Towards A Spider Web 3.0? The Touching On Of The Google Spain Judgment On Social Networks Together With Wikipedia

Steve Peers

If its historic menses could last measured inward ‘Internet years’, the EU’s data protection Directive would last prehistoric. This tin laissez passer the axe easily last demonstrated past times comparing amongst the historic menses of Facebook. The Directive was adopted 7 years earlier the virtual panty raid on Harvard students’ privacy that ultimately launched Facebook. Indeed, when the Directive was adopted inward 1995, Mark Zuckerberg was 11 years old, as well as help primary school. He turns thirty today.

That’s a important birthday – but is at that spot anything inward the Google Spain judgment that would ruin the party? This weblog ship service looks inward exceptional at the possible application of the judgment to ii well-known features of the Internet: social networks as well as Wikipedia.

Long agone (in Internet years), the Internet shifted to a ‘Web 2.0’ model, dominated increasingly past times user-generated content such every bit social networks as well as Wikipedia (along amongst blogs as well as many other forms of such content). The query I desire to pose hither is whether the Google Spain judgment could launch a ‘Web 3.0’: an Internet dominated past times information subjects’ command of their personal data?

Applying the Google Spain judgment to social networks as well as Wikipedia

Material reach of European Union law

First of all, the information placed on social networks as well as Wikipedia certainly constitutes personal data, at to the lowest degree every bit far every bit it concerns living natural persons. It’s an interesting query every bit to whether the legislation also applies to dead persons: this conjures upwards the icon of the supporters as well as critics of (say) Ronald Reagan or Margaret Thatcher using information protection constabulary to litigate over the reputation of their heroes (or villains). But the exclusion of legal persons way that information protection constabulary cannot last a vehicle for companies (or other legal persons such every bit NGOs, political parties, charities or governments) to attempt to take all traces of criticism of their actions.

As the CJEU has made clear several times, it isn’t relevant that the information was initially (or subsequently) made available elsewhere. This squall for is relevant to Wikipedia inward particular, given the sources it links to for most of its information.  

Placing information on the Internet amounts to ‘data processing’, at to the lowest degree where it is available to the full general public. This is peculiarly relevant to Wikipedia, but it’s also relevant to those social network profiles which are accessible to the exterior world. In both cases, the personal information would also last accessible past times way of search engines, which way that Google (or other search engines) would last separately liable for securing information protection rights nether the weather condition gear upwards out inward the Google Kingdom of Spain judgment.

However, where a social network profile is truly closed to the exterior Blue Planet as well as made accessible solely to persons selected past times the information subject, the EU’s ‘Article 29’ working political party on information protection (a trunk made upwards of national information protection supervisors, which gives non-binding advice on the application of European Union information protection law) has suggested that the so-called ‘household exception’ inward the Directive mightiness apply. This would hateful that, since the information could solely last seen past times a closed circle of (presumably) friends as well as family, the European Union constabulary wouldn’t apply at all. Obviously, though, that exception wouldn’t apply to whatever processing of the personal information inward query past times the fellowship which established the social network itself, for direct marketing or other purposes.

Who is the ‘data controller’, ie the individual amongst greater liability for application of European Union information protection legislation, every bit regards social networks as well as Wikipedia? On this point, at that spot is a clash betwixt the nature of Web 2.0 as well as the putative Web 3.0, to the extent that the content of the personal information is generated past times the users. In principle, each private chooses how much personal information to house online as well as who has access to it, as well as similarly the editors of Wikipedia generate its content. The liability of the social network provider or Wikipedia mightiness arise, however, to the extent that they alteration the privacy settings, or could last regarded every bit controlling (as inward Google Spain) the systematic presentation of the information to the exterior world.  We can’t forget that inward that judgment, the CJEU ruled that at that spot has to last a ‘broad Definition of the concept’ of a information controller.

Territorial scope

Back when the Internet was (in Internet years) a teenager, the CJEU ruled inward Lindqvist that the special rules on external relations inward the information protection Directive should not, past times way of the nature of the Internet, move a full general regime applicable to the entire world. But inward Google Spain, the Court conversely was anxious to ensure that the full general rules of the Directive were applicable to companies based exterior the EU.

