The right to be forgotten was at stake in the EU court last week. It also was a classic David vs Goliath battle: the case of a Spanish citizen against information giant Google. The Spanish individual simply wanted to have the links removed that pointed to two pages of La Vanguardia newspaper mentioning a real estate auction of his repossessed home back in 1998. When entering his own name in Google search these pages popped up but since the matter had been resolved he demanded the digital trail to be removed as well. And the EU ruled in his favor, explicitly stating:
An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.
Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.
The ruling is seen as victory for the privacy advocates. Viviane Reding called it a “clear victory for the protection of personal data of Europeans” on her Facebook page. For free speech supporters it is a big setback as they regard the ruling as censorship, a violation of the freedom of speech and a way to change or remove the past.
The court of Justice stated that Google can be required to remove inadequate and irrelevant data or excessive data “in relation to the purposes for which they were processed and in the light of the time that has elapsed”. The ruling is a first but important test in which the right to be forgotten – as proposed by the EC back in 2012 and later on weakened by the European Parliament to the ‘right to erasure’ of specific information – has been called upon.
But what makes it more interesting is that the ruling on the right to be forgotten not only targets the originating source but also the index machine. This means that Google can no longer defend itself by saying that it is just a search engine, that it does not host the actual information and therefore should not be blamed for what others publish. The court implicitly acknowledges the powerful and pivotal role of Google on the Web and requests that Google takes its responsibility.
Naturally Google is not amused as the ramifications for Google could be big: millions of people can potentially request to have personal data removed. Google is also surprised and furious as the ruling is very different from what Advocate General Jääskinen considered last year: ’search engine service providers are not responsible, on the basis of the Data Protection Directive, for personal data appearing on web pages they process’. Unfortunately for Google the statement only has a advisory status and no binding power.
It is no surprise that freedom of speech and the right to privacy don’t mix well. The EU Court of Justice is merely trying to find its way in the darkness of unknown legal web territory and is proceeding step by step. It will be a lengthy, painful and interesting process of which the outcome will be unsure but messy nonetheless.
