By Steve Peers

The EU’s data protection Directive was established in 1995 during the early days of the internet, before the rise of major internet companies. Notably, Google, founded in 1998, emerged just as EU countries were implementing this Directive.

Despite its age and ongoing debates surrounding a proposed revision, this legislation still governs the modern internet. Years of debate about the Directive’s application to aspects like social media, search engines, and cookies culminated in the CJEU’s GoogleSpain judgment, focusing on search engines.

The case, as detailed by Lorna Woods, involves a Spanish citizen who wanted to remove an old news article about his financial history from Google’s search results. Ironically, this legal challenge might increase awareness of his situation, mirroring the case of Mr. Stauder, whose legal challenge regarding his financial privacy led to the first CJEU ruling on human rights in EU law.

The Court’s judgment

The CJEU focused on four key issues: (a) whether the Directive applies to search engines; (b) whether it applies to Google Spain, given its parent company’s location in Silicon Valley; (c) the responsibility of search engine operators; and (d) the concept of the ‘right to be forgotten’ - an individual’s right to request information removal from search engine results. Lorna Woods has summarized the ruling, but key points are highlighted below for context.  

Material scope

The CJEU affirmed the Directive’s application to search engines. The information in question was “personal data,” and its online presence constituted “processing.” Search engines, though utilizing data from third parties, process personal data by “collecting,” “retrieving,” “storing,” and “disclosing” information from the internet, regardless of its origin or alteration. This aligns with the CJEU’s previous ruling in the Satamedia case involving tax information published on CD-ROM.

Another crucial point was whether Google, as a potential “controller” of data, bore liability for its processing. The CJEU, contradicting the Advocate-General’s opinion, concluded that Google was indeed a data controller. The Court highlighted the distinction between initial data publication and its subsequent processing by search engines, asserting Google’s control over the search process. This scenario evokes comparisons to the fictional portrayal of a manipulative search engine tycoon in the TV show The Good Wife, despite obvious differences from Google’s leadership.

The Court emphasized that search engines broaden information access and create comprehensive user profiles, impacting privacy more significantly than original website publications.

Territorial scope

The Court addressed whether the Directive applies to a California-based search engine company with a Spanish subsidiary. The national court proposed three potential grounds: the presence of an “establishment,” the “use of equipment” (crawlers, data storage, domain names), or the default application of the EU Charter of Fundamental Rights.

The CJEU found that Google Spain, by virtue of its “establishment” in the territory, was subject to the data protection Directive as implemented by Spain. While not ruling on the other possibilities, the Court acknowledged the Directive’s broad territorial scope, particularly in the internet context.

The CJEU determined that Google Spain’s advertising activities, integral to Google’s business model of linking ads to search results, constituted an “establishment,” even though the subsidiary wasn’t directly involved in search engine operations.

Responsibility of search engine operators

The CJEU asserted the responsibility of search engine operators, as separate entities from original publishers, to remove information from search results, even if the initial publication was lawful. The right to rectify, erase, or block data applied not just to inaccurate information but also to unlawful processing based on data quality, processing criteria, or the right to object on “compelling legitimate grounds.”

Individuals could request data removal from search results and seek legal redress or approach data protection authorities if their requests were denied. Article 7(f) of the Directive, allowing data processing based on the “legitimate interests of the controller,” wasn’t applicable here, as the data subject’s rights took precedence.

While acknowledging the need to balance rights, including freedom of expression, the Court ruled that the ease of accessing information and the comprehensive profiles created by search engines tilted the balance in favor of privacy over the search engine’s economic interest. Public interest in the information was only relevant if the data subject was a public figure.

Given their impact on privacy, search engines faced a stricter application of the balancing test, potentially resulting in information remaining accessible on original websites but blocked from search results. The CJEU stated that the “journalistic” exception within the Directive wasn’t applicable to search engines.

The ‘right to be forgotten’

The CJEU acknowledged that the Directive’s provisions on data retention limits and relevance implied a “right to be forgotten,” although not explicitly stated. While leaving the application to the national court, the CJEU strongly suggested that the plaintiff’s rights had been violated.

Comments

This judgment’s primary flaw lies in its prioritization of privacy rights over other relevant rights.

The Court’s perspective on privacy is understandable. Information about an individual’s finances is “personal data,” and prior publication doesn’t negate this, especially concerning search engines. Additionally, the Court’s prior ruling in the Lindqvist case correctly identified online data placement as a form of “data processing.”

