EU ruling raises individual privacy over business interest

The Court of Justice ruling raises questions over the future of online searches, says Maria Helen Murphy.

A ‘right to be forgotten’ has become more attractive as internet users realise the permanence of online information.

A ruling this week by the Court of Justice of the EU has led to widespread speculation on the future of online search as we know it.

The facts of the case involved a Spanish national who previously sold his house to pay off social security debts. When his name was searched on Google, the results included links to two newspaper articles from 1998 discussing these issues. The man felt his name should no longer be associated with these prejudicial articles, as he had since cleared his debts.

In spite of the fact that the original articles were both legal and factual, the Court of Justice found he was entitled to have the links between his name as a search term and the “irrelevant” information erased. The Court of Justice relied on the 1995 Data Protection Directive in addition to the rights to privacy and protection of personal data as guaranteed by the Charter of Fundamental Rights of the EU.

Following this ruling, if an Irish person believes that the search results delivered on the basis of their name are inaccurate, irrelevant, excessive, or out of date, they can request that the search engine erase those results. The search engine must conduct a balancing analysis to determine whether the search results comply with the principles of the 1995 directive. If the search engine refuses to erase the offending results, the person is entitled to approach the Data Protection Commissioner, who could make the search engine remove the results in question.

It is important to note that the EU court’s decision did not require that the material be removed from the content provider’s website, and the original articles could remain in their unedited form on the newspaper’s website. It was the Google search results that connected the man’s name with the articles from 1998 that were at issue. Accordingly, anyone who wished to find the original article on the content provider’s website could still do so. To some, this appears counterintuitive and even unfair. It may be argued that it is unduly burdensome on the search company which merely links to existing information that is already available online.

On the other hand, the approach could be seen as recognition of the integral role search engines have come to play in our ordering of the internet. On this second reading, the approach of the court both protects free speech by permitting the maintenance of the original article, and protects the privacy rights of the individual.

Google has emerged as the dominant player in online search. For more than a decade, Google’s application of its famed algorithm has shaped how information is discovered and connected on the internet. Everyone can now be googled, and the benefits and risks of this fact are widely recognised. The ease with which an average person can be associated with isolated events in their past makes the relevance of this recent ruling clear. Due to the permanence of the current model of the internet, a “right to be forgotten” has clear popular appeal. Such a right is even more appealing to a budding job candidate with an unflattering internet past.

Unsurprisingly, Google and other online businesses have expressed dismay at the decision. In its ruling, the Court of Justice makes it clear that the individual right to privacy occupies a privileged position over the business interests of private companies. While the court also privileged the rights to privacy and data protection above the access to information interests of internet users, the court said the balance would depend on the nature of the information in question and on the interest of the public in having that information. A crucial factor identified by the court is the role played by the data subject in public life — politicians and celebrities would not benefit from this protection. As well as raising some censorship questions, the implementation of the ruling in the business practices of online companies is likely to require significant expenditure of resources.

This is not the only notable privacy decision of the court in recent times. In April, the Court of Justice found the Data Retention Directive to be disproportionate and in breach of the Charter of Fundamental Rights. In addition, significant progress has been made towards strengthening the current EU data protection laws. It should be noted that this right to be forgotten ruling has been delivered in the context of a significant resurgence of public interest in privacy rights globally. While the Snowden revelations are unlikely to have a direct impact on the development of the EU privacy law and policy, the leaks have led to the increased prominence of privacy issues in the public debate.

lThe ruling on Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González was delivered by the Court of Justice of the EU on May 13.

* Maria Helen Murphy is an academic at NUI Maynooth.