Right to be Forgotten?

Lots of this morning's news has focused on Google's removal of news stories from search results. Many are expressing outrage at the implications this has for freedom of expression and information.

Credit

How did it come about?

13th May 2014, the European Court of Justice passed a judgement in the case Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González. Google results linked two 1998 articles regarding action taken against a Spanish National to recover social security debts. The individual in question argued that as the matter had been resolved, the results were no longer relevant, and should therefore be removed. (More details on the facts can be found here.) The case was referred to the ECJ, who decided that 

"As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter (EU Charter of Fundamental Rights), request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question."

In other words, Art 7 -Respect for private and family life and Art 8 - Protection of personal data, are to be upheld over the freedom of expression and information, unless the data is of particular public interest. It was also held Google is a data controller, “given that it is the operator which determines the purposes and means of the processing”.

What does this mean for EU Citizens? 

If you are a resident of the European Union you can request to have search results relating to you removed from Google, if you believe that they are "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed." Although this judgement was in relation to Google, as Kathryn Smith writes, this could eventually lead to a right to removal unwanted data such as photos from social networking sites. 

What does this mean for businesses?

• "A business does not have to have control over the information itself in order to be considered a data controller for the purposes of the Directive; all that is necessary is for the business to have some control over when and where the data is displayed." – Richard Bevan, Partner at Boodle Hatfield
• "This [...] is a ruling that could affect many more businesses than the search engines on which so much attention has been focused. Social media sites are an obvious example; but other businesses, too, could be subject to the rules." - Emma Woollacott, Forbes
• "An EU Member State's data protection laws will in the future likely be held applicable, if any entity – not just a search engine operator - established in a non EU Member State (1) processes data, and (2) has a subsidiary established in any EU Member State that engages in substantial advertising or promotional activities which are directed to inhabitants of that EU Member State." – Osbourne Clarke Publication

Businesses are likely to require legal advice in this area, and for some it may even affect their decisions to establish themselves in the EU. 

Read More:

CURIA Press Release

Judgement of the Court

City AM

The Right to be Forgotten: Legislating for Individuals to Regain Control of their Personal Information on Social Networks
LVCENTINVS (not a typo)
Lawyer2b Google and an EU 'right to be forgotten'?
Commercially Aware - UPDATE: Right to be forgotten? (13/10/2014)

Priscilla