The Right to Erasure is Already Here: Regulators and Disgruntled People Win Greater Control Over Search Results

In a decision with profound implications for the Internet economy, the European Court of Justice ruled that, for privacy reasons, search engines must sometimes alter search results on demand by removing links to material containing personal data, even if that material was lawfully published on the underlying websites. You can read the Court’s full judgment here and the Court’s synopsis/press release here.

This case involved January and March 1998 announcements in the Spanish newspaper La Vanguardia that property owned by Spanish citizen Mario Costeja González would be auctioned for the recovery of social security debts. You can find one of the announcements about two-thirds down the right-hand column of this newspaper page. In 2009, Google’s search results still listed links to the announcements, but Mr. Costeja objected, arguing that the debt issues were no longer relevant since they had been resolved many years prior.

Mr. Costeja filed a complaint with the Spanish data protection authority (“DPA”), asking that the newspaper be
ordered to take down the article and that Google be required to cease linking to it. The DPA refused to order the newspaper to cease publication because the Ministry of Labor and Social Affairs had ordered the publication to give maximum publicity to the auction to secure as many bidders as possible. The DPA did, however, order Google to remove its links to those articles.

Google responded by suing the DPA. After a series of procedural events(including a 2013 opinion issued by an adviser to the court implying that Google did not need to remove the links), the European Court of Justice has sided with the DPA, rulin
g as follows:

1. When search engines crawl the web and index it for search purposes, and the web pages contain personal data, the search engines are processing personal data within the meaning of the EU Data Protection Directive.
2. That processing of personal data “is carried out in the context of the activities of an establishment of the controller on the territory of a Member State” within the meaning of the EU Data Protection Directive when “the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.” This is a trigger for the application of the EU Data Protection Directive.
3. The rights of rectification, erasure or blocking of personal data, and of objection to the processing of personal data, which EU residents have under current national laws, apply to search engine results. Specifically, when certain conditions are satisfied, those rights are to be interpreted as obligating a search engine “to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person . . . even, as the case may be, when its publication in itself on those pages is lawful.”
4. When determining whether those conditions mentioned in #3 are satisfied, it is not necessary to find that the search results cause prejudice to the data subject. Generally, the data subject’s wishes may “override . . . not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information . . . . However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having . . . access to the information in question.”

The decision has already been heavily criticized on the grounds that it poses a threat to free speech in Europe, as it could be misused by those who have something to hide and who can simply demand that information be taken down. Others have expressed concern that the decision creates unnecessary and costly burdens on search engines, who must now be in the business of evaluating the validity of and responding to individuals’ complaints about search results found when searching for their names. These extra burdens could cause less information to be available online and could lead search engines to make fast decisions to remove content rather than take the time to determine whether a complaint is legitimate.

As the European Court of Justice is the highest court in the EU, Google will not be able to appeal the decision.