On 13th May 2014, the CJEU published one of the most anticipated privacy cases for 2014. The case, about a request from a Spanish citizen to be removed from Google's search index:
- takes a broad and purposive approach to interpreting the Data Protection Directive, repeatedly emphasizing the need to ensure effective protection for individuals and to avoid loopholes;
- states that a member state's data protection laws will apply when a company sets up sales offices selling advertising space in that country and otherwise focuses activities towards inhabitants of that member state;
- confirms the rights in the Directive to have personal data erased and to object to processing; and,
- at least in the case of search engines, concludes that there is no need for an individual to demonstrate prejudice to exercise these rights and that, absent special factors, these rights will prevail over the interests of the search engine to disseminate information and other users to receive information.
The strongly purposive approach to interpretation, emphasizing effective protection over other interests, will be of relevance to all organisations processing personal data.
In order to meet rights of erasure and objection, search engines will need to institute notice and take down style procedures. More worryingly for search engines, however, the Court also notes that operators must be able to justify their activities from the outset of the processing: in other words, a search engine which responds promptly to a notice from an individual, may still be faced with a claim for breach of data protection legislation for the period during which the linked material was available, even when such a claim could not be made against the original publisher.
The conclusions on rights to erasure and to objecting to processing could be seen as being specific to search engines, which are singled out by the Court as posing a specific threat to privacy. In the balance between the democratisation of information and privacy, the Court has come down firmly in favour of privacy.
In 1998, Spanish newspaper, La Vanguardia, published an announcement for a real-estate auction connected with attachment proceedings for the recovery of social security debts owed by Mr Gonzalez. This was indexed by Google, making the page turn up when a user searched on González's name.
Mr González requested the newspaper to remove his personal data from the website or alter the pages so that this data would no longer be included by search engines. Subsequently, Mr González requested Google Spain or Google Inc. (California, US), to remove or conceal the personal data related to him so that they ceased to be included in the search results.
The Spanish data protection authority, AEPD, rejected the request made to La Vanguardia. The AEPD ruled that this publication was legally justified on order of the Ministry of Labour and Social Affairs, to give maximum publicity to the auction and secure as many bidders as possible. The AEPD did, however, uphold the complaint against Google and ordered it to remove Mr. Gonzalez's data. Google Spain and Google Inc each appealed to Spain's National High Court, which made a reference to the CJEU.
The Spanish Audiencia Nacional asked the CJEU preliminary questions on:
- the material scope of the Data Protection Directive: when search engines find, index, store and make available information, does this amount to 'processing of personal data';
- the territorial scope of Spanish law, i.e. whether Spanish data protection law applies to Google Spain or indeed directly to Google Inc; and
- whether search engine operators may be required to remove personal data from their indexes and to erase and block personal data – including in situations where the personal data has been lawfully published by third parties.
1: Search engines do process personal data
Google Spain and Google Inc did not dispute that the data indexed and made available related to identified or identifiable natural persons and so amounted to 'personal data'.
The Data Protection Directive defines processing as '…collection, recording, … storage, … retrieval, … disclosure… making available…' The CJEU ruled that search engines engage in these specific activities when they index websites, record them and make them available. The CJEU followed its earlier 2008 decision (Satakunnan Markkinapörssi and Satamedia) and confirmed that the fact that this is processing (in unaltered form) of material which has already been published does not alter this. The CJEU also confirmed that the operator of the search engine is the controller as it decides on the means and purposes of these activities.
The CJEU rejected the arguments put forward in the Advocate General's Opinion, by the Greek government and by Google that a search provider cannot be a controller as it searches indiscriminately (without differentiating between personal and other data) and does not exercise control over what personal data is published on the web pages of third parties. The CJEU emphasized the objective of the Directive is 'to ensure, through a broad definition… effective and complete protection of data subjects' and excluding search engines from the scope of the Directive would be contrary to this aim.
