The European Court of Justice (ECJ) issued a quite surprising
decision against Google which has significant implications for global companies.
On May 13, 2014 the ECJ issued a ruling which did not follow the rational
eor the conclusions of its Advocate General, but instead sided with
the Spanish data protection authority (DPA) and found that:
•individuals have a right to request from the search engine provider that
content that was legitimately published on websites should not be
searchable by name if the personal information published is inadequate, irrelevant or no longer relevant;
• Google’s search function resulted in Google acting as a data controller
within the meaning of the Data Protection Directive 95/46, despite the fact that Google did not control the data appearing on webpage
s of third party publishers;
• Spanish law applied because Google Inc. processed data that was closely
related to Google Spain’s selling of advertising space, even where Google
Spain did not process any of the data. In doing so, it derogated from earlier decisions, arguing the services were targeted at the Spanish market, and such broad application was required for the effectiveness of the Directive.
The ruling will have significant implications for search engines, social media operators and businesses with operations in Europe generally. While the much debated “right to be forgotten” is strengthened, the decision may open the floodgates for people living in the 28 countries in the EU to demand that Google and other search engine operators remove links from search results.
The problem is that the ECJ mentions a broad range of data that may be erased. Not only should incorrect or unlawful data be erased, but also all those data which are “inadequate, irrelevant, or no longer relevant”, as well as those which are “excessive or not kept up to date” in relation to the purposes for which they were processed. It is left to the companies to decide when data falls into these categories.
In that context, the ruling will likely create new costs for companies and possibly thousands of individual complaints.
What is more, companies operating search engines for users in the EU will have the difficult task of assessing each complaint they process and whether the rights of the individuals prevail over the rights of the public. Internet search engines with operations in the EU will have to handle requests from individuals who want the deletion of search results that link to pages containing their personal data.
That said, the scope of the ruling is limited to name searches. While search engines will have to de-activate the name search, the data can still be available in relation to other keyword searches.
The ECJ did not impose new requirements relating to the content of webpages, in an effort to maintain the freedom of expression, and more particularly, press freedom. But this will still result in a great deal of information legally published to be available only to a limited audience.
Below we set out the facts of the case and the most significant implications of the decision, and address its possible consequences on all companies operating search engines.
Read the rest at Morrison & Foerster – Click Here