While Google’s classification as a “data controller” might seem less clear-cut, the Court’s conclusion is ultimately justified, considering the additional processing and value added by search engines. In this sense, Google’s success is a double-edged sword.

Regarding territorial scope, it’s logical that Google, with a subsidiary, a domain name, and advertising operations in Spain, falls under the Directive’s purview. The advertising revenue generated through free searches forms the backbone of Google’s business model (excluding acquired companies like YouTube and Blogger), and profit-making is undeniably a core “activity” for such businesses.

Google’s separate liability as a “data controller” justifies the Court’s ruling that it might be required to remove information violating the data protection Directive. This is particularly relevant for inaccurate or defamatory data but doesn’t directly apply here, where the information is simply embarrassing.

Therefore, without other legitimate grounds for processing (typically absent for search engines), the case hinges on balancing the interests of the individual, the search engine, and other internet users. This is where the Court’s reasoning falters.

In its ASNEF ruling, the Court deemed Spanish law inadequate for not balancing data subjects’ rights with direct marketing companies’ rights. By prohibiting the use of non-public personal data, the law undermined companies’ right to conduct business. However, this judgment neglects this right, despite Google’s practices being as central to its business model as private data usage is for direct marketers. Notably, Google’s targeted advertising, though not directly relevant here, is a form of direct marketing.

Furthermore, in ASNEF, the Court criticized the Spanish law for its automatic nature, failing to weigh individual cases. Conversely, in Google Spain, the Court establishes an automatic test: the search engine’s economic interest is superseded unless the individual is a public figure.

The judgment barely acknowledges other internet users’ interests, despite Article 7(f) mandating a balance between the data controller (search engine), the data subject, and third parties (the public). Surprisingly, the Court doesn’t explicitly mention the Charter’s right to freedom of expression (Article 11) nor connect its balancing test statements to the European Court of Human Rights’ case law on balancing privacy and freedom of expression.

The dismissal of the journalistic exception contradicts the Court’s stance in Satamedia, where sharing personal tax data via text messages was considered “journalism.” While Google isn’t a journalist, it’s a crucial intermediary. If sharing tax information via text messages qualifies as journalism, then commenting on an individual’s past financial difficulties should too, regardless of the forum or motive. The passage of time, although relevant to privacy, shouldn’t hinder freedom of expression.

Consequences of the judgment

While focused on search engines, this judgment’s implications could extend further, as will be explored in a future post on social networks. For search engines, those less successful than Google might not have an “establishment” as defined by this ruling, raising questions about the broader applicability of the Directive based on equipment use or the Charter.

Any non-EU company with a subsidiary using targeted advertising in an EU member state would likely fall under the data protection Directive, similar to this judgment, without prejudice to broader interpretations.

Search engines within the judgment’s scope, especially Google, now face greater legal obligations. They must address complaints about outdated or irrelevant personal data, regardless of accuracy, and risk legal action or scrutiny from supervisory authorities. Individuals could also proactively approach supervisory authorities.

However, supervisory authorities likely cannot act independently, as the rights in this case are complaint-driven. While some actively monitor their online presence, others might be unaware of, indifferent to, or even pleased with old information about themselves being accessible through Google.

Therefore, not everyone potentially embarrassed by such information will complain, but many might. Google’s responsibility lies in responding to individuals, not overhauling its data processing practices without specific complaints.

However, the judgment’s interpretation raises questions: what constitutes a “public figure,” and when does personal data become irrelevant? For instance, a job applicant could reasonably object to embarrassing photos from their past appearing in Google search results. However, they can’t demand the removal of recent content, even if they have no memory of it.

Such disputes might lead to arguments for a narrower interpretation of this judgment or even calls for the Court to reconsider aspects of its ruling. For now, the CJEU has established a potentially expansive “right to be forgotten,” significantly impacting search engines. While the Lindqvist judgment aimed to adapt the data protection Directive to the internet, Google Spain seems to demand the reverse.

This judgment could accelerate the Directive’s amendment process, replacing it with a general data protection Regulation. Internet companies now have an incentive to actively participate in shaping the regulation to limit their liability, a stark contrast to their previous preference for delaying the process to avoid increased obligations. Time will reveal the outcome of this negotiation.

Barnard & Peers: chapter 9