Google must honor requests to delete some links, E.U. court says
by James Kanter & Mark Scott, New York Times
The highest court in the European Union decided on Tuesday that Google must grant users of its search engine a right to delete links about themselves in some cases, including links to legal records.
The decision by the European Court of Justice in Luxembourg is a blow for Google, which has sought to avoid the obligation to remove links when requested by European users of its service.
By ruling that an Internet company like Google must comply with European privacy laws when operating in the European Union — a consumer market of about 550 million people — the court is indicating that such companies must operate in a fundamentally different way than they do in the United States.
Instead of operating as a single around-the-world, round-the-clock forum for other people’s information, Google — and potentially companies like Facebook and probably Twitter — would need in the 28 European Union countries to become more actively involved in refereeing complaints from users about information carried online. The companies would also assume the responsibility and cost for removing that information if requested to do so by national data officials on behalf of people raising complaints.
The case began in 2009 when Mario Costeja, a lawyer in Spain, objected that entering his name in Google’s search engine led to legal notices that he said were no longer relevant. Credit Cabalar/European Pressphoto Agency
‘’This sounds like a landmark judgment,’’ said Peter Hustinx, a top European Union official for data protection. “The court is saying that Google isn’t just selling adverts in Europe, but is providing content along with those services. If you are a regular citizen, it gives you a remedy anywhere in Europe for you to ask companies to take down content connected to you.’’
The ruling would apply only to Europe and probably have no effect for users of Google or other digital media services in the United States, where freedom of speech in many cases overrides privacy considerations, assuming the information is accurate. But Europe tends to strike more of a balance between speech and privacy rights.
And in Tuesday’s ruling the European court indicated that individuals may have the right to have links to unflattering material removed from the Internet even if the original was true and legally posted. The case involved a lawyer in Spain who had sought to have links removed to online newspaper accounts from the 1990s of his debt and tax troubles.
The ruling comes as momentum builds in Europe to adopt an even more far-reaching privacy law already under negotiation by lawmakers that includes a tougher so-called right to be forgotten, or “erasure” as it is termed in draft legislation, that also would apply to companies like Facebook. Helping drive that impulse in the last year have been Edward J. Snowden’s revelations of data privacy intrusions by the United States National Security Agency and some other international law enforcement agencies, which in some cases have involved gleaning information collected by Internet companies.
The judgment on Tuesday was based on a data protection law from 1995 that provides limited rights to object to the processing of personal information and to demand its erasure in certain situations.
The court decided that there were cases in which a company like Google should allow online users to be “forgotten” after a certain time by erasing links to web pages “unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public.”
It ruled that companies like Google could be “obliged to remove links to web pages” even when the original “publication in itself on those pages is lawful,” according to a summary of the judgment. The ruling would not necessarily require that the original publisher of the information delete it from its own website — arguing that individual websites are harder for users to find than information gathered through the data-sweeping capabilities of a search engine like Google’s.
Al Verney, a spokesman for Google, said in a statement that the decision was “a disappointing ruling for search engines and online publishers in general,” and that the company would “take time” to analyze the implications. Google was “very surprised” that the judgment “differs so dramatically” from a preliminary ruling by the court last year that mostly went in the company’s favor, he said.
A trade group for information technology companies said the court’s decision posed a threat to free expression in Europe. ‘’This ruling opens the door to large-scale private censorship in Europe,’’ said James Waterworth, the head of the Brussels office for the Computer and Communications Industry Association, which has Facebook, Microsoft and Google among its members, as well as European companies like BT and T-Mobile. ‘’While the ruling likely means to offer protections, our concern is it could also be misused by politicians or others with something to hide who could demand to have information taken down,’’ he said.
Some Internet experts said the court had devised an unwieldy and expensive formula for search engines like Google that could lead to less information being searchable online.
“Having search engines conduct a public interest test is problematic, not least because they will be challenged to carry out the kind of thorough assessments that can done by courts and other public authorities,” said Orla Lynskey, a lecturer in law at the London School of Economics. “I expect the default action by search engines will be to take down information in response to complaints,” she said.
The judgment on Tuesday reversed what had seemed a preliminary victory for Google in June 2013, when an adviser to the court, Niilo Jaaskinen, issued an opinion implying that Google did not need to remove the links.
