The Cjeu's Google Spain Judgment: Failing To Residuum Privacy Too Liberty Of Expression

By Steve Peers

The EU’s data protection Directive was adopted inwards 1995, when the Internet was inwards its infancy, in addition to most or all Internet identify names did non exist. In particular, the outset version of the code for Google search engines was outset written the next year, in addition to the fellowship was officially founded inwards September 1998 – shortly earlier Member States’ deadline to implement the Directive.

Yet, pending the completion of negotiations for a controversial revision of the Directive proposed yesteryear the Commission, this legislation remains applicable to the Internet as it has developed since. Many years of disputation as to whether (and if so, how) the Directive applies to key elements of the Web, such as social networks, search engines in addition to cookies receive got culminated today inwards the CJEU’s judgment inwards GoogleSpain, which concerns search engines.

The background to the case, as further explained yesteryear Lorna Woods, concerns a Castilian citizen who no longer wanted an former paper study on his fiscal history (concerning social safety debts) to last available via Google. Of course, the mere fact that he has brought this legal challenge probable way that that the details of his fiscal history volition give-up the ghost known fifty-fifty to a greater extent than widely – much as many thousands of European Union police line students receive got memorised the shout out of Mr. Stauder, who similarly brought a legal challenge amongst a thought to keeping his fiscal difficulties private, resulting inwards the outset CJEU judgment on the purpose of human rights inwards European Union law.

The Court’s judgment

The CJEU addressed iv key issues inwards its judgment: (a) the textile reach of the Directive, ie whether it applies to search engines; (b) the territorial reach of the Directive, ie whether it applies to Google Spain, given that the parent fellowship is based inwards Silicon Valley; (c) the responsibleness of search engine operators; in addition to (d) the concept of the ‘right to last forgotten’, ie the right of an private to insist (in this case) that his or her history last removed from accessibility via a search engine. The details of the Court’s ruling receive got been summarised by Lorna Woods, but I volition repeat some key points hither inwards lodge to set the next analysis into context.  

Material reach

Does the Directive apply to search engines? The CJEU said yes.  The information at number was undoubtedly ‘personal data’, in addition to placing it on a website was ‘processing’. Influenza A virus subtype H5N1 search engine was processing personal data, fifty-fifty though it originated from tertiary parties, because (using the Definition inwards the Directive) it ‘collects’ information from the Internet, in addition to so ‘retrieves’, ‘stores’ in addition to ‘discloses’ it. It was irrelevant that the textile had been published elsewhere in addition to non altered yesteryear Google, as the CJEU had already ruled inwards the Satamedia case (in the context of taxation information published on CD-ROM). Moreover the Definition of ‘processing’ does non require that the information last altered.

Influenza A virus subtype H5N1 instant – in addition to perchance to a greater extent than of import betoken – was whether Google was a ‘controller’ of the data, amongst the outcome that it has liability for the information processing.  Again the key number was Google’s utilisation of information already published elsewhere. The Advocate-General had concluded from this that Google was non a information controller – but the CJEU reached the opposite conclusion. On this point, the Court, ruling that at that spot must last a ‘broad Definition of the concept’ of a ‘controller’, distinguished betwixt the master publication of the information in addition to its processing yesteryear a search engine: Google undoubtedly controlled the latter activity, yesteryear way of its command over the search process. One is unavoidably reminded of the Machiavellian search-engine billionaire who oft appears on episodes of The Good Wife – although of class he is null similar the executives of Google.

In particular, the Court ruled that the activities of search engines brand information available to people who would non receive got found it on the master spider web page, in addition to provides a ‘detailed profile of the information subject’, in addition to so receive got a much greater touching on on the right to privacy than the master website publication.

Territorial reach

Does the Directive apply to search engine companies based inwards California, amongst a subsidiary inwards Spain? The national courtroom suggested iii grounds on which this powerfulness last the case: the ‘establishment’ inwards the territory; the ‘use of equipment’ inwards the territory (as regards crawlers or robots, the possible storage of information in addition to the utilisation of domain names); or the default application of the European Union Charter of Fundamental Rights.

The Court found that Google Kingdom of Spain was ‘established’ inwards the territory, in addition to thence the information protection Directive, inwards the cast implemented yesteryear Spain, applied. It was non necessary to dominion on the other possibilities as regards the reach of the Directive, which are rattling important inwards the context of the Internet, so those issues stay open. It should last noted, however, that inwards lite of the objectives of the Directive, the rules on its reach ‘cannot last interpreted restrictively’, in addition to that it had ‘a peculiarly broad territorial scope’.

Why was Google Kingdom of Spain established there, fifty-fifty though it did non acquit out whatever search engine activities? The CJEU said that it was sufficient that the fellowship carried out advertising activities, these beingness linked to the well-known concern model of Google (selling advertising which was relevant to search engine results).

