On 13 May 2014, the CJEU issued an important decision regarding data protection law and internet search engines. The CJEU ruled that an internet search engine operator such as Google is responsible for the processing that it carries out of personal data that appears on web pages published by third parties. The data subject may request from Google that personal information is no longer made available to the general public by its inclusion in a list of results. The data subject’s fundamental rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information.
On 13 May 2014, the Court of Justice of the European Union (“CJEU”) issued an important decision regarding the applicability of data protection law to internet search engines1. The CJEU ruled that an internet search engine operator is responsible for the processing that it carries out of personal data that appear on web pages published by third parties. Accordingly, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page that contains information on that person, that data subject may approach the operator directly and, where the operator does not grant this request, bring the matter before the competent authorities to obtain the removal of that link from the list of results.
In 2010, Mario Costeja González, a Spanish national, lodged a complaint against the publisher of a daily newspaper, La Vanguardia, and against Google Spain and Google Inc. According to Mr Costeja González, when an internet user entered his name in the search engine of the Google group (“Google Search”), the list of results would display links to two pages of La Vanguardia, dated 1998. Those pages contained an announcement for a real-estate auction organized following attachment proceedings for the recovery of social security debts owed by Mr Costeja González.
With that complaint, Mr Costeja González requested that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appeared) or to use certain tools made available by search engines in order to protect the data. He also requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Mr Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
Data protection law is applicable to internet search engines such as Google
Firstly, the CJEU considered that in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine “collects” such data which it subsequently “retrieves”, “records” and “organizes” within the framework of its indexing programmes, and “stores” on its servers. Following a search, the search engine “discloses” and “makes available” those data to its users in the form of lists of search results.
These operations must be classified as “processing”, regardless of the fact that the operator of the search engine also carries out the same operations in respect of other types of information and does not distinguish between the latter and personal data. It is also irrelevant that those data have already been published on the internet and are not altered by the search engine.
As a data controller, Google (or any other search engine) needs to ensure that its operations are compliant with data protection law.
Fair balance between the data subject’s fundamental rights, the economic interest of search engines such as Google and the interest of internet users in having access to information
Another question was when a search engine operator such as Google is obliged to remove, from the list of results displayed following a search made on the basis of a person’s name, links to web pages published by third parties and containing information relating to that person.
The CJEU emphasized that the Data Protection Directive (95/46) seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data. The processing of personal data by Google can significantly affect the fundamental right to privacy and to the protection of personal data when the search by means of Google is carried out on the basis of a person’s name.
That is because that processing enables internet users to obtain through the list of results a structured overview of the information relating to that person that can be found on the internet. This information potentially concerns a vast number of aspects of their private life that, without the search engine, could not have been interconnected, or only with great difficulty. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important roles played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.
Accordingly, the potential interference with the data subject’s fundamental rights cannot be justified by merely the economic interest of the search engine operator.
A fair balance should also be sought between the data subject’s fundamental rights and the legitimate interest of internet users in having access to information (concerning the data subject). As a general rule, the data subject’s fundamental rights override the interest of the internet users. That balance may, however, depend on the nature of the information and its sensitivity in relation to the data subject’s private life and on the interest of the public in having that information. The latter in particular may vary according to the role played by the data subject in public life.
The previous or simultaneous removal of the data subject’s name and information from the web page on which they were published is not required
Google can be obliged to remove from the results list displayed following a search made on the basis of that person’s name links to third party websites containing information on that person. The previous or simultaneous erasure of that name and information from the web page on which they were published is not required.
The reasons for this are threefold. Firstly, effective and complete protection of data subjects could not be achieved if data subjects had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites. Secondly, the processing by the website publishers may sometimes be carried out “solely for journalistic purposes” and thus may benefit from derogations from the data protection law requirements, whereas that does not appear to be so in the case of the processing carried out by Google. Thirdly, the inclusion in the list of Google search results of a web page with information relating to a person makes access to that information appreciably easier for any internet user. The inclusion of information in the list of Google search results is therefore liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.
Right to be forgotten?
The last question was whether a data subject can request that links to web pages are removed from a list of results because he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time. The CJEU held that it should be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name. If so, the links to those web pages must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.
