On May 13, 2014, the European Court of Justice dismissed Google’s claims on the grounds that search engines are responsible for the processing of personal data published on web pages (ECJ, Google Spain SL, Google Inc. / Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez, May 13, 2014, C-131/12).
A Spanish internet user sought from the Spanish Data Protection Agency the deletion of two press articles that reported his indebtedness. He also requested that these articles be de-indexed by Google since they no longer reflect his situation.
In this respect, the ECJ upheld a fundamental right: the right to be forgotten. Henceforth, when so requested by a person, search engines must delete search results that are irrelevant and outdated.
Furthermore, the Court is of the view that Google and other search engines have to exercise control over personal data as they retrieve, record and organize them in a systematic way. They are thus controllers within the meaning of EU privacy law.
The Court also mentioned all persons have a right to control their personal data, irrespective of whether they are public figures or not. Therefore, if a person wishes that irrelevant or inaccurate information pertaining to them be deleted from search engine results, they may request the deletion thereof even if the information has been published legally. Such a request may be addressed directly to the search engine operator who must duly examine its merits.
Finally, the decision to delete a person’s personal data depends “on the nature of the information in question, on its sensitivity for the person’s private life and on the interest of the public in having that information, an interest which may vary according to the role played by that person in public life.”
The ECJ upheld, in the end, the right to be forgotten. Nonetheless, it is not an absolute right since a balance must be struck between the freedom of expression, of information and the right to privacy. Finally, problems related to the enforcement of this right to be forgotten have already arisen following this decision.
Indeed, in the three days following the decision, Google received hundreds of withdrawal requests of personal data. Google reported on the complexity of processing these requests since they are in different languages and given that particular attention must be given to each of them.
Nevertheless, the European Court of Justice’s decision holds that legal action may be initiated before a supervisory authority or a court against the search engine operator and/or the latter may be heavily fined if it does not take any action.
In order to regulate the right to be forgotten, the CNIL’s annual report of May 19, 2014 offers effective means to control the publication of personal data. First and foremost, the CNIL recommends the elaboration of a framework of reference on the duration of conservation of personal data. The rationale behind such a recommendation is to provide guidelines for those in charge of the processing regarding how long they may keep personal data. Moreover, the CNIL suggests tools that would allow internet users to have better control on the publication of their data. For example, they could define a time limit for publication, modify their data or delete it. Lastly, the CNIL advocates that the right to be forgotten should be supplemented by an obligation to de-index without delay incumbent to search engines from the moment an internet user has obtained the deletion of the initial information.