In response to May 13 decision by the Court of Justice of the European Union (CJEU) ordering Google to allows users to demand that Google remove information about them, Google announced May 29 that it was complying with the ruling. The decision is not appealable and is now the law in the EU.
The company’s response was to publish two new web forms (one for search and one for image search), which — for the UK — can be linked to from here. Several points are notable about these forms, according to a client alert put out the next day by Baker & McKenzie.
From the client alert
On 13 May, 2014, the Court of Justice of the European Union (CJEU) issued its decision in the case of Google Inc and Google Spain against the Agencia Española de Protección de Datos, the Spanish data protection authority (the “Costeja Decision”). The court’s decision immediately grabbed the attention of the news services and became a headline item; it continues to generate considerable comment around the world. The heat has been generated by the court’s support for a ‘right to be forgotten’, a concept that had only first been expressly mooted in the commission’s draft for a new data protection regulation, in January 2012, but which, in light of this case, is apparently already existing law under Directive 95/46/EC.
Google expressed disappointment with the decision at the time of its release. Supported by free speech advocates and most of news community, it raised concerns about the implications for access to information for European users, as well as the practical problems of asking a private entity to make determinations which balance competing fundamental rights (i.e. freedom of expression v privacy) and determine where the public interest lies. Supporters of the CJEU’s decision pointed to the fact that the media industry has long been in an equivalent position. They argue that the Internet results in information attaining a permanence that did not previously exist, such permanence justifying reasonable restrictions on search engines in support of privacy rights because of the prominence to information that search engines facilitate.
Whatever side of the debate one takes on these issues, there can be no doubt that the decision in this case is of fundamental importance for publishers of information online (it has been reported that the BBC has already received a take down notice in respect of its news archive), search engines and content aggregators alike.
Several points are notable about these forms, according to Baker.
Consistent with the language of the judgment, Google is asking that the complainant explain why the information is “irrelevant, outdated or otherwise inappropriate” [para 93 of the judgment]. Interestingly, Google has elected not to include the fourth criterion mooted by the CJEU, namely that the information is “excessive”, immediately above the input box, but it does mention it at the start of the form, so we do not think much can be read into this.
It remains to be seen what approach Google will take to assessing such claims. One of the hardest things to reconcile about the Costeja Decision is why the court felt it irrelevant that Mr Costeja had been declared bankrupt in the past, especially as he is a lawyer, a profession whose rules look very dimly on bankruptcy. Indeed, the very fact that bankruptcy is published as a matter of the public record indicates that the legislature felt that there was a public interest in the publication of this information.
The logical inference is that there is a constituency for whom this information was and remains relevant (a fact inherent in the CJEU’s decision that the source information was remained relevant and publishable on the newspaper’s website, which turned up in Google’s search results).
The CJEU offers no guidance as to how relevance should be determined and, in particular, relevance to whom. This perhaps explains the inclusion of the following language on Google’s form: “After you submit this form we may forward your request, and any accompanying details, to the relevant data protection authority”. One expects that Google, and other search providers, are likely to seek guidance from DPAs as to where to draw the line, if only to highlight the difficulty of doing so in any principled manner. The Costeja decision is inherently relative, making applying its ratio much more complex than some of the decisions that media outlets have had to face in the past.
It continues: Complainants will be required to nominate the country whose law they say applies. This may indicate that Google intends to limit takedowns geographically. There has been much talk in the press about European users being offered a second tier internet as a result of the Costeja decision, but this level of granularity on the take down form leaves open the possibility of a more granular approach. This feature of the form also highlights another of the difficulties in implementing the decision. It is possible that the relevance of information varies from one place to another, much as the CJEU has held that the concept of ‘unfairness’ under European consumer law can vary from one member state to another.
For example, an old spent conviction for a British citizen who retires to Spain may be irrelevant to Spanish users, but would be highly relevant to British users if that person returned to the UK and stood for public office.
The form also indicates that Google may tell source sites that information on their site has been taken down. It says: “We may inform webmaster(s) whose content is removed from our search results as a result of your complaint”. This raises an interesting fact scenario — one which of course the Costeja case itself highlights. Most of people would never have heard of Mr Costeja, much less that he had been bankrupted, had it not been for this case. Given that the CJEU held that it was relevant and appropriate for the newspaper to continue to publish the bankruptcy notice, would it also be relevant for the same newspaper to publish a news article about the fact that takedown notices had been filed by a particular complainant, especially if they relate to factually undisputed content? The information has a relevance in the context of the take down request and reporting of it that it may not have in its originally indexed form.
Implications
Google’s response to the Costeja decision is important for all stakeholders as it is likely to set the industry bar for responding to take down notices of this sort. Other search engines will watch the response with interest, as will the media industry and DPAs (and of course those who represent public figures in particular). Any publisher of material or links on the web would be wise to keep an active eye on this area of developing jurisprudence.
Background
The Costeja decision arose from a request by Spanish resident, Mr Costeja, to have a bankruptcy notice in respect of him removed from Google’s search results. Google refused and the matter ended up in the CJEU. In summary, the court made three key findings:
1. Controllers — The court had to determine whether Google was a ‘controller’ under Directive 95/46/EC. The Advocate General had held that Google was not, on the grounds that it was not aware of the nature of the information it was automatically indexing, personal data or otherwise. The court decided that Google was a controller because it determined the ‘purpose and the means’ of the processing it carried out, as defined in article 2(d), whether jointly with the original publisher or on its own.
2. Establishment — The next question was to determine whether Google was ‘established’ in Spain for the purposes of Directive 95/46/EC. Google argued that since Google Inc owned and operated the search engine and was located in the US, it was out of reach of the Spanish authorities. Here the Court agreed with the Advocate General that the applicable law provisions of Directive 95/4/6/EC do not require the Spanish entity to have actually processed personal data. It was sufficient that such processing was carried out “in the context of the activities” of the Spanish establishment.
3. A right to forget — The issue at the heart of the case was whether Google had to remove indexed links to a newspaper article even though the original publication can lawfully continue to be available on the internet. Here the focus of the analysis concerned Articles 12(b) and 14(a) of Directive 95/46/EC. Rather than undertaking a balancing exercise between the privacy rights of the data subject; the legitimate interests of Google and the rights of others to receive information, the court held that the data subject’s rights “override, as a general rule”, these other interests. This is the most surprising part of the judgment. Remarkably, the CJEU concluded that the newspaper website which hosted the content linked to was justified in keeping that content available on the internet, while Google was required to remove it from its search index. Therefore, the processing was ‘relevant’ for the newspaper, but ‘irrelevant’ for the search engine.
Ben Allgrove of Baker & McKenzie. Courtesy photo.
The Baker & Mckenzie client alert was written by London Partner Ben Allgrove and consultant Ian Walden.
