A Bit of Clarity on the Right to be Forgotten from EU

This is a delayed post, but better late than never. At the end of June, an Advocate General of the Court of Justice of the European Union filed an opinion regarding the Spanish Data Protection Agency’s (AEPD) decision from back in July, 2010 to uphold a complaint filed by one of its citizens against Google for not withdrawing data from its search index. It all started in 1998 when a newspaper reported (in print) information about an auction related to a social security debt and the announcement’s subsequent electronic presence years later, retrievable through Google. The data subject of the announcement contacted the publisher in 2009, but the newspaper refused to erase the content from the site. He then requested that Google Spain see to it that the link was not included in search results for the data subject’s name, and the request was forwarded to the main office in Mountain View. The identified individual also filed a complaint with AEPD against both the search engine and the publisher.

The AEPD found the publication of the data legally justified but supported the complaint as it related to Google – who appealed to the Audiencia Nacional seeking to overturn the agency’s decision. The National High Court of Spain referred the question to the EU Court of Justice.

This long awaited opinion is somewhat anti-climactic. First of all, the Advocate General’s opinion is not binding; it serves as more of an advisory document. Second, the opinion sheds little light on the right to be forgotten that we can expect to come from the proposed Data Protection Regulations.

Essentially the opinion answers a few questions:

1.) Google is accountable for processing data in Spain, regardless of the fact that no processing of personal data related to searches occurs in Spain. “[I]t must be considered that an establishment processes personal data if it is linked to a service involved in selling targeted advertising to inhabitants of a Member State, even if the technical data processing operations are situated in other Member States or third countries.”

2.) Even though Google is processing personal data, it is not a data controller of the personal data that appears on a web page hosted by a third party. It has no way of removing data from a web page, and so it cannot be held to the obligations of a data controller of that personal data. Google has to remove information from its index only when it has not complied with the exclusion codes (i.e., robots.txt) or updated cached memory. This is the most interesting. The AG explains that search engine service providers are not responsible, on the basis of the DATA PROTECTION DIRECTIVE, for personal data appearing on outside web pages they process. There may be secondary liability for search engines under NATIONAL LAW that may lead to duties amounting to the blocking of access to 3rd party sites with illegal content like IP infringing material or libelous or criminal information – but not data protection. 

3.) There is no right to be forgotten under the current DP Directive. This is not surprising, even though the European Commission claimed it would be “strengthening” the right to be forgotten in the new DP Regulations, suggesting a weak right to be forgotten existed. However, the AG did explain that the right to object in the ’95 DP Directive requires more than just the “subjective preference” of the data subject to meet the “compelling legitimate grounds” hurdle. This begs the question about whether the subjective preference of a data subject will be enough to have information removed if no compelling legitimate grounds in the future.

Although the AG is not extending liability onto the search intermediary in this case (and recommends this as a general rule), it is difficult to know whether this (rational) interpretation will extend into the DP Directive. The AG explains that search engines had not been foreseen when the 95 DP Directive was drafted. That is not true for the DP Regulation, which does establish a right to be forgotten as well as addresses data transfers to third parties. Because this is the first instance in which the DP Directive has been interpreted in relation to a search engine, the AG’s opinion may not be followed by the Court.