It’s been around 6 months since our last post. However it’s holiday time and do expect us to churn out something during this politically active time period. For now we have a post from Divya Mirlay, a II Year Law student from Christ College, Bangalore. A special thanks to her and all our other followers for helping us keeping the fire of LTATL burning.
On 13th May, The European Court of Justice in Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja Gonzálezheld held inter alia, that if, in the event of indexing by a search engine of personal data relating to an identified or identifiable natural person (data-subject) and the dissemination of the same is prejudicial to his fundamental right to data privacy and protection, the data-subject’s ‘right to be forgotten’ overrides the legitimate economic interests of the operator of the search engine and the general interest in freedom of information. A brief summary of the case-history and judgment is provided below.
In 2010 Mario Costeja González, a Spanish national, lodged a complaint against the publisher of a Spanish newspaper La Vanguardia Ediciones SL and against Google Spain and Google Inc. with the Spanish Data Protection Agency, the AEPD. (Agencia Española de Protección de Datos) Mr Costeja González contended that, when an internet user entered his name in the search engine of the Google group (‘Google Search’), the list of results would display links to two pages of La Vanguardia’s newspaper, of January and March 1998. Those pages in particular contained an announcement for a real-estate auction organized following attachment proceedings for the recovery of social security debts owed by him. In this context, Mr Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant. With that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appeared) or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future. Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the European Court of Justice. One of the questions referred regarded the scope of the right of erasure and/or the right to object, in relation to the right to be forgotten.(“derecho al olvido”)
European Court of Justice-Judgment
Question referred the by National High Court, Spain to the ECJ on the Right to be Forgotten
The Court considered EU Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with regard to the processing of personal data and on the free movement of such data (‘Directive 95/46’) which, according to Article 1, has the object of protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data.
One of the questions referred to the ECJ was, in essence, whether Article 12(b) and subparagraph (a) of the first he paragraph of Article 14 of Directive 95/46 are to be interpreted as enabling the data subject to require the operator of a search engine to remove from the list of results displayed following a search made on the basis of his name links to web pages published lawfully by third parties and containing true information relating to him, on the ground that that information may be prejudicial to him or that he wishes it to be ‘forgotten’ after a certain time.
Article 12 of Directive 95/46, entitled ‘Rights of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
Article 14 of Directive 95/46, entitled ‘The data subject’s right to object’, provides:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
Considering Article 12(b), the Court additionally emphasized the requirements under Article 6(1)(c) to (e) of Directive 95/46, which provides:
- Member States shall provide that personal data must be:
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
Thus, under Article 12, the data subject possesses the right to obtain blockage of data, the processing of which does not comply with the provisions of Directive 95/46. The Court in this regard has constructively interpreted such incompatibility to also result from the data being ‘inadequate, irrelevant or excessive in relation to the purposes of the processing, that they are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes’, as provided under Article 6 of the Directive.
The Court also held that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed.
It is in this light of reasoning that the Court deemed the links to the web pages lawfully published by the third party to be incompatible with Article 6(1)(c) to (e) on the basis of the data being ‘inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing issue carried out by the operator of the search engine’. The Court then ordered for the information and concerned links to be erased.
The Court points out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.
The Court further held that under Article 7 and 8 of the Charter of the European Union, the fundamental right of the data-subject to request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results override the economic interests of the search engine as well as the interest of the general public. However, this would not be the case if, for particular reasons, the nature of the role played by the data subject in public life justifies the interference with his fundamental rights.
Implications-Application of Domestic Laws
Google Inc. and Google Spain had previously disputed that the processing of personal data is carried out exclusively by Google Inc. It was further submitted that Google Search, which was again, solely operated by Google Inc., was done without any intervention from Google Spain. It was argued that the latter’s activity was separate from its search engine service. Nevertheless, the Spanish Government pointed out that Article 4(1)(a) of Directive 95/46 does not require the processing of personal data in question to be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities’ of the establishment. The Court then analyzed the language of the relevant provision:
Article 4(1)(a) of Directive 95/46 entitled ‘National law applicable’ provides:
1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;
The Court firstly held that Google Spain, being a subsidiary of Google Inc. was an ‘establishment’ within the meaning of Article 4(1)(a). In order to satisfy the criterion laid down in the above provision, it is also necessary that the processing of personal data by the controller be ‘carried out in the context of the activities’ of an establishment of the controller on the territory of a Member State. The Court interpreted the ‘context of activities’ to mean a branch or subsidiary of the operator of the search engine (Google Spain) intended to promote and sell advertising space oriented towards the inhabitants of the Member State. In other words, the display of data on Google Search, by virtue of being accompanied by the advertisements provided by Google Spain on the same page constitutes the processing of data carried out ‘in the context of the activities of an establishment of the controller on the territory of the Member State.’ This inextricably links the activities of both, Google Inc. and Google Spain. Having said this, the Court then stated that the processing of data carried out for the purpose of operation of the search engine would be liable to fulfill the obligations and guarantees laid down by Directive 95/46. In this context, it may be said that as per Article 4(1)(a), the national laws of Spain, implemented in pursuit of Directive 95/46, would be applicable to Google Spain, even though the Google Search is exclusively operated by Google Inc., without any interference by Google Spain. Thus, the domestic laws of Member States, being applicable in such situations, would possibly not require the parent/ controller to be impleaded as intermediaries while requiring the website to erase/disable access to information.