‘Memory Loss’

IP & IT analysis: The Court of Justice of the European Union (CJEU) took a step towards giving people the ‘right to be forgotten’ as it weighed up the right to privacy against the right to free speech. IT expert Alejandro Touriño, partner at law firm ECIJA, based in Madrid, considers the possible consequences of the decision.

Original news

Google Spain SL and another company v Agencia Espanola de proteccion de Datos (AEPD) and another C-131/12 [2014] All ER (D) 124 (May). The CJEU made a preliminary ruling concerning the interpretation of Directive 95/46/EC, arts 2(b), 4(d), 4(1)(a), 4(1)(c), 12(b) and 14(1)(a) ( the Data Protection Directive) and of the Charter of Fundamental Rights of the European Union, art 8. The request had been made in proceedings between, on the one hand, Google Spain SL and Google Inc and the Spanish Data Protection Agency (the AEPD), and Mr Costeja González concerning a decision by the AEPD upholding the complaint lodged by Mr Costeja González against those two companies and ordering Google Inc to adopt the measures necessary to withdraw personal data relating to Mr Costeja González from its index and to prevent access to the data in the future.

The Information Commissioner’s Office’s (ICO) response to the judgment can be found here.

What was the background to this case?

Mr Mario Costeja, a Spanish resident, filed a complaint against the newspaper La Vanguardia and against Google before the Spanish Data Protection Agency. The complaint was based on the fact that, when an internet user entered his name in the search engine, he would obtain links to two pages of La Vanguardia’s newspaper on which an announcement, mentioning his name, for a real-estate auction connected with attachment proceedings for the recovery of social security debts appeared.

The Spanish Data Protection Agency rejected the complaint in so far as it related to La Vanguardia, taking the view that the publication of the information in question was legally justified as it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible.

On the other hand, the complaint was upheld in so far as it was directed against Google considering that operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society.

Google brought an action against that decision before the Audiencia Nacional, which decided to stay the proceedings and to refer certain questions to the CJEU for a preliminary ruling with regard to the territorial application of the Data Protection Directive and regarding the scope of the right to be forgotten.

What did the CJEU decide?

The CJEU ruled that following a search made on the basis of a person’s name the operator of a search engine is obliged to remove links to web pages, published by third parties and containing information relating to that person from the search results. This applies when the name or information has not been removed in advance and even if its publication in itself on those pages is lawful.

If Google is responsible for the processing that it carries out of personal data which appears on web pages published by third parties–what does this mean for Google and the individual?

Google is obliged to remove search results related to the named person in the case that those results are not relevant or pertinent at certain point of time.

Individuals are entitled to directly request the search engine operator to remove their names from the list of results displayed and links to web pages and so on.

When it comes to search engine results when does the right to be forgotten apply to kick in–where does the balance lie?

According to the judgment, the first question is whether the data subject has a right that the information in question relating to him personally should, at certain point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name.

It is not necessary to find that the information in question in that list causes prejudice to the data subject.

The individual’s rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.

However, his rights would not override the interest of the general public in having access to the information in question if it appeared, for particular reasons (such as the role played by the data subject in public life) that the interference with his fundamental rights was justified.

Will this change the way we use the internet?

As we have recently read in the press, Google could soon announce a mechanism for Internet users to request that links to information about them be removed from the company’s search engine. Although it has not been made public by Google, it seems to be one of the first signs that Google is working through how to operate after a court ruling said Internet users could make such requests.

What does this mean for lawyers acting in this area?

For lawyers acting in this area, this ruling has two main consequences on their advice to clients:

– for companies which set up a branch or subsidiary in a member state which is intended to promote and sell advertising space offered by that company and which orientates its activity towards the inhabitants of that member state, personal data processing by those companies must be carried out in accordance with the law of the corresponding member state where the branch or subsidiary is established.

– o data subjects have a right that the information relating to them personally should no longer be linked to their name by a list of results displayed following a search made on the basis of their name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject.

Please read full interview here: ‘Memory Loss’