Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
Google Spain SL v. Agencia Espanola de Proteccion de Datos, E.C.J., No. C-131/12, 5/13/14
Holding: EU data subjects can compel Google Inc. and other Internet search engines to remove from their search results links to websites containing data subject's personal information.
Potential Impact:Landmark decision establishes extraterritorial jurisdiction of EU data protection law over Google and other Internet companies, imposes burdens on Web companies.
May 13 --Data subjects in the European Union have the right to compel Google Inc. and other Internet search engines to remove search results linking to websites containing personal information about them, the European Union Court of Justice ruled in a landmark May 13 decision Google Spain SL v. Agencia Espanola de Proteccion de Datos, E.C.J., No. C-131/12, 5/13/14).
The court's partial rejection of the June 2013 recommended opinion of the court's advocate general is a significant application by the EU's highest court of EU data protection law to U.S. companies such as Google, Microsoft Corp., Twitter Inc. and Facebook Inc.
The ruling is a "big deal," establishing extraterritorial jurisdiction of EU data protection law over Google, which has "strenuously resisted" efforts to apply EU law to it, Daniel P. Cooper, a partner with Covington & Burling LLP in London, told Bloomberg BNA May 13.
The ruling may "open the floodgates for tens of thousands of requests to have legal, publicly available information about Europeans taken out of a search index or links removed from websites," James Waterworth, the head of the Brussels office of the Computer& Communications Industry Association, said in a May 13 statement.
While the ruling targets Google directly, its impact may be felt by the press, social media sites and any other business that publishes links to personal information online, John Armstrong, a partner at CMS Cameron McKenna LLP in London, said in a May 13 statement.
Representatives from Twitter, Microsoft and Facebook declined May 13 Bloomberg BNA requests to comment.
The case concerned a Spanish national who asked the Spanish Data Protection Agency (AEPD) to enforce a right to be forgotten by obliging Google to remove search results linking his name to newspaper details of debt recovery proceedings against him.
Spain's National Court (Audiencia Nacional) referred the case to the ECJ in March 2012 for a clarification of EU law in relation to the complaint against Google .
Reform of the EU Data Protection Directive: 'Right to Be Forgotten'--What Should Be Forgotten and How?--Axel Spies, Bingham McCutchen LLP, Washington and Frankfurt
The European Commission's proposed data protection regulation to replace the EU Data Protection Directive (95/46/EC) included a right to be forgotten principle (11 PVLR 178, 1/30/12). The version of the proposed regulation approved by the European Parliament March 12 changed the nomenclature to a "right to erasure" of personal data, which also would create an obligation for companies receiving such a request to forward the request to other data processors to which the data have been transferred (13 PVLR 444, 3/17/14)
The activities in which search engines engage--"finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference"--amount to data processing, and a search engine carrying out such processing is a data controller under the EU's 1995 Data Protection Directive (95/46/EC), the ECJ said in its ruling.
Consequently, search engines should be required to remove links at the request of a data subject, a right that is granted by Article 14 of the Data Protection Directive, the court said.
In a May 13 statement accompanying the ruling, the court added that the right to request removal of links should be balanced with "the legitimate interest of internet users potentially interested in having access to that information," but the rights of data subjects "override, as a general rule, that interest of internet users."
The court statement added that search engine results could "establish a more or less detailed profile" of the person being searched. In addition, the court said, "the effect of the interference with the person's rights is heightened on account of the important role played by the internet and search engines in modern society."
"In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing," the court statement said.
Search engines should consider requests from data subjects for removal of links and could be referred by data subjects to national data protection authorities in cases of refusal, the court said.
The court found that Google's data processing operations are subject to EU data protection law, even though those operations take place outside the EU. The ruling also said that a request from a data subject for removal of a search engine link doesn't imply that the information to which the link refers should be removed from its initial place of publication.
On extraterritoriality, the court statement said it was sufficient that Google has a Spanish subsidiary that deals with advertising sales, because the Spanish subsidiary "is intended to promote and sell, in the member state in question, advertising space offered by the search engine in order to make the service offered by the engine profitable."
Cooper said the ruling could influence the decisions of non-EU corporations to establish subsidiaries in the EU.
"It marks a fork in the road where companies might retrench and pull back," because Internet companies would either have to accept falling under the jurisdiction of EU data protection law, or find other ways to "try to insulate themselves" from the law's provisions on data processing, he said.
"Companies are going to have to make that judgment call," Cooper said. However, some U.S. Internet companies are already established in EU countries, such as Ireland and the U.K., and for many companies the EU is "too important a market" to miss out on, he added.
