CHAPTER 2: THE JUDGMENT OF THE COURT OF
JUSTICE
The factual background
7. In March 2010 a Spanish national, Mr Costeja
González, complained to the Spanish National Data Protection
Agency (AEPD) that when his name was entered in the Google search
engine the entries which first appeared were pages of the Barcelona
newspaper La Vanguardia of 19 January and 9 March
1998 with an announcement mentioning a property of which he was
joint owner in connection with attachment proceedings for the
recovery of social security debts. He requested, first, that
La Vanguardia be required either to remove or alter those
pages so that the personal data relating to him no longer appeared,
and secondly that Google should be required to remove or conceal
the personal data relating to him so that they ceased to be included
in the search results. He stated that the attachment proceedings
had been fully resolved for a number of years and that reference
to them was now entirely irrelevant.
8. This raises a point which we think worth emphasising.
If information is inaccurate or incomplete, the data subject has
a right to obtain from the data controller its rectification or
erasure.[9] If information,
though accurate, is on a website in breach of the criminal law—an
example might be child pornography—the data controller has
an obligation to remove the link to it. The same applies to data
on a website which are defamatory or contravene civil rights;
search engines constantly receive, and act on, requests to remove
data which are allegedly in breach of copyright. In this case
there was no suggestion that the information was inaccurate; and
far from being illegal, the publication of the information by
La Vanguardia took place on the order of the Spanish Ministry
of Labour and Social Affairs and was intended to give maximum
publicity to the auction in order to secure as many bidders as
possible. This case, and our inquiry, are concerned only with
data which are lawfully on a website but which the data subject
would prefer not to be easily available through a link to his
or her name on a search engine.
9. The AEPD rejected the complaint in so far
as it related to La Vanguardia. However the complaint against
Google was upheld. The AEPD considered that operators of search
engines are subject to data protection legislation given that
they carry out data processing for which they are responsible
and act as intermediaries in the information society. Google took
the matter to the Audiencia Nacional (the Spanish High Court),
which referred to the Court of Justice three questions on the
interpretation of the Directive for preliminary ruling.
First question referred for preliminary
ruling: territorial scope of the Directive
10. The first question asked whether the territorial
scope of the Directive extended to the activities of Google in
Spain. Advocate General Jääskinen[10]
advised that it did, and the Court followed his advice.[11]
The reach of EU data protection legislation therefore extends
to cover not only organisations in the EU but also those outside
the EU which have operations in the EU—even where, as in
the case of Google Spain SL, those operations do not include the
processing of data. This was described by Morrison & Foerster,
a global law firm with one of the largest privacy and data security
practices in the world, as "a very broad interpretation of
the Directive's territorial reach [which] has little basis in
the current wording of Article 4.1".[12]
We can see that this may raise problems for a global corporation
like Google which operates in many jurisdictions outside the EU
as well as within the EU, but it does not seem to us to cause
difficulties for United Kingdom data protection law.
Second question: Is a search engine
a data controller?
11. In its second question the Spanish court
sought a ruling on whether Google's activities as an internet
search engine provider made them a "controller" of personal
data on web pages published by third parties. The difficulty here,
as the Advocate General pointed out, is that:
"When the Directive was adopted the World Wide
Web had barely become a reality, and search engines were at their
nascent stage. The provisions of the Directive simply do not take
into account the fact that enormous masses of decentrally hosted
electronic documents and files are accessible from anywhere on
the globe and that their contents can be copied and analysed and
disseminated by parties having no relation whatsoever to their
authors or those who have uploaded them onto a host server connected
to the internet."[13]
12. A "controller" is defined by Article
2(d) of the Directive as "the natural or legal person …
which alone or jointly with others determines the purposes and
means of the processing of personal data". The Advocate General
and the Court therefore had to decide whether that definition,
drafted without any thought being given to search engines, could
be stretched to include them. The Advocate General thought not.
