People have the right to be forgotten online,
The ruling, handed down by the European Union’s Court of Justice (ECJ), went against Google in a case concerning the removal of links to two pages published in 1998 by Spanish newspaper La Vanguardia.
The court said in its ruling that under existing EU data protection laws, search engine operators must be held responsible for processing personal data that appear on web pages published by third parties, so if the subject of a search doesn’t want said data to pop up, he or she has the right to ask that they be taken down.
From the ruling:
If, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.
The case, brought by Spanish national Mario Costeja González in 2010, concerned links to two newspaper pages from January and March 1998.
The pages contained an announcement for a real-estate auction held to recover social security debts owed by Costeja González: he was in hot water financially, and his home was repossessed.
The pages were showing up in Google search years after the debts were resolved, in spite of the search results no longer being relevant, he said.
The Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) rejected his request that La Vanguardia take down the pages, given that the newspaper was within its rights to publish the information.
But the AEPD did agree with Costeja González when it came to his second request: that Google Spain or Google Inc. be required to either remove the data and links from search results or bury them.
The AEPD asked the two companies to make it happen, but Google fought back, bringing two actions before the Audiencia Nacional (National High Court, Spain) to get the AEPD’s decision annulled.
In its Tuesday ruling, the ECJ pointed out that the information a search engine returns on a person “potentially concerns a vast number of aspects of his private life” that might previously never have been stitched together in the manner that search engines conveniently do – or, at least, without a search engine, a structured overview of a person’s information could only be achieved “with great difficulty.”
And once it’s out there, it’s everywhere, the court pointed out:
The effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous. In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.
The court noted that it was aware that removing links from results could affect the legitimate interests of people potentially interested in having access to the information.
Accordingly, the ruling held that the legitimate interests of internet users have to be balanced with the privacy rights of an individual, and that the sensitivity of given data will come under consideration in order to achieve a “fair balance” between the two.
But in a nutshell, these are the new rules of the game – at least, until opponents potentially challenge the ruling:
… the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.