The right to be forgotten on the internet is a sensitive and complex societal issue at the crossroads between respect for right to privacy, protection of the fundamental rights and freedoms of natural persons, general interest in freedom of information, freedom of expression and communication, duty of memory.
A comprehensive and major reform of the EU legal framework on the protection of personal data proposed by the Commission to strengthen online data protection rights and boost Europe’s digital economy, has been endorsed by the Parliament on March 2014. To become law the proposed Regulation has to be adopted by the Council of Ministers.
In this context, the Court of Justice of the European Union (the Court) recently interpreted the European data protection law, i.e. the Directive 95/46 protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data, and the Charter of Fundamental Rights of the European Union (1).
In this judgment, the Court clearly bolsters the right of any European individual to its data protection and in particular the right to be forgotten by ruling that:
- Google Spain (and by extend all Google European subsidiaries) falls within the material and territorial scope of the EU regulation;
- According to EU regulation and under certain conditions, “the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful”;
- The fundamental rights of a data subject override, “as a rule the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question”.
The Court even gives the procedure to be followed: “Requests may be addressed by the data subject directly to the controller who must then duly examine their merits and, as the case may be, end processing of the data in question. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly” (point 77).
Google responded immediately: a form to fill was put online in May 29, 2014 (2) allowing users to submit a request to remove search results for queries that include their names where those results are inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.
Google indicates that “in implementing this decision, we will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information. When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information—for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials”.
No need to say that this measure covers only European people…
© [INSCRIPTA]
(1) CJEU, Case C‑131/12, 13 May 2014, Google Spain and Google Inc. v/ AEPD and Mr Costeja González.
(2) https://support.google.com/legal/contact/lr_eudpa?product=websearch