He argued that:
"the general scheme of the Directive …
and the individual obligations it imposes on the controller are
based on the idea of responsibility of the controller over
the personal data processed in the sense that the controller
is aware of the existence of a certain defined category of information
amounting to personal data and the controller processes this data
with some intention which relates to their processing as
personal data."[14]
13. The Court however differed. The judges thought:
"it would be contrary not only to the clear
wording of that provision [Article 2(d)] but also to its objective—which
is to ensure, through a broad definition of the concept of 'controller',
effective and complete protection of data subjects—to exclude
the operator of a search engine from that definition on the ground
that it does not exercise control over the personal data published
on the web pages of third parties."[15]
The Court therefore ruled that the operator of a
search engine must be regarded as the "controller" of
the personal data processed by the search engine.[16]
Third question: the right to be
forgotten
14. If the Court had followed the Advocate General's
Opinion on the second question, the third question on the right
to be forgotten would not have arisen, since the right to obtain
rectification or erasure of data is available only as against
the data controller.[17]
But since the Court decided Google should be treated as a data
controller, the third question had to be answered. It was summarised
by the Court as asking whether the relevant provisions of the
Directive should be interpreted "as enabling the data subject
to require the operator of a search engine to remove from the
list of results displayed following a search made on the basis
of his name links to web pages published lawfully by third parties
and containing true information relating to him, on the ground
that that information may be prejudicial to him or that he wishes
it to be 'forgotten' after a certain time."
HOW IS INFORMATION 'FORGOTTEN'?
15. The expression 'right to be forgotten' is
misleading. Information cannot be deliberately "forgotten".
It cannot be "consigned to oblivion" (the expression
used by the Spanish court in its request for a preliminary ruling).[18]
The pages of La Vanguardia still exist in hard copy, and
can immediately be accessed electronically by typing in the name
of the co-owner of the property which was being auctioned. The
information may have been published in other newspapers. It may
well still be in the records of the Spanish courts and the Spanish
ministry. It will, in theory, have become more difficult to find
since those pages will no longer appear from a Google search for
the name of the complainant, Mr Costeja González;
in fact it is more prominent than ever since it appears on a large
number of reports linked to the Court's judgment which, of course,
do appear when his name is entered. It will also be accessible
through search engines, like google.com, which are not territorially
subject to the Court's judgment. From the point of view of the
data subject, the right to be forgotten is at best a right to
make information less easily accessible; at worst, it may achieve
the opposite of what was desired.
16. The Minister described the expression as
"an inaccurate and unhelpful gloss on what happened. There
is no right to be forgotten."[19]
All our other witnesses who addressed the issue agreed.
THE ANSWER OF ADVOCATE GENERAL JÄÄSKINEN
17. Since he had concluded that Google were not
a data controller, the Advocate General considered the third question
otiose. He did however answer it in case the Court differed from
him on the second question, as it did. He concluded that neither
the Directive itself, nor the data protection guarantees enshrined
in Article 8 of the European Convention on Human Rights and Article
7 of the Charter of Fundamental Rights (which is in substance
identical), provided the data subject with a 'right to be forgotten'.[20]
He added, in our view very pertinently:
"I would also discourage the Court from concluding
that these conflicting interests could satisfactorily be balanced
in individual cases on a case-by-case basis, with the judgment
to be left to the internet search engine service provider. Such
'notice and take down procedures', if required by the Court, are
likely either to lead to the automatic withdrawal of links to
any objected contents or to an unmanageable number of requests
handled by the most popular and important internet search engine
service providers. … internet search engine service providers
should not be saddled with such an obligation. This would entail
an interference with the freedom of expression of the publisher
of the web page, who would not enjoy adequate legal protection
in such a situation, any unregulated 'notice and take down procedure'
being a private matter between the data subject and the search
engine service provider. It would amount to the censoring of his
published content by a private party."[21]
THE RULING OF THE COURT OF JUSTICE
18. Article 6 of the Directive sets out the principles
governing the collection and processing of data which the data
controller must comply with. Box
1: Article 6 of the Directive
| 1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is complied with.
