Opinion: Google privacy ruling could change how we all use the Internet

Editor’s Note: Paul Bernal is a lecturer in Information Technology, Intellectual Property and Media Law at the University of East Anglia Law School, and a specialist in data privacy issues. He is a blogger and the author of the recently published Internet Privacy Rights – rights to protect autonomy. The opinions expressed in this commentary are solely his.

In a decision that goes strongly against Google, Europe’s highest court has ruled search engine operators are responsible for the processing they carry out of personal data which appear on web pages published by third parties – and that a form of the contentious “right to be forgotten” already exists.

The European Court of Justice’s ruling looks like a strong decision in favor of privacy and individual rights, and against the business models of search engines and certain aspects of freedom of speech.

It means, for example, that if a web page can be found by searching for a person’s name the search engine is responsible for the contents of that page.

In certain circumstances, the search engine operator will be required to remove the search results and links to that page.

Google can be expected to be very unhappy about this ruling indeed, particularly given that last year’s Advocate-General’s opinion suggested the reverse, and the court generally follows such guidance.

What is the right to be forgotten?

One of the perennial problems on the Internet is the idea that whatever appears is there forever.

Stories that appear discreditable – whether they are true or not, whether they are up to date or not, whether they tell the whole story or not – can always be found and brought to the public attention.

The “right to be forgotten” is the idea that we have the right to wipe the slate clean, to remove outdated stories such as spent convictions from the record.

There have been versions of this right in a number of European countries – France, Italy, Spain and Germany, for example – for some time, but for the most part in pre-Internet forms, designed to stop newspapers republishing out-dated stories.

The Internet has changed things so much that some suggest the law needs to catch up.

For most people, Google is the main way people find information – so if you can prevent Google from providing links to a story, to a great extent you prevent people from reading that story.

Many cases have been brought against Google – more than 200 in Spain alone – demanding that links to stories be removed.

The particular one that is the subject of the court’s ruling concerned a real estate auction of property belonging to a man who at the time had social security debts.

It was a story from 1998, but still discoverable via Google, and despite the fact proceedings relating to the debts had been resolved many years before.

The man successfully sued both Google Spain and Google Inc. in the Spanish courts but Google appealed, and it is on that appeal that today’s ruling was made.

The ruling covered three issues.

Firstly, it looked at territory issues, delving into issues such as the ability for Google to be sued, as Google Inc, who operates the search engine and where the data is processed.

Secondly, it looked at whether Google be treated as though it controls the data on pages reachable through its search engine – or whether it is a kind of neutral intermediary.

Thirdly, it considered if current law provides for a right to be forgotten that is enforceable on search engines.

On all three issues, the court effectively ruled against Google.

If a search engine’s business is established in a state, then regardless of where the data itself was actually processed, data protection law applies.

In effect, if Google looks to make money in Spain, the search engine itself is subject to local data protection laws.

On the data processing issue, the court ruled that Google was responsible as controller and on the third issue, that this responsibility implied that Google would have to remove links and results where appropriate.

Specifically, the court ruled that individuals’ fundamental rights “override, as a rule, not only the economic interest of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name.”

This, essentially, is a right to be forgotten.

What happens next?

For Google, this result creates a headache, and potentially huge costs. It could open the door to a floodgate of actions, each of which will need resolution. Google will no longer be able to claim immunity.

The ruling also needs to be seen in the context of the reform of the data protection regime in Europe.

The Data Protection Directive dates back to 1995, before Google was even founded – and a new Data Protection Regulation has been going through the tortuous processes through which EU law is formed for the last few years.

It appears close to completion – it passed through the European Parliament in March this year – and includes a formalization of a right to be forgotten.

The story is not over, however, and it is not clear how this ruling will feed into the last stages of the debate.

That a form of right to be forgotten is deemed to already exist in the current law could bolster the campaign of those who wish for a full “right to be forgotten” in the new regime.

The potential chilling effect of the ruling could make those who oppose the right redouble their already considerable lobbying efforts to have the right removed from the new regulation, thus rendering this ruling irrelevant.

As it is, however, the court has made a ruling that could have a huge impact on how search engines operate, and how we all use the Internet.

Read more: Europe’s top court supports ‘right to be forgotten’
Read more: Google Glass users fight privacy fears
Opinion: Google, let users opt in on privacy setting

The opinions expressed in this commentary are solely those of Paul Bernal.