Europe's highest court today ruled that search engines can be ordered to remove links to publicly available news items from their search results.
The decision by the European Union Court of Justice (ECJ) has dealt a blow to Google in Europe. The company had, through its Spanish operation Google Spain, appealed an order by the Spanish Data Protection Agency (AEPD) that stipulated that the company had to remove links to two pages published in 1998 by Spanish newspaper La Vanguadia.
The order followed a complaint by a Spanish national to the AEPD in 2010, after he found that searches for his name made through Google returned links to the two pages, which contained details about a real-estate auction that was held to settle social security debts. Essentially, the complainant believed the links highlighted details about his history that were no longer relevant.
While the man's request that the newspaper remove the two pages in question was knocked back, the AEPD did order Google to remove the links from its search results — a decision Google then appealed against.
At the heart of today's ruling is the question of whether the existing 1995 Data Protection Directive can be used by a data subject (in this case, the Spanish national) to request to be "forgotten" by a data controller (Google). Interestingly, the introduction of a so-called "right to be forgotten" was a key plank in Europe's 2012 proposed overhaul of the 1995 directive, which means the right may exist even before the update to the directive has officially been made law.
According to the ECJ, "if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased".
Complicating Google's compliance with the order — and how it handles future removal requests — is the ECJ's view that the legality of the company's indexing and collection of "accurate" data may shift over time.
"The Court observes in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed."
If a request to be forgotten meets those conditions, Google and other search engines would be obliged to examine what results are returned when a person's name is searched and whether they contain links to the offending information.
"If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made," the ECJ noted.
Google and other web companies will now also be obliged to "duly examine" all removal requests on their merits and where one is declined, the complainant can take their case to a relevant authority.
Google said in a statement: "This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the advocate general's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."