|
19. Article 12 provides that: "Member States
shall guarantee every data subject the right to obtain from the
controller … (b) as appropriate the rectification, erasure
or blocking of data the processing of which does not comply with
the provisions of this Directive, in particular because of the
incomplete or inaccurate nature of the data". The words "incomplete
or inaccurate" are a reference back to the requirement in
Article 6(1)(d) that the data controller should erase or rectify
data "which are inaccurate or incomplete". There was
no suggestion in the case before the Court that the data were
either inaccurate or incomplete. But the Court, fastening on the
words "in particular", held that the right to have data
erased also extended to data which breached the requirement of
Article 6(1)(c) that they should be "adequate, relevant and
not excessive".[22]
The critical passage reads as follows: Box
2: Paragraph 94 of the judgment of the Court
|
Therefore, if it is found, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of the directive because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.
|
THE NEED FOR PREJUDICE TO THE DATA
SUBJECT
20. Comments that we have seen suggest that the
'right to be forgotten' is widely thought to depend on a requirement
that the information disclosed by the search engine must be prejudicial
to the data subject, or at least must be thought by him to be
prejudicial. The Spanish court's third question asked the Court
of Justice to rule whether it was enough for the data subject
to believe "that such information should not be known to
internet users when he considers that it might be prejudicial
to him".[23] The
Court ruled that "it is not necessary in order to find such
a right that the inclusion of the information in question in the
list of results causes prejudice to the data subject." There
is therefore a right to have information erased even if it is
not in fact prejudicial to the data subject, nor even thought
by him to be prejudicial; it is enough that the information "appears
… to be inadequate, irrelevant … or excessive".
THE QUALIFICATION: AN EXCEPTION
FOR "PARTICULAR REASONS"
21. The Court held that the right of the data
subject to have information erased overrides "as a rule"
the economic interest of the operator of the search engine but
also the public interest in accessing the information by searching
for the data subject's name.[24]
The words "as a rule" introduce an important qualification:
"However, that would not be the case if it appeared, for
particular reasons, such as the role played by the data subject
in public life, that the interference with his fundamental rights
is justified by the preponderant interest of the general public
in having, on account of inclusion in the list of results, access
to the information in question."
22. We quoted in paragraph 17 the Advocate
General's view that internet search engine service providers should
not be saddled with the obligation of having to assess an unmanageable
number of requests on a case by case basis. The consequence of
the Court's ruling is that, not only will search engines have
to assess such requests as against the requirements of the Directive,
they will also, in every case in which they decide that the withdrawal
of a link to a page is prima facie justified, have further
to assess, against unknown criteria, whether there are "particular
reasons, such as the role played by the data subject in public
life" why the link should nevertheless not be withdrawn.
9 Directive, Article 6.1(d) Back
10
The Advocate General of the Court of Justice, like those in many
Continental judicial systems, is an officer of the same standing
as the judges but whose task is to issue to the Court an independent
Opinion of his own on the issues, which the Court usually follows,
though it not obliged to do so. Back
11
Advocate General's Opinion, paragraph 68; judgment of the Court,
paragraph 60. Back
12
Written evidence from Morrison & Foerster (TRF005) Back
13
Opinion, paragraph 78 Back
14
Opinion, paragraph 82. Advocate General's italics Back
15
Judgment, paragraph 34 Back
16
Judgment, paragraph 41 Back
17
Directive, Article 12, opening words Back
18
The reference of course was in Spanish, where the relevant part
of the reference reads: "o desea que sea olvidada".
The English translation by the Court is perhaps more colourful
than accurate. Back
19
Q28 (Simon Hughes MP) Back
20
Opinion, paragraphs 111, 136 Back
21
Opinion, paragraphs 133-134 Back
22
Judgment, paragraph 92 Back
23
Judgment, paragraph 20 Back
24
Judgment, paragraph 97 Back
| 
