In a decisive ruling for privacy advocates and “the right to be forgotten,” the Court of Justice of the European Union has ruled that Google, as an Internet search engine operator, is responsible for the processing of personal data published by third parties which appear in search results.
The ruling expresses that if a search for an individual’s name returns a link that is “inadequate, irrelevant or no longer relevant, or excessive,” that upon the individual’s request Google is required to remove the link from the results— even if the original information was legally published.
The case originated from a complaint by a Spanish man that a Google search of his name resulted in two links from 1998 newspaper articles concerning the repossession of his house, and that such results were now irrelevant as he has settled the outstanding debt. The complaint against Google was brought to the Spanish Data Protection Agency and was maintained, prompting Google to appeal to the Spanish National High Court, which then referred the issue to European Court of Justice.
The decision centered on defining search engines such as Google as controllers of the data they collect and process, rejecting the defense presented by Google that it is a neutral party in regard to the information it makes available to users.
Individual privacy rights and the protection of personal data have become the focus of online privacy advocates recently after last year’s revelation from Edward Snowden to journalist Glenn Greenwald of The Guardian newspaper about massive U.S. government online data collection and spying aided by companies such as Google, Yahoo, Facebook, Microsoft, and Apple.
The ruling upholds protection of an individual’s personal data and the movement of such data, established in the 1995 European Data Protection Directive.. Furthermore, the “right to be forgotten” is expanded in the Data Protection Regulation passed by the European Parliament in March, which now awaits approval from the Ministers of the Council of the EU.