Responsibility of search engine operators

The CJEU ruled that search engine operators are responsible, distinct from the master spider web page publishers, for removing information on information subjects from search engine results, fifty-fifty where the publication on the master pages powerfulness last lawful. It confirmed that the right to need rectification, erasure or blocking of information did non apply alone where the information was inaccurate or inaccurate, but also where the processing was unlawful for whatever other reason, including non-compliance amongst whatever other soil inwards the Directive relating to information lineament or criteria for information processing, or inwards the context of the right to object to information processing on ‘compelling legitimate grounds’.

This meant that information subjects could asking that search engines delete personal information from their search results, in addition to complain to the courts or information protection supervisory regime if they refused.  As for Article 7(f) of the Directive, which provides that i soil for processing information (where at that spot was no contract, legal obligation, world involvement requirement or consent yesteryear the information subject) was the ‘legitimate interests of the controller’, this was a illustration where (as Article 7(f) provides) those interests were ‘overridden’ yesteryear the rights of the information subject.

There has to last a balancing of rights inwards such cases – including Earth right to liberty of appear – but inwards lite of the ease of obtaining information on information subjects, in addition to the ‘ubiquitous’ nature of the ‘detailed profile’ that results from search engine results, the huge touching on on the right to privacy ‘cannot last justified yesteryear only the economical interest’ of the search engine operator. The world involvement inwards the information was alone relevant where the information dependent land played a purpose inwards world life.

In lite of the greater touching on of search engine results on the right to privacy, search engines are non alone dependent land to a dissever application of the balancing test, but a to a greater extent than stringent application of that exam – pregnant that the information powerfulness stay available on the master website, fifty-fifty if it was blocked from the search engine results. The CJEU states that search engines cannot rely on the ‘journalistic’ exception from the Directive.

The ‘right to last forgotten’

Finally, the CJEU accepts the arguments that the Directive’s requirements that personal information must last retained for limited periods, alone for as long as it is relevant, amounts to a cast of ‘right to last forgotten’ (although the Court does non say that such a right exists as such). While it leaves it to the national courtroom to apply such a right to the facts of this case, the Court clearly guides the national courtroom to the determination that the information subject’s rights receive got been violated.

Comments

The essential occupation amongst this judgment is that the CJEU concerns itself so much amongst enforcing the right to privacy, that it forgot that other rights are also applicable.

As regards the right to privacy, the Court’s analysis is convincing. Of course, information on a named person’s fiscal affairs is ‘personal data’, in addition to it has long been established that prior publication is irrelevant inwards this regard – a peculiarly of import betoken for search engines. Equally, the Court had previously ruled (convincingly) inwards the Lindqvist judgment that placing information online is a cast of ‘data processing’. 

While it is less obvious that Google is a ‘data controller’, given that it does non command the master publication of the data, the Court’s determination that search engines are information controllers is ultimately convincing, given the additional processing that results from the utilisation of a search engine, along amongst the enormous added value that a search engine brings for anyone who seeks to respect that data. In this sense, Google is a victim of its ain success.

Similarly, as regards the territorial reach of the Directive, it would last remarkable if Google, having established a subsidiary in addition to domain shout out inwards Kingdom of Spain in addition to sought to sell advertising there, would non last regarded as beingness ‘established’ inwards that country. The sale of advertising inwards connector amongst costless searches is, of course, the key chemical factor of Google’s concern model (leaving aside the many other companies, such as YouTube in addition to Blogger, that Google has acquired over the years), in addition to making coin is certainly i of the ‘activities’ of whatever concern that aims to brand profits.

The dissever liability of Google as a ‘data controller’ patently justifies the Court’s determination that it might, inwards appropriate cases, last required to select downward textile from its search engine results that infringes the information protection directive. This is most patently relevant where that information is inaccurate or libellous, but that is non the illustration here, where the personal information is simply embarrassing.

So, inwards the absence of some other legitimate soil for processing (which volition commonly last the illustration as regards search engines), the illustration ultimately turns on the balancing of interests betwixt the information subject, the search engine in addition to other Internet users. And hither is where the Court’s reasoning goes awry.

In its previous judgment inwards ASNEF, the Court ruled that Castilian police line failed to apply the right residuum betwixt information subjects in addition to right away marketing companies, because yesteryear banning whatever utilisation of personal information which was non already public, it implicitly did non give plenty weight to the company’s right to acquit on a business. But hither the Court makes no reference to that right, fifty-fifty though Google’s methods are as fundamental to its concern model as the utilisation of private personal information is for right away marketers. Indeed, Google’s highly targeted advertising (not as such an number inwards this case) is itself patently a cast of right away marketing.

Also inwards ASNEF, the Court criticised the Castilian police line for its automaticity, because it failed to weigh upwardly the interests of companies in addition to information subjects inwards private cases. But inwards Google Spain, it is the Court which sets out an automatic test: the economical involvement of the search engine is overridden if the private is non a world figure.

