Top EU court upholds “right to be forgotten”

A ruling by the European Court of Justice (ECJ), that EU citizens can demand the removal of search results about themselves, has led to accusations of censorship and inconsistency.

The judgement stems from a long-running case in Spain, in which a man claimed that when Google searching his name, the results returned – a 1998 auction notice of his repossessed home – breached his right to privacy.

The claimant, Mario Costeja Gonzales, lodged a complaint with the Spanish Data Protection Agency (AEPD) against national newspaper La Vanguardia, which first published the notice, and Google Spain.

While the AEPD upheld La Vanguardia’s right to publish the notice, it referred the matter of the search results to the ECJ, which today came down in favour of Costeja Gonzales.

Following the judgement, the ECJ has ruled that if, following a web search of a person’s name, the list of results contains a link to a web page containing information on that person, they can ask the search engine to move that result.

If the search engine refuses, the subject of the search can approach the relevant authorities and ask them to enforce the removal of the link.

The court added that while governing bodies should take public interest and the role of the individual in public life into account when making a decision, “the data subject’s rights [to privacy] … override, as a general rule, that interest of internet users”.

The decision has been criticised by the Open Rights Group (ORG), which has said the move could restrict access to content already in the public domain.

Javier Ruiz, policy director of the ORG said: “If search engines are forced to remove links to legitimate content that is already in the public domain but not the content itself, it could lead to online censorship.”

“This case has major implications for all kind of internet intermediaries, not just search engines,” he said.

The organisation also expressed concern that the ruling goes against the opinion given by the European advocate general Niilo Jääskinen in June, who said search engines were not responsible for personal data appearing on third party sites.

Anderw Rose, principal analyst in security and risk at Forrester, told PC Pro: “Its somewhat unfair to lay the blame and workload entirely with the search engine providers. They are the conduit to the data repositories, and may cache the data, but they are rarely the originator.”

“The EU law needs to focus on removing the original data and then overlaying the search engine’s responsibilities to clear caches. To use an analogy, at the moment, this looks like making the airline responsible for customs and duty, and that’s not how it should work,” he added.

Nevertheless, European justice commissioner Viviane Reding took to Facebook following the most recent ruling to declare “a clear victory for the protection of personal data of Europeans”.