Internet censorship or major progress in personal data protection?
This is an issue that lately has attracted much publicity in the media and legal profession and has sparked a heated debate between personal data protection advocates and supporters of the infinite freedom to post information on the Internet. It involves one of the most recent significant and far-reaching judgements of the European Court of Justice (hereinafter: the ECJ), in which the latter ruled inter alia that individuals shall be entitled to demand the deletion of certain data relating to these individuals that was gathered by the search engine of the technological giant Google.
The ECJ, in case C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD), Mario Costeja Gonzáles, during the preliminary ruling procedure decisively backed the personal data protection position. The ECJ took the stance that, in principal, the rights of individuals to privacy and personal data protection have priority over the economic interests of a search engine operator, and even over public interest as well. This, however, is not the case, only if it were proven later that an individual's role in public life justifies a more radical infringement on his/her fundamental rights.
In the first part, the ECJ touched on the territorial applicability of Directive 46/95/EC, which has been transposed into the Slovenian legislation via the Personal Data Protection Act, and by employing the "processing of personal data" term. It acknowledged that the operator of the web search engine (Google) is bound by the European legal system concerning personal data protection, whenever it holds a subsidiary or branch office engaged in the marketing and sales of advertising space in a web search engine in any Member State. In the opinion of the ECJ, this activity can also be deemed personal data processing. As a result, the ECJ, with respect to the second question, affirmed that the operator of the web search engine which processes personal data in this manner, shall be deemed a "controller".
Ultimately, the ECJ discussed the scope of liability of the search engine operator. It ruled that the company which operates the web search engine shall be held accountable for the processing and display of personal data, despite these data being published by third parties and the company "merely" indexing data into lists of search results returned by a search engine.
Therefore, the operators of search engines must grant an individual's request to delete the data that are inappropriate or inadequate, or are inappropriate or excessive, (the so-called right to be forgotten) given the reasons for their processing or the time that has elapsed. This means that at the request of an individual, Google must delete all links to websites that are published by third parties and where information relating to such individual is found from the list of search results that are returned by the search engine when a name of an individual is entered in a search. This obligation applies even though the name or information is not simultaneously or previously deleted from third-party sites, if their publication is completely legal and even if such list of results causes no damage to an individual.
If the operator of the search engine rejects such request, the aggrieved party may contact the relevant national supervisory authority (e.g. in Slovenia the Information Commissioner) or initiate relevant court proceedings. Google has already responded to ECJ's judgement and stated that they will need several weeks to delete the obsolete information from their search engine.