However, this doesn’t hateful that all social networks, or Wikipedia, are necessarily dependent area to the Directive. They are certainly dependent area to it if they are inward the same province of affairs every bit Google: amongst a subsidiary inward a Member State, which is selling advertising connected to the Internet-related activities of the parent body. But this is certainly non the solely scenario when the Directive applies to companies based exterior the EU. As the CJEU said inward Google Spain, the Directive has ‘a peculiarly wide territorial scope’ as well as the relevant rules ‘cannot last interpreted restrictively’. So piece it is an oversimplification to say that the Directive applies to whatever entity ‘doing concern inward the EU’, it in all likelihood applies at to the lowest degree where at that spot is a important local activity (certainly inward the cast of a branch, peradventure inward the cast of an agent or licensee) past times the parent entity, that has unopen to link to its Internet activities.

It is also soundless opened upwards to scrap (since the Court did non address the issue) whether a parent fellowship tin laissez passer the axe last regarded every bit ‘established’ or using equipment on the territory due to its utilisation of domain names, storage of data, as well as utilisation of crawlers or robots on the territory, or whether the European Union Charter of Fundamental Rights imposes broader criteria every bit regards the territorial reach of the rules.

Of course, at that spot volition last practical difficulties enforcing the Directive where a non-EU entity does non guide keep assets inward the EU. However, inward such cases at that spot mightiness last possibilities to enforce the Directive’s rules past times seeking to enforce a courtroom ruling inward a non-Member State, or to a greater extent than straight past times way of obtaining an injunction to block access to the information which infringes information protection rules. Undoubtedly, such an injunction could last sought against Google, where the information is accessible past times way of its search engine, as well as arguably (by analogy amongst copyright law) against an Internet service provider.

Personal reach

One interesting query which the Court did non guide keep to bargain amongst inward Google Spain was the personal reach of data subjects. For instance, could a celebrity based inward America, who in conclusion gets tired of stories nearly her enormous backside, attempt to utilisation European Union information protection constabulary to forestall access to such stories?

There is no requirement inward the Directive that the information dependent area must last a national of a Member State, and/or domiciled inward the EU. Nor create the rules on the territorial reach of the Directive bring upwards this factor. So it must follow that non-EU citizens who are non resident inward the European Union tin laissez passer the axe rely upon the Directive to assert their information protection rights inside Member States. So inward principle, at least, the supporters as well as detractors of Barack Obama or Vladimir Putin could convey their disputes, inward the context of editing Wikipedia entries, to the courts as well as information protection supervisors of European Union countries.

While this mightiness audio absurd, inward fact at that spot are other reasons which would stand upwards inward the way of the application of European Union information protection constabulary to such disputes – to which nosotros straightaway turn.

Responsibility of information controllers

Data controllers must ensure that the information character rules inward the Directive are satisfied, as well as that information was processed inward accordance amongst i of the legal grounds for processing.

On the latter point, i of the crucial factors inward the Google Spain example was that Google could solely rely (as regards its search engine) on its ‘legitimate [commercial] interest’ inward processing personal data, inward accordance amongst Article 7(f) of the Directive. The same provision refers to the interests of 3rd parties, namely liberty of expression. However, the Court held that such interests were overridden past times the information subject’s rights inward that case, due to the huge invasion of his privacy due to the utilisation of search engines.

Two issues arise here: the balancing test, as well as the grounds for processing. The start number is peculiarly relevant for Wikipedia, since (like Google, every bit regards its search engine) it must rely on this balancing exam inward gild to justify its processing of personal data, inward the absence of other possible grounds to justify it.  

Applying the balancing test, the CJEU ruled on both Google’s involvement as well as the populace involvement inward liberty of expression. As regards Google, the Court stated that its ‘merely economic’ interests were outweighed past times the information subject’s. This suggests that a non-profit trunk similar Wikipedia would arguably guide keep a greater claim to assert its interests than a profit-making entity.

As regards the populace interest, the Court listed the factors to last considered every bit ‘the nature of the information’, its ‘sensitivity for the information subject’s private life’, as well as the public’s involvement inward the data, which could ‘vary, inward particular’, on the information subject’s ‘role…in populace life’. It should last recalled that the concept of ‘private life’ commonly includes information concerning a person’s activity inward public, but hither the Court does advise that at that spot mightiness last a distinction betwixt populace as well as private activities. So the residual tips inward favour of liberty of seem the to a greater extent than that the individual concerned is a populace figure, as well as the to a greater extent than that the information concerns his or her populace activities. So certainly Wikipedia could incorporate a tape of populace criticism of a politician; but the sordid details of his intern’s (postponed) dry-cleaning mightiness peradventure last unopen to other matter.

