European Court of Justice compels internet search engine operators to respect ‘right to be forgotten’

The European Court of Justice had – in the course of a preliminary ruling – to answer the question, if online search engines have to delete search results with regard to ‘private’ information. The facts of the case involve an underlying complaint of a Spaniard against Google for cancellation of entries in the results list that were displayed when you search for the name of the person concerned. In the present case, it was actually an accessible online newspaper article from 1998, which included information about the seizure of land by the person concerned. Due to the fact that any procedures with regard to the land seizure were already done, the Spaniard requested the cancellation of the information, which can be found online, at the competent Spanish Data Protection Supervisory authority. Google has sued subsequently against the decision granting the Data Protection Supervisory authority, which in turn led to the subject preliminary ruling.

By judgment of 13 May 2014, the European Court of Justice ruled (C-131/12), that an internet search engine operator is ‘responsible for the processing that it carries out of personal data which appear on web pages published by third parties’[1] within the meaning of Article 2 (b) of the Data Protection Directive 95/46/EC.

With regard to the directive’s territorial scope, the Court observes that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an ‘establishment’ within the meaning of the directive. Because of that fact, people – like Spanish nationals – specified in the Data Protection Directive are entitled to claim for withdrawal of search results that relate to personal data. The so called ‘right to be forgotten’ just undergoes a restriction if there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.

In the context of Data Protection regulations the European Court of Justice clarified that the operator of a search engine ‘collects’ data within the meaning of the directive by searching ‘automatically’, ‘constantly’ and ‘systematically’ for information published on the internet. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the search results in the form of so called hit lists. The European Court of Justice explains with regard to the personal data as follows:

‘Inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements.’[2]

The European Court of Justice determines by now that the operator of the search engine is, in certain circumstances, obliged to

‘remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name.’[3]

The Court makes it clear that such an obligation may also exist in a case – where that name or information – when its publication in itself on those pages is lawful.

With regard to ‘processing of personal data’ the European Court of Justice points out,

‘processing of personal data carried out by such an operator enables any internet user, when he makes a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet.’[4]

Without the installation of an internet search engine operator the information could not have been interconnected or could have been only with great difficulty. In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.

The European Court of Justice answered the question about the so called ‘right to be forgotten’ as follows:

‘If it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased.’[5]

The so called ‘right to be forgotten’ just undergoes a restriction if there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.

‘Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.’[6]

To sum it up, the person concerned is entitled to claim for the so called ‘right to be forgotten’, regardless of the lawful publishing of personal data by the internet search engine operator. Because of the fact that Google also has an ‘establishment’ on Austrian territory, Austrian nationals are as well entitled to claim for their ‘right to be forgotten’ and the withdrawal of personal data.