This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.
Google's only public response to the judgment so far is to say that it is "disappointed" by the decision.
It is reported that it is already being deluged with requests from individuals to bar access to personal information.
In order to accede to these requests, Google faces two formidable hurdles. Firstly, it needs to establish an administrative procedure for receiving, filtering and dealing with requests. This may involve a degree of evaluation to determine what information it will continue to be permissible, an enormous quasi-judicial task.
Secondly, it may need to develop sophisticated technical means to block personal information. This could be tricky. The judgment does not require blocking of any particular websites, merely websites relating to an individual which are responsive to a search relating to that individual. So if there is an article regarding X's crashing his car, Google are not permitted to allow searches returning the article based on entering X's name, but there appears no reason why the article could not be returned if their indexing and the user's the search relates to the make of the car in question. Developing the means that determines automatically whether a search term relates to an individual or is impersonal is far from straight-forward.
Moreover, Google's problems go further than this because the unlawfulness of their processing of personal data may not be dependent on them first receiving a complaint or a request from the individual in question that they stop. Every act of processing may already in itself be potentially unlawful. If so, Google is amassing an enormous potential liability every hour.
Google would appear to have four options.
Firstly, they could simply ignore the decision and carry on processing personal information regardless, as they always have. The difficulty is not just that they are potentially leaving themselves open to a very great deal of costly litigation but also the data protection regulators are likely to take an increasingly aggressive line with the company with possibly substantial fines for non-compliance. If they were to carry on, they may wish to withdraw their physical presence from Europe, closing down their many European subsidiaries, to seek to escape the effect of these new requirements. But the impact of such a withdrawal on their business would surely be dramatic. Could they really continue to sell the advertising which sustains their service in Europe without a physical presence here?
Secondly, they could seek to comply with the judgment and stop processing personal information as the judgment requires. The difficulty here is not only the administrative and technical challenges identified above but also the commercial consequences. Searches on individuals may not be necessarily the most lucrative in terms of selling advertising (not for example compared to searches for the latest high-tech gadgetry) but such searches must do a lot in terms of bringing users to the site.
Thirdly, they could seek to challenge the decision legally. The difficulty is that the Grand Chamber of the CJEU is the highest court in Europe, there is no appeal. Google might seek to bring further cases to the Court in the hope that the apparent effect of this judgment could be diluted by future clarifying decisions. However, to do so, they would first need a reference from a court in a member state and that would require convincing such a court that there was an outstanding uncertainty.
Given the terms of the judgment, courts may consider the position in respect of search engine liability is pretty clear. Moreover, there is no guarantee that a future decision of the CJEU may be any more favourable to Google than this one
Finally, they could seek legislative change. As stated below, a new Data Protection Regulation has been in a long state of discussion and development. However, the possibility that this might assist
Google seems unlikely. The only question for legislators is the extent to which they can increase the protection of personal data. The chances of them reducing this protection and rowing back against the decision of the CJEU seem remote.
So there appear to be no good options for Google. It seems likely that at least in the medium term, it will have to accept that there is no alternative but to prepare itself for a vast influx of data removal requests.
