The important judgment in the Google Spain case concerns the interpretation of Directive 95/46/EC (the Data Protection Directive) and was handed down by the Grand Chamber of the European Court of Justice on 14 May 2014.
Although the ruling is of immediate relevance to the publication of search results by search engines such as Google, the judgment is of general relevance to the publication of information on the internet within the European Union.
The complaint was brought by Mr Gonzalez, a Spanish national living in Spain, against the publisher of a Spanish daily newspaper (La Vanguardia) and against Google Spain and Google Inc. The complaint related to the fact that when a search was undertaken on the Google search engine (“Google Search”) against the Claimant’s name the results provided links to articles in La Vanguardia from 1998 mentioning Mr Gonzalez in connection with bankruptcy proceedings.
Mr Gonzalez wished to put those matters behind him and although he had failed in his complaint against the newspaper (which could benefit from the journalistic exemption under the Directive), he contended that the continued publication by Google Search of those search results breached his rights under the Directive. He sought an order requiring Google to remove or block the search results.
The main issues for the court were whether:
- The activity of a search engine in finding information on the internet, indexing it, storing it temporarily and making in available to the public in the form of search results linking to other websites amounts to “the processing of personal data”.
- The operator of a search engine carrying out the above activities is a “data controller”.
- The territorial scope of Directive 95/46 extended to Google Inc, an establishment based in the United States but which had a subsidiary in the European Union.
- The extent of the responsibility of the operator of a search engine to remove links to web pages that are published by third parties from its own search results, including in circumstances where the information remains available on website of the original publisher.
- The criteria to be applied by the operator of the search engine in deciding whether to accede to a request to remove certain links from its search results.
- There is a “right to be forgotten” under the Directive, entitling an individual to demand that information which he considers outdated be removed from the search results of a search engine.
Given the great breadth of the definition of “processing”, “personal data” and “data controller” under the Directive, the court held that the activities of search engines do involve the processing of personal data and that the operators of search engines are data controllers. I note in passing that the Advocate General had found that Google was not a data controller because it has no responsibility for the “personal data”.
In relation to the territorial scope of the Directive, the court reasoned that as Google Spain (as a subsidiary of Google Inc)markets advertising space offered by Google Search and as Google Search and its advertising were inextricably linked, the processing of personal data by Google Search was carried out in the context of the activities of Google Spain, an establishment of the controller on the territory of a member state.
The court held that search engines are responsible for ensuring that the search results that they publish are compatible with the rights of individuals under the Data Protection Directive. In this context, the court emphasised the way in which search results amount to “a structured overview of the information relating to an individual that can be found on the internet – information which potentially concerns a vast number of aspects of his private life… and thereby to establish a detailed profile of him” and the important role played by the internet in modern society: see [80].
In terms of the balance to be struck between the rights of individuals about whom personal data is held as against the right of the public to receive it, the court made the sweeping statement that in general the rights of data subjects override the interests of internet users in having access to information, except where in the specific circumstances of the case “such as the role played by the data subject in public life”, the public interest in internet users having access to the information in question outweighs the data subject’s rights: see [81].
The court then held that the Data Protection Directive includes a “right to be forgotten”, which it derived from the general principles set out in Article 6 of the Directive at [92] to [94]. The court then went on to hold that the effect of this new right was that individuals are entitled to demand internet search engines to remove information which the individual does not wish to have published, notwithstanding that the information remains available on the website of the original publisher (as in this case) and without having to show any prejudice. Accordingly, on the facts of this case, Google Inc was held to have been in breach of Mr Gonzalez’s rights and Mr Gonzalez was entitled to an order requiring Google Inc to remove the links to the articles from its search results.
In support of the new “right to be forgotten” the court makes frequent reference to Articles 7 and 8 of the EU Charter of Fundamental Rights (the right to respect for private life and the protection of personal data respectively), which it wrongly said was implemented by the Directive at [69] (the Charter post-dates the Directive). What is strikingly absent from the judgment is any reference to article 11 of the Charter which protects freedom of expression, or the relevance of that right to the balance to be struck between the rights of data subjects and the rights of data controllers and of the general public who receive the information which they publish. The great tradition of the European Court of Human Rights under Article 10 in protecting freedom of expression as “one of the essential foundations of a democratic society” has been simply ignored.
The Data Protection Directive was enacted to regulate the acquisition and management of individuals’ personal data by both private and public bodies. In recognition of the fact that such a regime could undermine free expression in the context of publications to the general public, there was an express exemption for journalistic, artistic and literary works. The Data Protection Directive was never intended to regulate internet publications, because back in 1995 the internet was in its infancy and internet search engines such as Google weren’t even established (Google was first incorporated in 1998).
The transposition of the data protection regime to publications to the world at large on the internet is therefore highly problematic. Very different considerations arise in the content of publication on the internet, to those which apply to the internal management of information by public and private bodies or even data sharing between such bodies. The internet is a global public resource, the world’s most valuable tool for freedom of expression. It is now the first port of call for people all over the world seeking access to information and ideas.
In the context of the management of personal data by public and private bodies, a wide definition of personal data (any information relating to an identified or identifiable individual) makes sense. When applied without further thought and analysis to publications to the general public on the internet, this wide definition and the resultant lack of any meaningful distinction between what is truly private and what is or should be public becomes highly problematic. In UK law the threshold test for misuse of private information is that the claimant has a reasonable expectation of privacy in relation to that information; it is only if the information is private in this sense, that a balance between the competing rights to privacy and freedom of expression is required. What has been lost in this judgment is the insight that we value freedom of expression for its own sake and that in general terms no justification is required for the publication of information which is not private.
The court’s reductionist approach is to require that all published information must have a specific public interest justification. This approach is profoundly erroneous and stems in large part from failing to keep in mind the private/public distinction. Most of what is published on the internet has no specific public interest justification and there is no specific public interest which could relate to most pieces of biographical information about an individual. Facebook is an extremely valuable resource for freedom of expression and information sharing, but most of the “personal data” published there be it banal or wacky would not avail itself of any specific public interest defence. The point is that it shouldn’t have to; there is an inherent value in the free circulation of information and ideas which the court has completely overlooked.
This judgment will affect not only Google and other search engines, but potentially all websites sharing information with the public which can’t avail themselves of a specific defence under the Directive. The ramifications are enormous. Operators of websites in Europe will be drawn into endless arguments with individuals about whether there is a specific public interest in publication of that specific piece of information, even where it is neither private nor prejudicial. It appears that the court never asked itself if these large corporations can be relied on to protect the public interest in freedom of expression, taking a principled stance in response to unmeritorious complaints, as opposed to simply following the easy (and cheap) course of erasing information on request. Across the Atlantic and around the world other countries will look on us with bemusement as they read information which we are denied. This judgment is profoundly harmful to the operation of the internet and a betrayal of Europe’s great legacy in protecting freedom of expression.
This post originally appeared on the eutopia blog and is reproduced with permission and thanks.
Leave a Reply