In a judgment with far-reaching consequences for the Internet industry in general and search engines in particular the CJEU on May 13, 2014 in the Costeja case (C 131-12) concluded that search engines are regarded as ‘data controllers’ under the Data Protection Directive and that they are not exempted under the safe harbour rules of the E-commerce Directive. Balancing the fundamental rights between search engines and data subjects, the CJEU further concluded that search engines under certain circumstances are obliged to remove search results from its search indexes.
The case before the CJEU is the result of a request for a preliminary ruling from a Spanish appeal court, the Audiencia Nacional. In the case before the Audiencia Nacional the applicant claimed that Google should remove certain information regarding the foreclosure of the applicant’s property because of the applicant’s social security debts from its search results. Searches for the applicant’s name revealed the foreclosure which eventually did not occur and the applicant applied to the Spanish Data Protection Authority requesting an injunction against the newspaper where the data had occurred and an injunction against Google Spain SL and Google Inc. to delete the data from Google’s index.
The Costeja decision addresses a number of core issues under the Data Protection Directive, namely (i) the territorial scope of the Data Protection Directive, (ii) whether search engine operators are to be considered as data controllers (iii) whether search engine operators are exempted under the safe harbour rules of the E-Commerce Directive and (iv) under which circumstances a data subject can claim a ‘right to be forgotten’. In summary the CJEU has concluded that
- the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’, ‘organises’, ‘stores’, ‘discloses’ and ‘makes available’ data to its users and thereby ‘processes’ the data in the context of the Data Protection Directive.
- It is the search engine operator which determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of that activity.
- A search engine which is operated by an undertaking that has its seat in a third State but has an establishment in a Member State, carries out processing of personal data ‘in the context of the activities’ of that establishment if the latter is intended to promote and sell, in that Member State, advertising space offered by the search engine which serves to make the service offered by that engine profitable.
- The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
- The data subjects fundamental rights under Articles 7 and 8 of the Charter to request that the information in question no longer be made available to the general public by including it in on the search engine index list override the economic interest of the operator of the search engine and the interest of the general public in having access to that information upon a search relating to the data subject’s name. However if there is a preponderant interest of the general public in having access to the information in question, such as the role played by the data subject in public life, the right to access information overrides the data subject’s interests
The fact that the CJEU in the Costeja decision has come to the conclusion that search engine operators are regarded as data controllers and as such being responsible for removing information regarding data subjects from its indexes even though the original web page publishing was lawful comes as a surprise to many. The conclusion is suprising in that the Advocate General Jääskinen, who has opined in many Internet related cases, had opined that Google would not be regarded as a ‘data controller’ and that the data subject would not have the right to prevent a search indexing information relating to him/her. Further, the balance that the CJEU strikes between the fundamental right of privacy and the public’s fundamental right to access information raises eyebrows in view of the importance of the the Internet in enhancing the public’s access to news and generally facilitating the dissemination of information emphasized in several judgments by the European Court of Human Rights (cf Times Newspapers Ltd v. the United Kingdom(nos. 1 and 2), Wegrzynowski and Smolczewski vs Poland, the Internet related judgments are summarized by the European Court of Human Rights in a factsheet).
The judgment obviously gives rise to a number of questions regarding the application of the Data Protection Directive not only to search engines but also to other operators of digital services frequently used by the public which in an automated manner processes personal data, such as social media websites or auction sites. The result of the wide jurisdictional reach of the Data Protection Directive and the fairly broad ‘controller’ definition is further that companies which are established outside of the EEA must take caution and assess whether they are subject to the rules of the directive or not. The decision puts a new regulatory pressure on Internet start-ups which will have particular difficulties to assess the privacy boundaries. Finally, in view of the newly imposed ‘right to be forgotten’ newspapers providing digital article databases and database publishers will likely need to implement measures to address requests from data subjects to be excluded from search results in the respective databases.
Removal requests in response to the Costeja judgment
The Costeja judgment has clear impacts on all search engines, not only Google, but also the Bing and Yahoo search engines which likely are regarded as ‘controllers’ under the directive. The search engines evidently face difficulties consistently applying the Costeja decision and in particular deciding whether there is a preponderant interest of the general public in having access to the information in question. Google has quickly adopted to the Costeja decision and as an initial effort published two “Search removal request under European Data Protection law” forms (one for web search and one for picture search) which data subjects may fill out and submit to Google. Google will thereafter evaluate the data subject’s request balancing the freedom of information against the data subject’s rights to privacy. Facing a difficult balancing where the Costeja judgment does not give much guidance, Google will among others evaluate the public interest and whether the data is irrelevant, outdated or otherwise inappropriate. The data subject is requested to submit the linked page and to explain why it is about the data subject and to verify his/her identity by submitting a copy of an ID card. Among Google’s first steps is further, according to the Financial Times, the establishment of a privacy committee with Google executives, Wikipedia’s head and academics and former data regulators from a number of European countries.
Undoubtedly, requests for removals from search engine results will create a growing workload for search engines in particular when it comes to extensive requests covering both texts and images where it is difficult for a search engine operator to decide on the relevance of the facts submitted by the data subject. Google’s initiative is an interesting first attempt in seriously addressing the impact the consequences of the Costeja decision which will be followed by other search engines. In due time there will likely be national decisions on which data shall be removed and not, decisions which, in view of the European Data Protection Authority’s differing opinions on other subjects are likely not to harmonize. The Swedish Data Inspection Board has not yet published any guidelines or other recommendations in view of the Costeja decision. It is foreseeable that the Article 29 Working Party will issue a working document addressing some of the more difficult issues that Internet operators are facing in view of the Costeja judgment.