On the court's finding that data subjects could oblige search engines to remove search results, but couldn't oblige publishers to remove original information, Cooper said the ruling had created "one rule for the publisher and another rule for the web search engine provider."
"It's just such a mind-bogglingly impossible decision," Fred Cate, distinguished professor and C. Ben Dutton professor of law at Indiana University Maurer School of Law, told Bloomberg News.
Google and other Web companies may have to consider charging a fee for European users to cover the costs of staff to comb through user requests to remove information, Cate, who is also a member of the advisory board for Bloomberg BNA's Privacy & Security Law Report, said.
Justin Brookman, director of the Center for Democracy and Technology's Project on Consumer Privacy told Bloomberg News that companies may now need "to hire an army of compliance officers" and that may make it difficult for companies to "scalably compete online."
Google said in a May 13 statement to Bloomberg BNA that "this is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the advocate general's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."
Advocate General Niilo Jääskinen in a June 2013 opinion said that search engines couldn't be considered controllers of data processing operations related to indexing of existing information and that data subjects shouldn't have the right to oblige search engines to delete links.
ECJ judgments usually follow closely the opinions of the advocate general.
Cooper said that perceived attempts by Google to sidestep EU data protection law were "perhaps offensive to European regulators" and "that may have influenced the thinking" behind the court judgment.
During many discussions over the past several years with EU data protection authorities, including arguments over data retention time limits (7 PVLR 1344, 9/15/08), Google took the position that EU laws shouldn't apply to its operations even if it had operations in EU member states because its U.S. operations retained control over the data.
AEPD: Will Affect More Than 220 Appeals
The ECJ's interpretation of the EU Data Protection Directive will affect more than 220 appeals made by Google against AEPD rulings that are currently before the National Court in Madrid, according to a May 13 AEPD statement provided to Bloomberg BNA.
"The agency welcomes the ECJ's support for its positions and its binding establishment of a correct interpretation of the directive in the future, as this will thwart renewed attempts to circumvent its application with resulting damage to those affected," the AEPD said.
The AEPD said the ECJ judgment "definitively clarifies" the responsibility of search engine operators with regard to personal data protection and "puts an end to the lack of protection generated by Google's refusal to submit to Spanish and European regulations on the matter."
There is no exact right to be forgotten principle in the relevant Spanish law, the Organic Data Protection Act (LOPD, Law 15/1999), but the court and AEPD broadly equated data subject correction rights with the principle.
The ruling sharply divided privacy advocates and those that said it could negatively affect free speech.
Sophie in 't Veld, Dutch liberal member of the European Parliament, said in a May 13 statement that "this is a landmark ruling. It puts results of a search engine within the scope of EU data protection rules."
"Big internet companies can no longer escape EU data protection rules by having their headquarters outside the EU," she said. "This ruling puts Europe firmly back in the lead when it comes to data protection in the world."
Mina Andreeva, spokeswoman for the European Commission, the EU's executive arm, said at a May 13 briefing that the ruling was "good news" and that it "reversed the burden of proof" with regard to the deletion of personal data. Whereas previously, consumers had to justify the deletion, data controllers now have to demonstrate why data shouldn't be deleted, she said.
However, Jodie Ginsberg, chief executive of Index on Censorship, which campaigns for free speech, said in a May 13 statement that the ruling "violates the fundamental principles of freedom of expression."
The judgment "allows individuals to complain to search engines about information they do not like with no legal oversight. This is akin to marching into a library and forcing it to pulp books," Ginsberg said.
The ECJ's ruling "opens the door to anyone who wants to whitewash their personal history," and is "a retrograde move that misunderstands the role and responsibility of search engines and the wider internet," Ginsberg added.
Paolo Balboni, scientific director of the European Privacy Association, a think tank supported by companies including Google, Facebook and Microsoft, said in a May 13 statement to Bloomberg BNA that "the limited liability of search engines should be preserved, they are not responsible for available content."
He added that the companies "must, however, actively cooperate in order to best protect the rights of European internet users."
By Stephen Gardner
With assistance from Brett Allan King in Madrid; Aoife White in Brussels; Dina Bass in Seattle; Sarah Frier in San Francisco; Brian Womack in San Francisco; Joel Rosenblatt in San Francisco
To contact the reporter on this story: Stephen Gardner in Brussels at firstname.lastname@example.org
The ECJ opinion is available at http://tinyurl.com/kt5bzvg.
The June 2013 opinion of the advocate general is available at http://bit.ly/1mSMc8O
Notify me when updates are available (No standing order will be created).
Put me on standing order
Notify me when new releases are available (no standing order will be created)