The Court also ruled that the activities of search engines make information available to people who would not have otherwise found it and allow those searching to create a detailed profile of the data subject, acts which are liable to affect the right to privacy separately from the original website publication. Searching is, thus, seen as a significant act of processing in its own right.
2: Broad territorial scope
The Directive provides that an EU Member State's law will apply where 'processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State'. Google has a subsidiary in Spain and is, therefore, established there. The activities of Google's establishment in Spain mainly related to selling advertisement-space: Google Spain was not involved with the actual functionalities of the Google search engine.
The CJEU held that the Directive does not require that the processing be undertaken 'by' the local establishment. There was sufficient connection between the activities of the Spanish branch and the search engine's data processing activities, … the activities … in [Spain]… are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine … economically profitable and that engine is, at the same time, the means enabling those activities to be performed…'.
The Spanish National High Court had also asked the CJEU to consider if Spanish law would apply because Google Inc had designated Google Spain as its representative for some purposes, because Google Spain forwards to Google Inc requests from individuals and authorities relating to data protection, or on the basis that Google Inc makes use of equipment in Spain when it crawls information contained 0n web servers in Spain. As the CJEU considered that Spanish data protection law applied by means of Google's Spanish establishment, it declined to consider these questions.
3: Search engines' responsibilities
The Directive grants individuals the right to have personal data corrected, erased or blocked (Art.12(b)) and to object to processing on 'compelling legitimate grounds' (Art.14).. The CJEU affirms that these rights can also be invoked against search engines acting as controllers.
When it comes to the application of those rights, the search engines' responsibility is distinct from the original websites and this could result in removing information on data subjects from search engine results, even where publication on the original pages might be lawful. According to the CJEU, search engines cannot rely on the journalistic exception in the Directive, whereas the original publisher may benefit from this. This could thus result in disparity between what is available on the web and what can be effectively found though search engines. This right to demand rectification, erasure or blocking of personal data applies to all situations of non-compliance with the Directive, including situations where the data is kept too long (data retention), not complete (data quality) or where the data subject has compelling legitimate grounds (substantial impact on his privacy or other legitimate interests).
Search engines, like other controllers, must also be able to show that their processing satisfies one of the legitimate bases for processing under Article 7 – the most relevant condition for search engines being Article 7(f) (that the processing is necessary for the legitimate interests of the search engine, or those to whom the personal data are disclosed, except where the interests or fundamental rights and freedoms of the data subject override these interests). On this balancing test, the CJEU noted that:
- Search engines are likely to significantly affect fundamental rights to privacy, as search plays an important role in society and makes information ubiquitous;
- The potential seriousness of the interference with privacy rights, is such that search engines 'cannot' justify this purely on their economic interests;
- The CJEU accepts that it is relevant to consider the legitimate interests of internet users who are interested in having access to search results;
- However, 'data subject's rights … override as a general rule … that interest of internet users [in having material communicated to them]';
- This may be altered in specific cases – based on the sensitivity of the information for the individual and the interest the public have in accessing the information – for example, whether the individual has a role in public life.
4: A right to be forgotten?
The 'right to be forgotten' has been a heavily debated part of the proposals for the draft General Data Protection Regulation.
The CJEU refrains from stating that there is an actual "right to be forgotten". However, it confirms that an individual does have a right to require his personal data to be removed from a list of results, without needing to show specific prejudice – which is substantially equivalent to a right to be forgotten. This right may be overridden in particular cases – eg where there is a strong interest in continued availability of information if the individual is a public figure. In this case, the CJEU noted that there did not appear to be any particular reasons justifying continued inclusion of Mr Gonzalez's personal data in Google's search results – although this was a matter for the referring Spanish court to determine.
The CJEU has confirmed that the Spanish courts could, if they chose, grant Mr González's wish to be "forgotten". In the process, the case has likely secured Mr Gonzalez's literary immortality, at least in legal circles: a 'right' to be forgotten is easier to say than to deliver.