Rewriting history: the curious case of Google’s ‘right to be forgotten’

By Irvine Chiwara

In a case that is unlikely to be forgotten, the European Court of Justice (ECJ), Europe’s highest court in matters of European Union law, has attracted worldwide attention for giving people the means to remove their unwanted history online.

In May of this year, the ECJ ruled that individuals had a ‘right to be forgotten’ under the European Data Protection Directive (95/46/EC) (the Directive).

The ruling effectively enables people to conceal references to their past financial troubles, criminal past, or even allow politicians to airbrush their history. It is because of this ruling that the statement: Some results may have been removed under data protection law in Europe, is now a common feature on search engine results pages.

What the case was about

It all began in 1998 when a Spanish newspaper, La Vanguardia, published details of a real estate auction held after property belonging to Mr Gonzalez had been attached for the recovery of social security debts he had. The published article was placed on La Vanguardia’s website and consequently appeared on the Google search engine. In 2009, Mr Gonzalez asked La Vanguardia to remove the article, which they refused to do. He then asked Google to remove the links to the article from its search results, which Google also refused to do.

In 2010, Mr Gonzalez lodged a complaint with the Spanish data protection agency (the AEPD) against la Vanguardia and Google. He argued that the attachment proceedings against him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.

In relation to La Vanguardia, the AEPD held that the publication was legally justified as it had been intended to give maximum publicity to the auction and therefore the claim against them was rejected. However, in relation to Google, the AEPD upheld the claim and ordered that links to the publication be removed from the search results.

Google Inc., the US parent company, which operates the search engine exclusively from the US, and its subsidiary, Google Spain, responsible for online advertising sales in Spain, appealed to the Spanish National Court against the decision of the AEPD. The Spanish National Court then stayed the proceedings and sought assistance from the ECJ on a number of questions.

The questions

1. Since the Directive applies to ‘controllers’ of personal data, the first question was whether this Directive also applies to search engines: the ECJ’s answer was YES, search engines are controllers of personal data. The ECJ ruled that the very display of personal data on a search results page constitutes processing of such data. It was held irrelevant that search engines neither published or altered the data themselves nor distinguished between personal data and non-personal data. As the search engine operator determines the purposes and manner of processing personal data, it was therefore a controller of the same.

2. Given that the search engine servers were wholly operated from the United States, the second question was whether the Directive applied to a search engine based outside the EU if it has an EU subsidiary: again the ECJ’s answer was YES. The ECJ ruled that although the processing was itself not done by Google Spain, it was conducted ‘in the context of Google Spain’s activities.’ Google Inc. benefitted commercially from the advertising space sold by Google Spain and conversely Google Spain relied on the search engine to perform its activities. The two companies were ‘inextricably linked’ and therefore subject to EU law.

3. The third question was whether the Directive contained a ‘right to be forgotten’: on this too the ECJ’s answer was YES. The Court found that individuals can request search engines to remove search results about them if they are ‘inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue.’ This right could be exercised without the need for the individual to show that the list of results was prejudicial to him. In effect, the Court held that the individual’s rights to have the links removed, as a general rule, outweighed the interest of the general public in having access to that information or the economic interests of a search engine operator. Of course, this is dealt with on a case by case basis and is subject to a fair balance being struck between the legitimate interests of internet users gaining access to information and the individual’s right to privacy.

Wider implications

This ruling will undoubtedly have far reaching implications on how it is to be applied in practice in relation to, first, those businesses who process data online, second, individuals who may seek to have links to their names removed from search results and, third, the public’s right to access lawful information online.

1. Businesses

Although the case before the ECJ was brought against Google, it applies of course to all search engines, including Yahoo and Bing, and any other business that is considered a ‘controller of personal data.’ In essence, any business that provides links to personal information including in connection with an advertising business, such as through social media, is also likely to be directly affected by this judgment.

This is a particularly important point for any such business outside the EU but with a closely linked subsidiary in the EU, such as a sales branch, as was Google Spain to Google Inc. Whilst it is common for businesses seeking to expand internationally to set up local branches in the target countries, this ruling essentially means that subsidiaries within any of the member states of the EU potentially expose their parent companies outside the territory of the EU to local data protection laws.

It is therefore advised that if a business falls into this category, considerable attention should be paid to having in place i) a clear compliance framework ii) provisions to receive such requests and iii) the capability to remove the unwanted data when requested to do so by the concerned individual.

2. Individuals seeking to remove links to the unwanted information

This decision has been hailed by others as an indication of the importance of the right to privacy and that individuals should really have some influence over what is said about them online. This of course includes being able to remove or to conceal links to negative reputations online.

Such individuals are however advised to beware the Streisand Effect. This refers to the unintended consequence of publicising the information even more widely by attempting to hide it. This point is amply demonstrated by the considerable and far reaching publicity the complainant in the present case, Mr Mario Costeja Gonzalez, has received through attempting to hide references to his name.

3. The public’s right to access information online

The internet has always been a great source of research for many people, particularly those prudent enough to carry out some sort of due-diligence before engaging the services of another. Whilst this ruling may appear at first instance to impact on how those searches are carried out, there are ways to go round it. Firstly, this ban only applies to the European versions of Google.

Therefore, through visiting an international version of a search engine based outside the EU, one would get access to the full search results including those blocked on the EU versions. Secondly, search engines only block the exact name or search term for which they are asked to remove the link to. This effectively means that if one searches by using related key words, you can still get access to the full results.

Conclusion

The interesting thing about this judgment is that results are not entirely deleted from the web or even from the search engines but merely that links to them are blocked. Others have argued that this is a curious case of avoid censoring the press and shoot the messenger. Whilst others say that it allows people to rewrite history.

To my mind, such arguments are flawed. No matter how much one tries, you cannot rewrite history to suit yourself and, rightly, you should never be able to do so. This is not a question of shoot the messenger at all. It is correct that Google is not a publisher. However, they provide a channel through which data is accessed and to that extent they are data controllers.

This case merely emphasises one’s proprietary rights over their personal data, which justifiably extends to the removal of ‘inadequate, irrelevant or no longer relevant, or excessive …’ information which might be prejudicial to them. This, to my mind, does not at all equate to rewriting history.

Irvine Chiwara is a Zimbabwean lawyer based in the UK