Because the European Court of Justice is the highest court in the European Union, Google cannot appeal Tuesday’s decision.
The court ruling is not the first European decision to go against Google on privacy grounds. One of the most delicate cases involved the way Google’s StreetView mapping vehicles collected Wi-Fi data in Europe. The company apologized to users and then deleted the data.
European Union officials — and the French government in particular — also have criticized Google for merging privacy policies for about 60 of its services, including YouTube and Gmail, saying the blanket agreement does not make clear enough how personal data would be used and for how long it will be stored. In January, French authorities fined Google 150,000 euros, or about $206,000, in that dispute. Google paid the fine, but has appealed the ruling to French courts.
Even as the European authorities on Tuesday celebrated a victory for their strict approach to online privacy protection, legal experts asked whether the drive by Brussels to introduce a tougher law was still necessary after such a sweeping ruling by the court.
“Most surprising is that the court has come down firmly in favor of a ‘right to be forgotten,’ ” said Richard Cumbley, a London-based partner at the law firm Linklaters. “Given that the E.U. has spent two years debating this right as part of the reform of E.U. privacy legislation, it is ironic that the E.C.J. has found it already exists in such a striking manner,” he said, referring to the European Court of Justice.
But Mina Andreeva, a spokeswoman for the European Commission, the administrative arm of the European Union, told a news conference on Tuesday afternoon that incorporating the ruling into new legislation was still necessary.
The legislation, Ms. Andreeva said, would make it clear that a right to be forgotten is available to European users whose data was carried by non-European companies — even those companies that do not have a physical presence, like a computer server, in Europe. The new rules would also put an obligation on companies, rather than users as is currently the case, to prove whether data were still needed to be kept online. “Today, it’s up to consumers to prove this, but this is not very easy or effective,” she said. “We have reversed the burden of proof.”
While the European Union has taken a global lead in pursuing data privacy rules, many other foreign authorities — including Brazil and Malaysia — have been watching closely and even adopting their own regulations. That portends an even further fragmented set of policies that American Internet giants will encounter as they operate around the world. Brazil passed a law last month that forces technology companies to remove online material if local courts rule that it is offensive or libelous.
The European case began in 2009 when Mario Costeja, the lawyer in Spain, objected that entering his name in Google’s search engine led to legal notices dating back to 1998 in an online version of a Spanish newspaper that detailed his accumulated debts and the forced sale of his property.
Mr. Costeja said that the debt issues had been resolved many years earlier and were no longer relevant.
When the newspaper that had published the information, La Vanguardia, refused to remove the notices, and when Google refused to expunge the links, Mr. Costeja complained to the Spanish Data Protection Agency that his rights to the protection of his personal data were being violated.
The Spanish authority ordered Google to remove the links in July 2010, but it did not impose any order on La Vanguardia.
Google challenged the order, and the National High Court of Spain referred the case to the European court for advice on how to rule.
In his advisory conclusion, which the European court did not end up following, Mr. Jaaskinen had concluded that because Google merely aggregated information on the web and was a “processor’’ of information and not a “controller” of it — the company was not the legal entity that must comply with the provision of the law in question. Mr. Jaaskinen also said that the 1995 law guaranteed a right to be forgotten only in cases where information was incomplete or inaccurate, which was not at issue in the Spanish case.
But the court deemed otherwise on Tuesday, ruling that Google is a controller of information — a distinction that, according to the court, means Google must comply with European privacy rules when operating in Europe.
Tuesday’s ruling, while indicating what the new legal framework will be for deciding such issues in European Union member states, sent the original case back to the Spanish court to settle Mr. Costeja’s complaint. Whatever the Spanish court might decide in terms of La Vanguardia’s obligation to remove the disputed material from its database, Mr. Costeja’s lawyer said it was a victory because Google would be required to remove the online links.
“We’ve very happy because even though we were confident all along, this has been a very difficult process, given the massive means that Google could use” to defend itself, said Joaquín Muñoz, a partner at Abanlex, a Spanish law firm that specializes in technology cases. “The fundamental point is that consumers will now know what the rules of the game are and how to defend their rights.”