People have the right to be forgotten online, an EU court ruled on Tuesday.
The ruling, handed down by the European Union’s Court of Justice (ECJ), went against Google in a case concerning the removal of links to two pages published in 1998 by Spanish newspaper La Vanguardia.
The court said in its ruling that under existing EU data protection laws, search engine operators must be held responsible for processing personal data that appear on web pages published by third parties, so if the subject of a search doesn’t want said data to pop up, he or she has the right to ask that they be taken down.
From the ruling:
If, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.
The case, brought by Spanish national Mario Costeja González in 2010, concerned links to two newspaper pages from January and March 1998.
The pages contained an announcement for a real-estate auction held to recover social security debts owed by Costeja González: he was in hot water financially, and his home was repossessed.
The pages were showing up in Google search years after the debts were resolved, in spite of the search results no longer being relevant, he said.
The Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) rejected his request that La Vanguardia take down the pages, given that the newspaper was within its rights to publish the information.
But the AEPD did agree with Costeja González when it came to his second request: that Google Spain or Google Inc. be required to either remove the data and links from search results or bury them.
The AEPD asked the two companies to make it happen, but Google fought back, bringing two actions before the Audiencia Nacional (National High Court, Spain) to get the AEPD’s decision annulled.
In its Tuesday ruling, the ECJ pointed out that the information a search engine returns on a person “potentially concerns a vast number of aspects of his private life” that might previously never have been stitched together in the manner that search engines conveniently do – or, at least, without a search engine, a structured overview of a person’s information could only be achieved “with great difficulty.”
And once it’s out there, it’s everywhere, the court pointed out:
The effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous. In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.
The court noted that it was aware that removing links from results could affect the legitimate interests of people potentially interested in having access to the information.
Accordingly, the ruling held that the legitimate interests of internet users have to be balanced with the privacy rights of an individual, and that the sensitivity of given data will come under consideration in order to achieve a “fair balance” between the two.
But in a nutshell, these are the new rules of the game – at least, until opponents potentially challenge the ruling:
... the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
Why would anybody be against the right to be forgotten? As it is, some privacy advocates are calling this great news:
— Paul Nemitz (@PaulNemitz) May 13, 2014
In a Facebook post, EU justice commissioner Viviane Reding called the court decision a clear victory for the protection of the personal data of Europeans:
The ruling confirms the need to bring today's data protection rules from the 'digital stone age' into today's modern computing world.
The decision apparently preempts lengthy negotiations within the EU over a new data protection directive which could establish a limited “right to be forgotten”.
In fact, the EU judges made clear they interpreted the EU data protection directive as having already established a “right to be forgotten”.
Google referred to those prior negotiations in a statement that said the ruling is “disappointing” for search engines and online publishers in general, that it differs “dramatically” from the advocate general’s opinion and the warnings and consequences that he spelled out, and that the company needs time to digest the implications.
As The Guardian’s James Ball points out, the idea of “putting the genie back into the bottle” when it comes to search results is attractive, but the reality is going to be a “quagmire.”
Some of the issues that could arise:
- The ruling affects Google because it’s got an established operation in Spain, but search engines based in the US will likely be covered by the First Amendment, which could protect them from being forced to restrict search results.
- A slew of questions, such as: Does it matter if the subject is a celebrity or a politician? Who determines the shelf life of data? Do people have a right to bury heinous crimes, such as murder? What if a person runs for office after hosing down their search results?
The right to be forgotten is obviously a complicated issue. It pits individuals’ privacy rights against the rights of internet users to have access to uncensored information.
What do you think – privacy win or quagmire? Please share your thoughts in the comments section below.Follow @NakedSecurity