European citizens have the right to be forgotten, according to the Court of Justice of the European Union which ruled today that search engines must remove links relating to individuals, under certain circumstances, if requested to do so by the individuals themselves.
The case centres on the definition of a search engine’s role under EU data privacy law. Google had appealed a decision of the Spanish Data Privacy Commissioner in the case of Mario Cortejo, a Spanish lawyer who had demanded that online newspaper reportsof debt proceedings against him back in 1998 be taken down, and that search results relating to the online articles be also purged. The Commissioner had ruled in favour of the online newspapers, arguing that the reports were true at the time, but he said that Google must remove the articles from its search results.
The Court initially commissioned an opinion from its Advocate General, Niilo Jaaskinen, which appeared to support Google’s argument that it was merely aggregating data controlled by others, in this case the newspapers, and that a search engine was not a ‘data controller’ as defined by the Data Protection Directive 95/46/EC.
However today’s ruling by the court holds that Google is in fact a Data Controller, and that it is therefore bound by the data protection rules in the directive which are enacted into legislation in the EU member states.
Under the Data Protection Directive, Data Controllers must ensure that personal data is “adequate, relevant and not excessive”. In its ruling, the Court found that:
“even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed”
It added that a request such as that made by Mr Cortejo should be considered in the light of
“whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name”.
The idea of a “right to be forgotten” is contained in proposals for upcoming legislation already published by the EU Justice Commissioner, Viviane Reding, who expressed her approval of the court’s decision in a post on Facebook.
Insofar as it appears to impose significant new data-protection responsibilities on search engines, the decision could have significant implications for Google and others, as well as for data protection authorities.
Related articles
[…] You Have the Right to Be Forgotten: European Court Rules against Google […]
[…] You Have the Right to Be Forgotten: European Court Rules against Google […]
[…] body for the shared interests of its members: Irish ISPs. Recent developments, such as the Right to Be Forgotten ruling in Europe, are a source of concern for the association, which takes the view that […]