In what will have interesting implications for search providers such as Google and Bing, the European Court of Justice has ruled they must amend search results at the request of the public and observe “the right to be forgotten”.
The court ruled that an internet search engine operator is responsible for the processing that it carries out of personal data that appears on web pages published by third parties.
It ruled: “Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.”
The ruling was made in a case that stemmed from a situation whereby a Spanish man called Mario Costeja González made a complaint to the Spanish data protection agency AEPD against daily newspaper La Vanguardia and against Google Spain.
Whenever a user would search his name on Google the top list of results would display links to two pages of La Vanguardia an announcement for a real-estate auction organised following attachment proceedings for the recovery of social security debts owed by González.
AEPD rejected his complaint on the basis that the information in question had been lawfully published.
But on the other hand it decided that Google should withdraw the data from its index.
The case progressed to the National High Court of Spain before being referred to the European Court of Justice.
In its judgment the Court decided that by organising the information and processing it through its servers, search providers like Google are responsible for the presentation of the data.
“In today’s judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive.
“The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results.”
Google has said that it is disappointed by the decision.
“This is a disappointing ruling for search engines and online publishers in general,” a Google spokesperson said.
“We are very surprised that it differs so dramatically from the Advocate General’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications.”
‘A victory for personal data of Europeans’
The right to be forgotten stems from a law proposed by the European Commission in 2012.
Writing on her Facebook page EU Justice Commissioner Viviane Reding described the judgment as a clear victory for the protection of the personal data of Europeans.
“Companies can no longer hide behind their servers being based in California or anywhere else in the world. Today’s judgment is strong tailwind for the data protection reform that the European Commission proposed in January 2012 as it confirms the main pillars of what we have inscribed in the data protection Regulation.
“No matter where the physical server of a company processing data is located, non-European companies, when offering services to European consumers, must apply European rules.
“The data belongs to the individual, not to the company. And unless there is a good reason to retain this data, an individual should be empowered – by law – to request erasure of this data,” Reding said.
