The Right to Be Forgotten (Google v. Spain)

Summary

In Google v. Spain, the European Court of Justice ruled that the European citizens have a right to request that commercial search firms, such as Google, that gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant. The Court did not say newspapers should remove articles. The Court found that the fundamental right to privacy is greater than the economic interest of the commercial firm and, in some circumstances, the public interest interest in access to Information. The European Court affirmed the judgment of the Spanish Data Protection Agency which upheld press freedoms and rejected a request to have the article concerning personal bankruptcy removed from the web site of the press organization.

EPIC Resources

U.S. Attitudes Toward the Right to Be Forgotten - IndustryView 2014

From Software Advice's survey:

When Europe’s highest court ruled in May that individuals had a “right to be forgotten”—i.e., they have the right to request that outdated or “irrelevant” information about them be removed from search results—the shockwaves were heard around the world.

Given the First Amendment and the traditionally strong emphasis on the public’s right to know in American culture, it may be difficult to imagine such a ruling happening stateside. But American culture is also traditionally strong on protecting privacy—and in fact, in January 2015, variant legislation applicable only to minors will become law in California. What if U.S. citizens start demanding the right to be forgotten, too?

We at Software Advice were intrigued by the possibility, so we surveyed 500 adults in the U.S. to find out how they felt about the right to be forgotten and the problems the law seeks to address. We then quizzed a panel of experts for their opinions on this complex issue.

Key Findings:

Sixty-one percent of Americans believe some version of the right to be forgotten is necessary.

Thirty-nine percent want a European-style blanket right to be forgotten, without restrictions.

Nearly half of respondents were concerned that "irrelevant" search results can harm a person’s reputation.

Opinions on the RIght to Remove Irrelevant Information from Search Results

Top News

Background

Procedural History

In 2010 Mario Costeja González, filed a complaint with the Agencia Española de Protección de Datos (AEDP), the Spanish Data Protection Agency, against a local newspaper and Google Spain for claims relating to auction notices mentioning González published in 1998. The notices concerned real estate auctions held to secure repayment of González's social security debts. González contended that these pages were no longer necessary because "the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant." He sought to have the local newspaper, La Vanguardia, remove the pages or alter them so his personal information was no longer displayed. He also sought for Google Inc. to remove the links to the articles in question so that the information no longer appeared in Google Search results.

The AEDP dismissed the plaintiff's claims against the newspaper, but allowed those against Google. Google appealed to Spain's high court, which in turn referred three questions to the ECJ:

(1) Whether EU rules apply to search engines if they have a branch or subsidiary in a Member State;

(2) Whether the Directive applies to search engines; and

(3) Whether an individual has the right to request that their personal data be removed from search results (i.e. the "right to be forgotten").

ECJ Decision

The ECJ first ruled that the Directive applies to search engines. The Directive sets forth rules for "controllers" involved in the "processing of personal data." The ECJ held that search engines engage in "processing of data" because they explore the internet "automatically, constantly and systematically in search of the information." The ECJ further held that search engines are "controllers" within the meaning of the Directive because search engines "determine[] the purposes and means of" data processing.

Second, the Court concluded that because Google Inc. had a subsidiary (Google Spain) operating within the territory of Spain (a Member State), even though Google itself is based within a non-member state (the United States), the directive properly applied to Google and Google operated as "an 'establishment' within the meaning of the directive." The Court concluded this despite Google's assertion that the data was not processed within Spain, because Google intended to "promote and sell, in the Member State in question, advertising space offered by the search engine in order to make the service offered by the engine profitable." For these reasons, ruled the Court, Google has an obligation in certain cases to remove the links to pages displayed by third parties, even if the information published by those third parties is itself lawful.

Third, the ECJ held that individuals have a right to request search engines to remove links to personal information. The Court held Article 12(b) of the Directive gives individuals the right to ask search engine operators to erase search results that are incompatible with Article 6. Article 12(b) of the Directive give data subjects the right to "rectification, erasure or blocking of data the processing of which does not comply with the provisions of [the] Directive." Article 6 requires that data is "adequate, relevant and not excessive in relation to the purposes for which they are collected", "accurate and, where necessary, kept up to date", and "kept in a form which permits identification of data subjects for no longer than necessary." The Court also made clear that it is not necessary to find that links cause prejudice to the data subject. The Court held that "a fair balance should be sought in particular between that interest and the data subject's fundamental rights." However, "those rights override, as a rule, not only the economic interest of the operator of a search engine but also the interest of the general public in finding that information . . . ." This balance would vary on a case-by-case basis and may depend on "the nature of the information in question and its sensitivity for the data subject's private life" and the public's interest in the information. The public's interest, in turn, may vary depending on whether the individual is a public figure. According to the Court, Google's economic interest and the public's interest in links to Gonzalez's auction notices did not outweigh the serious interference with Gonzalez's fundamental rights under the Directive.

Legal Documents

Additional Resources

EPIC's Related Work

  • Expungement

  • The social consequences of a criminal record can lead to the denial of an individual's right to civic participation. Life, subsequent to an arrest, is permanently altered. Regardless of whether an individual has been convicted, an arrest or citation typically persists on a criminal record. Therefore, even a person who has had the charges against them dropped may be subject to a degree of social ostracism and a de facto public finding of guilt. Some states permit individuals who are arrested, but not convicted, to expunge their arrest records. Others permit some convicts to apply for expungements after time has passed from the completion of their sentences.

  • G.D. v. Kenny

  • In G.D. v. Kenny, a case raising both defamation and privacy tort claims, the Supreme Court of New Jersey has held that defendants are entitled to assert truth as a defense, even when the relevant facts are subject to an expungement order under a state statute. The Court relied on the fact that criminal conviction information is disseminated before the entry of an expungement judgement. In an amicus brief, EPIC had urged the New Jersey Supreme Court to preserve the value of expungement and further argued that data broker firms will make available inaccurate and incomplete information if expungement orders are not enforced by the state. The case may have implications for the "Right to be Forgotten."

News

Share this page:

Defend Privacy. Support EPIC.
EPIC Mueller Report book
US Needs a Data Protection Agency