In the long-awaited judgment in the Google Spain and Google case CJEU did not follow the opinion of Advocate General. It adopted an approach which is much stricter towards the operators of search engines. After striking down the data retention directive, CJEU yet again took a strong stand in favour of privacy. Interestingly only twice in the entire judgment did the Court refer to freedom of expression.
Search engines enable us to seek, receive and impart information. They render online content accessible and useful. This is why limiting the reach of search engines and demanding to withdraw some links from search results should be done with caution. The role of search engines has been recognized in 2012 by the Council of Europe Committee of Ministers who considered it essential that search engines be allowed to freely crawl and index the information that is openly available on the Web and intended for mass outreach (see: Recommendation CM/Rec(2012)3 of the Committee of Ministers to member States on the protection of human rights with regard to search engines, adopted on 4 April 2012).
At the same time, search engines can retrieve and group widespread information of various types about a single person. These capabilities may significantly affect individuals, both in their personal lives and within society. In the recommendations mentioned above the Committee of Ministers recognized the necessity to differentiate between various types of content. According to the Committee there is a need to review search ranking and indexing of content which is not intended for mass communication or mass communication in aggregate. The Committee proposed for example listing content sufficiently low in search results in order to strike a balance between the accessibility of the content in question and the intentions of its producer. The Committee recommended States to “enhance transparency in the collection of personal data and the legitimate purposes for which they are being processed”, “enable users to access easily, and, where appropriate, to correct or delete their personal data processed by search engine providers” and “develop tools to minimise the collection and processing of personal data, including enforcing limited retention periods, adequate irreversible anonymisation, as well as tools for the deletion of data”. Today’s judgment of the CJEU is in line with the Committee’s concerns, and seems to take an even stricter approach as regards the obligations of operators of search engines.
The case Google Spain and Google (C-131/12) originated from a complaint of a private person, Spanish citizen, who demanded from Google the removal of a number of references from search results. Spanish Data Protection Agency supported this request, but stated at the same time, that the information available on the online page of the local newspaper, where it originally appeared, could stay there because of its lawful character. Spain’s highest court had doubts whether the decision about the removal of the data from search indexes was correct and made a reference for a preliminary ruling to the CJEU. The national court asked, among others, whether the data subject should be allowed to request from Google de-indexing of information that refers to him personally.
CJEU ruled today that, indeed, it is possible to demand from operators of search engines the removal of links from search results. This is possible even if the content linked to is lawful and its original source remains untouched – the Court clearly distinguished between the right to publish information and to display it in the search result. It underscored that these activities have a different level of impact on the individual and their right to privacy. Referring to Article 7 of the Charter that guarantees the right to respect for private life and article 8 which proclaims the right to the protection of personal data, and relying on the provisions of Data Protection Directive, the Court decided that it is possible to order the operator of the search engine removal of links that are displayed in search results and that redirect to web pages published by third parties containing information relating to a person. The Court held that “given the ease with which information published on a website can be replicated on other sites and the fact that the persons responsible for its publication are not always subject to European Union legislation, effective and complete protection of data users could not be achieved if the latter had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites.”
Moreover, according to the Court individual rights override not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. At the same time, the Court acknowledged that there may be exceptions to that general approach.
While the Advocate General downplayed the role of search engines, claiming that is was passive, CJEU underscored that search engines are a key actor in the overall dissemination of data and that they render it accessible to internet user who otherwise would not find it. Thanks to search engines users can obtain a “structured overview” of information relating to individuals and establish their profiles and that “the activity of a search engine is (…) liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data”. According to the Court activities of search engines not only constitute an independent processing of personal data, operators of search engines are also data controllers and have all the obligations that follow from that fact.
Zuzanna Warso, z.warso at hfhr.org.pl
