The European Court of Justice (“ECJ”) ruled today that Google may be compelled to remove search listings of web pages containing information about individuals.
Mario Costeja Gonzalez, a Spanish national, complained in 2010 to Spain’s data protection authority (“Spanish DPA”) about the inclusion of a newspaper article in Google search results that appeared when searching his name. Mr. Gonzalez asked the Spanish DPA to order Google to remove its links to the 1998 story, which revealed Mr. Gonzalez’s connection with the forced sale of real-estate to recover debts. The Spanish DPA upheld Mr. Gonzalez’s complaint, taking the view that the failure to respect an individuals’ desire for anonymity on the internet could be a violation of fundamental rights under European Union law. Google objected to the decision before Spain’s National High Court, which then referred the case to the ECJ for its interpretation of E.U. law.
European Union data protection rules are contained in the Data Protection Directive (“Directive”) and E.U. member states’ implementing laws and regulations. The Directive provides individuals with a general right to the “erasure or blocking” of data processing which “does not comply” with Directive requirements. Under this provision of the Directive, the ECJ held that an individual may require an internet search engine to remove links to information that is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes” of the search engine. The ECJ suggested that Google’s use of Mr. Gonzalez’s information was improper under this standard. Referring to Google’s search result listings concerning Mr. Gonzalez, the Court wrote that, given “the sensitivity for the data subject’s private life” and the fact that the “initial publication” of the newspaper article “had taken place 16 years earlier,” an individual in Mr. Gonzalez’s position has a right to the removal of the search results.
The ECJ further held that individuals’ rights “override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name.”
The Court also rejected Google’s arguments that the Data Protection Directive should not apply to it. The Court held that Google’s activity in operating a search engine made the company a “controller” whose “processing” of personal information rendered it subject to E.U. requirements.
The ECJ opinion is a preliminary ruling before resolution of the case by Spain’s National High Court.
Written by Michael Young, Associate, Technology and Privacy Group | Alston & Bird LLP