The crucial query hither is whether the exam tin laissez passer the axe last regarded every bit severable: ie tin laissez passer the axe it last argued that fifty-fifty if a individual is a populace figure, his or her populace as well as private activities tin laissez passer the axe last distinguished? In whatever event, his or her mistress or children are information subjects inward their ain right, as well as then would guide keep a information protection correct to assert independently of the politician, as well as are unlikely to last populace figures. But of course, unopen to spurned mistresses are really keen indeed to waive their information protection rights.

But who is a populace figure inward the start place? Presumably the concept has an autonomous pregnant inward European Union law, as well as then it is non upwards to Wikipedia (or the persons concerned) to create upwards one's hear what it way past times themselves. But certainly the nature of Wikipedia is a important factor to guide keep into concern human relationship when developing as well as applying such a definition.

As regards the nature of the personal data, what if the information inward query reflects really badly upon the individual concerned? The CJEU did non address this number expressly inward Google Spain. But it could last argued that it depends on the populace involvement inward receiving that information. So piece past times fiscal difficulty does non heighten a populace involvement issue, at that spot is a improve example for disceptation (say) that a adult woman who has been groped past times a exceptional machine mechanic has every correct to warn other women against him via way of social networks.

Another crucial chemical constituent inward the Google Spain judgment was the journalist exception inward the Directive. It didn’t apply, because Google itself was non a journalist, as well as the Court disregarded the utilisation that journalists brand of search engines. But where content is user-generated, such every bit Wikipedia as well as on blogs, certainly the exception must apply, given the Court’s wide approach to it inward previous judgments such every bit Satamedia and Lindqvist. So inward that example it could last argued that the exception should last applied inward exercise past times the national courts. Indeed, perhaps the solely ground why the CJEU undertook the line of piece of occupation of applying the balancing exam betwixt privacy as well as liberty of seem itself inward Google Spain was because the journalist exception did non apply.

As for the minute issue, social networks volition commonly last able to squall for to other grounds justifying the processing of personal data: namely unambiguous consent, as well as necessity to perform a contract. This raises of import questions of how to translate these grounds for information processing, but these are clearly different issues non addressed at all past times the Google Spain judgment.

That judgment would solely last relevant every bit regards the processing of personal information nearly 3rd parties inward social networks, for example a homo ranting nearly his ex-girlfriend on his Facebook page. The way to resolve situations such every bit these is for social networks to adopt as well as apply robust privacy policies, but the Google Spain judgment tin laissez passer the axe solely last an indirect rootage of inspiration for such policies.  

The correct to last forgotten

Finally, what of the ‘right to last forgotten’? The Court derived such an implicit correct from the rules inward the Directive on the relevance of information (one of the information character principles), given that it mightiness cease to last relevant over a long menses of time.  While this tin laissez passer the axe last seen every bit a positive correct for information subjects, conversely it suggests that if information is accurate (and complies amongst all other rules inward the Directive), at that spot is non much of a correct for a information dependent area to object to its dissemination every bit long every bit it is relatively fresh.

Conclusion

Is at that spot practiced ground for Mark Zuckerberg's ain knickers to last inward a twist, next the Google Spain judgment? The CJEU does advise that the territorial reach of the Directive is relatively broad, as well as every bit such is to a greater extent than probable to apply to social networks as well as other well-known Internet services than mightiness otherwise guide keep been thought. But it is non yet sure whether as well as when the Directive does apply to entities whose province of affairs differs from Google’s. Equally the judgment confirms that the fabric reach of the Directive is broad, as well as it seems clear plenty that its personal reach is wide too.

However, the judgment is unlikely to atomic number 82 to a ‘Web 3.0’ every bit regards Internet services likewise search engines, because at that spot are basic differences inward the substantive data protection constabulary of the European Union every bit it applies to the bodies offering such services. These differences concern inward particular: the really nature of user-generated content (arguably changing who is the ‘data controller’); the beingness of privacy or editing policies; the populace figure exception; the possible application of different, additional grounds for processing personal data; as well as the Google Spain judgment itself – since it provides for an alternative, to a greater extent than effective way of blocking access to the personal information concerned.

Barnard & Peers: chapter nine

Share this post