A decision made by the European Court of Justice (ECJ) regarding the removal of personal data on search engines, holds a degree of implication for not only search engines but also for social media operators and businesses operating within the EU. The matter arose back in 2010, with the case of Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12.
The latter involved a complaint from Mr. González against Google Spain after the search engine refused to remove the weblinks published in a daily newspaper. The webpages contained his personal data concerning an auction of real estate. After Google was ordered to remove the data, they appealed to the Spanish National High Court, requesting for the decision to be annulled. After the matter was referred to the ECJ, the outcome held that although Google couldn’t be deemed data controller of third-party sites, the search engine was viewed as a data controller in relation to the data processed by the engine. As a result of this data processing, the ECJ stated that the individual’s fundamental right to privacy was affected.
Further, the ECJ viewed that a website operator may have the right to erase links published by third parties when the inclusion of such links would become incompatible with the Data Protection Directive (95/46/EC). Therefore, although data may have been legitimately published, it should no longer be searchable by the name of the individual. The Directive is binding in all EU member states and will mean EU search engines are required to handle requests for the deletion of search results.
This is where implications arise for the search engines. If they were to risk complaints to data protection agencies (DPAs), they would have to put a lot of time into assessing each case carefully, as well as covering the costs which would arise. Alternatively, search engines could de-activate the name search and have the legally published information available to a limited audience only. Compliance with the data protection laws will also implicate social media sites, despite the fact that they do not make the decision about online content, in the same way as search engines. Furthermore, the EU directive may also apply to non-EU entities, if a non-EU parent company has a service aimed at the EU member state market.
Overall, the EU Directive enables individuals to request the deletion of their personal data from a search engine. This would require the careful consideration of the nature and the sensitivity of the information, as well as the interest of the general public toward the information. The ECJ also proclaimed that whilst the use of consented personal data is not extended to search engines, it is allowed for journalistic purposes.
If you have any queries regarding the above article or would require assistance with an alternative matter, please do not hesitate to get in touch with a member of our Lawdit team today.
Tel: 023 8023 5979