Brussels, 12/05/2014 (Agence Europe) - An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. Thus, if, following a search made on the basis of a person's name, the list of results displays a link to a web page which contains information on the person in question, that person may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results. This was the ruling issued by the European Court of Justice on Tuesday 13 May in Case C-131/12, disagreeing with the recommendations of Advocate-General Niilo Jaaskinen (see EUROPE 10874). The ruling lays down case law in this domain.
In 2010, Mario Costeja Gonzalez, a Spanish national, lodged a complaint against La Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain) and against Google Spain and Google Inc because when his name was entered in Google Search, the results displayed links to two La Vanguardia pages about a real-estate auction organised to recover social security debts owed by Costeja González, who demanded that the links be removed. Costeja González wants La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appears) or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant. The Spanish court asked the European Court of Justice about the application in this case of EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Spanish legislation in this domain, because the “establishment” (using the terms of the directive) processing the data, Google Inc., is located in the United States, outside the European Union, and its subsidiary, Google Spain, only acts as Google Inc's commercial representative for advertising and does not process the personal information of its Spanish advertising clients. The Spanish court wanted to know whether Google's legal position as a supplier of web search services meant it could be held liable for how personal information was dealt with as far as the directive is concerned and whether there is a law whereby one can demand the removal of information or the right to prevent personal information from showing up in a search engine.
In the ruling, the Court of Justice says that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine 'collects' data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, 'retrieves', 'records' and 'organises' the data in question, which it then 'stores' on its servers and, as the case may be, 'discloses' and 'makes available' to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the directive, must be classified as 'processing', regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media.' Secondly, the Court ruled that 'the operator of the search engine is the 'controller' in respect of that processing, within the meaning of the directive and the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive's requirements. Thirdly, the Court observes that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an 'establishment' within the meaning of the directive. The Court holds that where data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member state, has an establishment in a member state, the processing is carried out in the context of the activities of that establishment, within the meaning of the directive. The Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person's name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. The Court holds that a fair balance should be sought in particular between that interest and the data subject's fundamental rights, in particular the right to privacy and the right to protection of personal data. An individual may legitimately demand that personal information be removed if the information is out-of-date, inaccurate or excessive and therefore incompatible with processing under the terms of the EU directive.
One of the many reactions to the ruling was made by the liberal candidate to become the next president of the European Commission, Guy Verhofstadt, who welcomed the ruling for strengthening the right to have personal data removed for ordinary people without preventing general access to public information. He urged member states to stop delaying introduction of new EU rules on data protection. The Greens at the European Parliament welcomed the ruling for clarifying that the provision of publicly available personal information about an individual can be a new and serious attack on that individual's rights and that data protection rules apply as soon as search engines are used on the European market. The Greens want ministers to introduce a uniform regulation on data protection at the next JHA Council. (FG)