The interests of other Internet users are alone briefly mentioned, fifty-fifty though Article 7(f) requires alone a balancing of interests betwixt non alone as betwixt the information controller (ie, the search engine inwards this case) in addition to the information subject, but also as regards tertiary parties to whom the information are disclosed, ie the full general public. Oddly, the Court does non expressly refer to the Charter right to liberty of appear (it’s inwards Article xi of the Charter), in addition to does non expressly link its statements most the balancing exam to the illustration police line of the European Court of Human Rights on the best way to residuum privacy in addition to liberty of expression.

Furthermore, dissimilar inwards ASNEF, the Court makes no refer of Article 52 of the Charter (the provision dealing amongst limitation of Charter rights, including inwards the involvement of protecting other rights, which also requires consistent interpretation amongst the ECHR). It should also last noted that, inwards deciding the key liberty of appear number itself, the Court has departed from its prior approach (in Satamedia in addition to Lindqvist, for instance) of leaving it to the national courts to create upwardly one's heed on this issue.

The Court’s dismissal of the journalistic exception also contradicts its willingness to agree, inwards Satamedia, that only sending personal taxation information yesteryear text message to nosy neighbours could constitute ‘journalism’. Here, of course, it is non Google which is the journalist; but Google is a crucial intermediary for journalists. If journalism tin consist of sending out taxation information yesteryear text message, it could also as consist of commenting (for whatever reason, in addition to inwards whatever forum) on an individual’s yesteryear fiscal problems. And at that spot is no argue why the passage of fourth dimension should count against the practice of the right of liberty of appear – although that factor should last relevant, as the Court says, as regards the right to privacy.

Consequences of the judgment

Obviously, today’s judgment alone concerns search engines, but it may receive got broader relevance than that.  Its relevance to social networks volition shortly last considered inwards some other post on this blog. For search engines, those which are less successful than Google powerfulness non receive got an ‘establishment’ inside the pregnant of this judgment, which raises the enquiry of whether they would otherwise receive got an establishment, utilisation equipment on the territory, or tin last covered due to the Charter.

More broadly, whatever non-EU fellowship amongst a subsidiary selling advertising inwards an European Union Member State inwards connector amongst its Internet services must patently last regarded as covered yesteryear the information protection Directive yesteryear analogy amongst this judgment, without prejudice to those broader possibilities.

As for those search engines which do autumn inside the reach of the judgment, most patently Google, it seems that their legal obligations are considerably greater than what they had idea them to be. They must response to private complaints that the personal information which tin last found most that private is simply as good former to last relevant whatever more, whether it is accurate or not, in addition to they tin last challenged earlier the courts or a supervisory potency if they do non comply.  In fact, an private could also select activeness to this goal earlier a supervisory authority.

Could a supervisory potency human activeness of its ain displace to enforce this judgment? Probably not, because the rights at number inwards this illustration are triggered yesteryear private complaints. Some people assiduously search Google to run across what results they tin respect on themselves; inwards this context, I should betoken out that I am non the same ‘Steve Peers’ from Essex who has been convicted for non-payment of council tax. But others are unaware of, or don’t assist about, or couldn’t last bothered to challenge, or are positively thrilled about, the existence of former information most them which tin last found yesteryear way of using Google.

So non everyone who powerfulness conceivably last embarrassed yesteryear such former information volition complain to Google, but a considerable number are probable to do so. Google’s liability extends to responding to such individuals, but non to completely changing the way it processes personal information inwards the absence of such complaints. 

Interesting questions may arise, however, as regards the interpretation of the rules laid out inwards the judgment: what just is a world figure, in addition to how long has to move yesteryear earlier personal information is no longer relevant? For instance, a project applicant tin certainly object to Google if its search results include pictures of her dancing drunkenly on a tabular array inwards 1998. But she could hardly debate that a tape of final night’s debauchery must last 'forgotten'  already - fifty-fifty if she cannot think it herself. 

Such disputes may good evidence an chance to debate that the remit of this judgment is narrower than it outset appears, or fifty-fifty to asking (which whatever national courtroom tin do) that the Court opposite at to the lowest degree some aspects of its judgment. For now, however, the CJEU has established a potentially far-reaching right to last forgotten, amongst possible important impacts at to the lowest degree on the activity of search engines. While inwards the Lindqvist judgment, the Court was keen to ensure that the information protection Directive was adapted to the reality of the Internet, inwards Google Kingdom of Spain it seems to need that the Internet should rather last adapted to the Directive. 

As for the initiatory to improve the Directive (to last replaced yesteryear a full general information protection Regulation), this judgment powerfulness speed that procedure up, since Internet companies at nowadays receive got an incentive to utilisation the procedure as an chance to bound their liability compared to what it would otherwise last - rather than (before the judgment) an involvement inwards slowing the procedure down, inwards lodge to avoid an increase inwards that liability. Time volition tell what the outcome of that negotiation volition be.

Barnard & Peers: chapter 9

Share this post