While the word “visionary” may be overused these days, the term is certainly appropriate when speaking of U.S. Supreme Court Louis Brandeis. In 1928, dissenting in the case of Olmstead v. United States, he wrote that there is a fundamental “right to be left alone.” His prescience was evident in the May 13, 2014 judgment of the European Court of Justice in case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja Gonzalez. In the judgment, the European Court of Justice held that Google, the world’s largest Internet search engine, must take down links to information about individuals, upon request of the subject of that link, if the information is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine.”(i) The judgment, which recognizes a “right to be forgotten,” may have implications well beyond search engines and may affect any multinational organization that maintains or controls personal information because they, too, may ultimately be required to amend, correct or delete certain items of personal data. Such provisions already exist, to various degrees, in Brazil, Japan and, for health information, the United States.
Search engines, the Court held, fall within the ambit of and are governed by the European Union Privacy Directives. The EU Privacy Directive, 95/46/EC, states that personal data (data that can be traced to an identifiable person), may only be collected and processed with consent of the data subject or for a purpose in the Directive. The Court noted that search engines come squarely within the jurisdiction of the Directive, “by searching automatically and systemically for information published on the Internet” and then cataloging the information. The information on a search engine, the Court explained in its Press Release on the judgment, “potentially concerns a vast number of aspects of [a person’s] private life”(ii) and that the effect upon a person’s privacy rights “is heightened on account of the important role played by the Internet and search engines in modern society.”(iii)
The Court offered little guidance to search engine operators as to how to balance the requests against public interest in maintaining the links, or how to implement a process to handle these requests. It is also unclear whether the decision will have effect beyond Europe, to operators of search engines in other locations that house personal data on EU citizens. The European Court decision highlights the growing concerns about an individual’s control of electronic information about him or her. Multinational organizations should study this decision closely for implications as to their management of personal information.
Update: June 2, 2014 – On May 31, 2014, Google released its online form that allows people to ask Google to remove certain information from its results. The form requires the individual to submit a copy of a document that verifies their identity, the specific link(s) which are requested to be taken down, and a brief explanation of why the link is irrelevant, outdated, or otherwise inappropriate. Google has confirmed that it has received 12,000 requests for removal on the first day that the form was made public.
(i) Judgment in case C-131/12, paragraph 94.
(ii) Court of Justice of the European Union, Press Release No.: 70/14, Luxembourg 13 May 2014
by Kenneth N. Rashbaum