Spain High Court Issues First Right to Forget Ruling

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Brett Allan King

Oct. 21 — In its first-ever ruling on the right to be forgotten, Spain's Supreme Court has recognized the need for insertion of a Web code to prevent search engine indexing of published personal information, but also said in a ruling made public Oct. 19 that personal data protections may not be used to rewrite history.

Spain's highest court said that online publications must include code to prevent the indexing of archival data on non-public persons by Google Inc., Microsoft Inc. and other companies that offer search engines. However, the companies may continue to index material in their archives without eliminating the names of data subjects, the court said.

In light of the Supreme Court ruling, newspapers and other media companies with online archives should clearly establish in their internal regulations when news items cease to be current and whether or not the personal data in items sent to the historical archive refers to persons of public relevance, Efrén Santos, a partner at the data protection law firm ICEF Consultores in Madrid, told Bloomberg BNA Oct. 21.

Under the ruling, if a person in an archived news item is of public relevance, the media company may allow indexing of personal data in news archives for access through Internet search engines; in the case of non-public persons, the company may index the personal data for searches within the archive itself but not for Internet search engines, Santos said.

“I think all digital editions should get together and establish a singular common code for all the companies dedicated to this type of activity, to establish some common rules with regard to the use of personal data for news purposes and for archival purposes,” he said.

Spanish Origins of EU Right to Forget 

In a landmark May 2014 ruling, the European Court of Justice held that EU data subjects have the right to compel Google and other Internet search engines to remove results linking to websites containing personal information about them if their fundamental right to individual privacy outweighs the public's right to know.

Spain's National Court prompted the ECJ action after it asked the European Union's top court for a preliminary ruling on whether the right to opposition and correction provisions of Spain's data protection framework law allowed the Spanish Data Protection Agency (AEPD) to force Google to remove material from its search engine results.

In January, the National Court issued its first rulings applying the right to be forgotten doctrine in favor of data subjects.

30-Year-Old Newspaper Stories 

The present case goes back to 1985, when the print daily El País published information about the conviction and imprisonment of individuals implicated in drug trafficking and drug use. Decades later, when they had remade their personal and professional lives, the data subjects anonymously referred to as “A and B” requested that their names be eliminated from the newspaper's historical archive and the source code on the Web page be altered in order to protect their rights to honor, privacy and data protection.

The Supreme Court ruling partly upheld the media company's appeal of a Barcelona Provincial Court ruling which ordered it to eliminate source code from its Web page and not include the data subjects' names or initials in the original reporting.

The supreme court balanced the individual right to privacy with the public right to information. On one hand, the court upheld the requirement to use code on Web pages to help thwart access by search engines; on the other, it said it would be excessive for an online archive to have to eliminate names from its past articles.

The Supreme Court ruling determined that the right to be forgotten “does not apply so anyone can tailor-fit their past, forcing Web page editors and search engine managers to eliminate the treatment of personal data when it is associated with events not deemed positive.”

At the same time, the court said the right does protect a non-public person against general Internet searches revealing information that is “obsolete” but permanently harmful to their honor or privacy. In this regard, publications' digital archives should employ “robot.txt code or non index commands, etc.” to disallow search engine indexing.

Ruling Criticized 

“The ruling falls short on two points, which to me are of vital importance,” Santos said.

According to Santos, the ruling should have established a clear time period for determining when a news items ceases to be “current” and publicly relevant to become an item of a historical nature.

Likewise, he said the court ignored provisions of the country's framework data protection statute that require data handlers to petition the AEPD to declare data worthy of different treatment based on their historic, scientific or statistical value.

Although the ruling was fundamentally aimed at media companies, it might conceivably affect other companies that link online to “historic” news items about non-public persons and allow readers to comment on them, Santos said.

Those companies would also be prohibited from using their source code to allow for indexing by Internet search engines, he said.

To contact the reporter on this story: Brett Allan King in Madrid at correspondents@bna.com

To contact the editor responsible for this story: Donald G. Aplin at daplin@bna.com