By Umit Utku
Mario Costeja González filed a complaint in 2010 with the Spanish Data Protection Agency (AEPD) against three principal parties: La Vanguardia Ediciones SL (a Spanish Daily Newspaper), Google Spain and Google Inc. When his name was researched on the popular search engine, two specific items contained an attachment redirecting to a newspaper’s feature – dated back to 1998 – advertising a real-estate auction for his house, which had been repossessed due to impending debts.
Mr González argued that the attachment in question mentioning his debts was no longer relevant because they had been fully settled. According to him, the presence of this out-dated attachment was infringing his privacy rights and consequently requested the removal or alteration of this item. The AEPD rejected the complaint against La Vanguardia stating that the publication in question was lawful, but upheld the complaint against Google Spain and Google Inc. In an attempt to challenge the AEPD’s decision, Google Spain and Google Inc. brought the case to the National High Court of Spain, which then referred it to the Court of Justice of the EU (ECJ). These questions concerned whether the 1995 Data Protection Directive also applied to search engines. Another issue regarded whether this directive applied to Google Spain because the company’s data processing servers are actually situated in the United States, outside EU jurisdiction. And finally, it was also asked whether an individual person can plea for the removal of his or her personal data from public access via a search engine – a request promptly identified as ‘the right to be forgotten’.
The ECJ Ruling
On 13th of May 2014, the ECJ presented its deliberations on the matter:
First, concerning the jurisdiction of EU legislation, the ECJ stated that if a branch or a subsidiary of a search engine is located in any member state, EU laws will apply for that company within the borders of the Union regardless of the location of the servers.
Second, regarding the applicability of Data Protection Directive to search engines, the ECJ stated that search engines are controllers of personal data and therefore compelled to follow European law, when handling such information. Since the directive applies also to search engines, the ‘right to be forgotten’ becomes automatically valid in this case.
Third, and most crucially, the ECJ ruled that an individual has the right – under certain specific circumstances – to request the removal of a link concerning private data information. This right only applies if such data appears to be inadequate, irrelevant, inaccurate or excessive. The ECJ explicitly remarked that the right to be forgotten is not unconditional, but must be balanced vis-à-vis other fundamental rights such as the freedom of expression and the media.
Protecting Individual Privacy
Although social media made it look like an entirely new principle, the ‘right to be forgotten’ has been legally binding for the past two decades since the enactment of the Data Protection Directive. The ruling confirmed the applicability of this directive to search engines such as Google and – considering the fame of this firm – the ruling received such extensive coverage. It could be argued that this ruling is just an update to the directive resulting from the technological advancements witnessed over the last two decades such as the appearance of search engines. After all, Google was founded only in 1997. Several experts argue that individuals should be entitled to ‘the right to be forgotten’ and monitor carefully the information concerning themselves on the Internet, especially if out-dated and inaccurate. In the case of Mr González, and many others that have already advanced complaints to Google, the information was either not relevant anymore or out-dated. In some cases, such obsolete information could influence key aspects of personal lives such as an individual’s employability.
Infringing the Freedom of Information
On the other hand, there are concerns that this ruling could provide justification for certain individuals or companies to remove negative information about them, regardless of whether such information is perfectly accurate or legally relevant.
Recently, the link to an article concerning the resignation of an investment banker during the salient moments of the financial crisis has been removed from the list of search results on Google, after a successful petition had been filed with the firm. Robert Peston wrote this article, which the BBC published in October 2007, analysing the problems faced by Bank of America – Merrill Lynch and mentioning the resignation of its CEO, Stanley O’Neal. Protesting against the removal of the link, the renowned BBC columnist claimed that – by taking this course of action – Google “kills journalism”. The Times also reacted with outrage writing that the ECJ ruling will help the rich and powerful to censor embarrassing but truthful information about them. Mr O’Neal claimed that he had no knowledge of the request to remove this specific link from search results.
Google has revealed that requests for removal of links are: a politician seeking re-election, a convicted child pornographer, and a doctor who received negative reviews from patients. Professor Adam Thierrer – a media expert at George Mason University – stated that the ‘right to be forgotten’ should be relabelled as the ‘right to censor and re-write history’.
If you wanted to remove a link to an article about yourself, what steps do you need to take? You would have to contact Google and ask for the removal of this personal data. Google would then have to decide whether your request is in line with the ruling and decide whether to remove the link. If the company refuses such request, then it is possible to go to court over the matter. This ruling is likely to impose a considerable burden on how search engines operate in Europe. Journalists may also be indirectly affected, since most requests have hitherto led to the removal of links to articles and blogs.
Simon Hughes MP recently stated at a parliamentary committee hearing that he was against restricting access to information. “I don't think we want the law to develop in the way that is implied by the ECJ judgment, which is that you close down access to information in the EU which is open in the rest of the world. We do not agree with the present text”, he remarked during the hearing. Ever since the ruling, 70,000 requests to take down circa 250,000 links from Google’s European search engine subsidiary have been recorded. The company is currently receiving 1,000 requests each day that have to be scrutinised by its lawyers.
Daring the Internet’s Quicksand?
Privacy is a topic acquiring more importance each day, due to our ever-increasing amount of time spent on the Internet. We shop, store our credit card numbers, communicate, and keep other sensitive information online. It is therefore almost inevitable that legislation safeguarding personal privacy needs to expand its scope alongside any new technological development. However, the re-affirmation of ‘the right to be forgotten’ brought with itself more questions than answers. Why should search engines be responsible for articles published by third parties? How are they supposed to establish whether something is out-dated? After all, something that is irrelevant today may well become the opposite tomorrow. The reason why a lot of people, as well as firms, are still confused about this ruling lies in its ambiguities. Although likely to work in favour of individuals and companies, it will prove extremely burdensome to search engines and journalists. The ruling does attempt to acknowledge freedom of speech, but does so in a rather unusual way. It is like allowing a library to keep determinate books while – at the same time – deleting their respective entries from the catalogue, thereby making it nearly impossible to find what you are looking for.