Google Spain and the “Right to Be Forgotten”

The European Court of Justice (CJEU) has decided the Google Spain case, which involves the “right to be forgotten” on the Internet. The case was brought by Mario Costeja González, a lawyer who, back in 1998, had unpaid debts that resulted in the attachment and public auction of his real estate. Notices of the auctions, including Mr. Costeja’s name, were published in a Spanish newspaper that was later made available online. Google indexed the newspaper’s website, and links to pages containing the announcements appeared in search results when Mr. Costeja’s name was queried. After failing in his effort to have the newspaper publisher remove the announcements from its website, Mr. Costeja asked Google not to return search results relating to the auction. Google refused, and Mr. Costeja filed a complaint with Spanish data protection authorities, the AEPD. In 2010, the AEPD ordered Google to de-index the pages. In the same ruling, the AEPD declined to order the newspaper publisher to take any action concerning the primary content, because the publication of the information by the press was legally justified. In other words, it was legal in the AEPD’s view for the newspaper to publish the information but a violation of privacy law for Google to help people find it. Google appealed the AEPD’s decision, and the appeal was referred by the Spanish court to the CJEU for a decision on whether Google’s publication of the search results violates the EU Data Protection Directive.

The question presented to the CJEU by the case was “whether [the Directive is] to be interpreted as enabling the data subject to require the operator of a search engine to remove from the list of results displayed following a search made on the basis of his name links to web pages published lawfully by third parties and containing true information relating to him, on the ground that that information may be prejudicial to him or that he wishes it to be ‘forgotten’ after a certain time.” The CJEU has now answered that question in the affirmative:

[I]f it is found, following a request by the data subject…, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, … inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.

The search engine operator’s obligation, the CJEU went on to say, is triggered whether or not “the information in question in the list of results causes prejudice to the data subject.” It is limited, however, by a preponderant public interest in access to the information in question, if, for example, the subject is a public figure.

Google Spain is not the first case involving search and the “right to be forgotten” in the EU. In January of this year, a German court ordered Google to purge its image search results of six images showing former Formula One president Max Mosely participating in a “Nazi-themed” sex party. The German decision followed a similar ruling in France involving the same photos. The Mosely photos, to my mind, present a closer privacy case than the Costeja auction announcements because they are intimate in nature and were not a matter of public record until they became fodder for scandal sheets. Whatever the circumstances of Mr. Costeja’s financial difficulties, they resulted in official action against his property. And, as any lawyer in the U.S. knows, an assessment of one’s character and fitness to practice law entails inquiry into how one handles money and debt. That may not be true for lawyers practicing in the EU, but it’s certainly true here.

The evolving law in the EU concerning the “right to be forgotten” is problematic not only from the perspective of intermediary liability but also from the perspective of the integrity of the historical record. The CJEU’s embrace of a double standard with respect to the information (i.e., it was permissible for the newspaper to publish it in 1998 but not for Google to link to it in 2014) raises a difficult question about the law’s role in empowering people to sculpt their public information profiles to conform with an image of themselves that they want the world to see. There is no question in Mr. Costeja’s case that the information at issue was true or that it was appropriately publicized by the newspaper. Does damaging public information become private simply by virtue of the passage of time? How stale does information have to be to be considered “irrelevant or no longer relevant”? And what is the standard for measuring relevance? Relevant to what, to whom, or for what purpose? I can only imagine how the cottage industry of online reputation management will grow in the face of this expanding “right to be forgotten.” Search intermediaries will be more than ever curators of the content they index, which is a development that I, as a consumer of information and a user of search, don’t welcome.

There is, undeniably, a certain brutality to the fact that information on the Internet can live forever. And there are surely circumstances in which private personal information that has become public is so damaging when weighed against its truth value that it shouldn’t be kept alive through persistent links. I worry, however, about the broad scope the CJEU seems to be creating for the “right to be forgotten.” As this door opens wider, the burdens on search intermediaries are becoming both greater and more nebulous, and the threat to the integrity of the digital historical record is increasing.