In May the Court of Justice of the European Union (CJEU) issued a surprising ruling in the data protection case, Costeja, which concerned Google’s search engine.
The EU Data Protection Directive was adopted in 1995, before the advent of search engines. It is no surprise, therefore, that almost 20 years later the law is in some need of clarification in this area. In Costeja the CJEU was asked to decide whether the Directive applies to Google Inc. and, if it does, what Google’s obligations under the Directive are in relation to its search engine results.
Mr Costeja, a Spanish national, requested that Google remove links including his personal data from its search results. The personal data in question was two articles in the archives of a Spanish newspaper containing an auction notice of Mr Costeja’s repossessed home. Links to these articles appeared when a search of his name was carried out on the search engine.
The Spanish High Court referred this case to the CJEU to clarify elements of the Directive in relation to search engines. The CJEU ruled that, upon request, Google Inc. is obliged to remove links from the search results of an individual’s name when they are ‘inadequate, irrelevant or no longer relevant, or excessive’. Surprisingly, these links should be removed even when they link to content that is lawfully hosted on a third party site, as was the case in Costeja. This is not a wholesale ‘right to be forgotten’ however, as only some links will qualify for removal under the ruling. In particular, where there is a public interest in having access to the content, the link to that content will not qualify for removal.
Given the digital age we live in, this decision will have a significant impact on companies that offer services online (not just search engines) and their users. In particular, search engines may have to individually consider each request they receive to assess whether it is a link that should be removed. This is very contentious; some believe it bolsters an individual’s right to privacy, while others feel it impedes on freedom of expression by allowing individuals to censor the internet.
Google Inc. has now launched an online form whereby individuals can request that specific URLs no longer be linked to a query for their name in Google’s search results. Google Inc. is the first search engine to take such a step in complying with this ruling, and it will be interesting to see how other search engines, such as Yahoo or Bing, follow.
Data protection law is a rapidly developing area of law and this decision has a range of implications which undoubtedly data protection lawyers will be asked to deal with. Firstly, lawyers will have to advise on the scope of this decision, which will inevitably involve litigation over the coming years. Additionally, the right to request that search engines remove links, granted in this decision, could result in further references to the CJEU regarding analogous situations, for example social networking sites. So it is likely that other companies with large databases will watch the evolution of this right with some nervousness.
Finally, as Costeja rules that Google Inc., an American corporation, is subject to EU data protection law by virtue of its EU sales office, it is likely that other companies with a similar corporate set up will now need advice in this area moving forward.
Francion Brooks is a trainee solicitor at Bristows