Internet privacy and the right to be forgotten

As people get older and move on, so many are likely to demand that their earlier stories and errors are forgotten and insist on a right of privacy.

The law in this area has significantly advanced following a decision in May this year – Google Spain v Agencia Espanola de Proteccion de Detos (AEPD) and Gonzalez.

The Applicant, a Spanish citizen, noticed that searches against his name on Google had links to announcements in a Spanish newspaper from 1998, an electronic version of which had been made available online.

This concerned a real estate auction connected with attachment proceedings prompted by social security debts.  Mr Gonzalez was stated to be the owner.

As the attachment proceedings had been concluded and were no longer relevant, Mr Gonzalez asked the publisher to remove the article.  This was rejected on the basis that the publication was by a Ministry Order.

Mr Gonzalez also contacted Google Spain and asked that when his name was put in the search engine it should not show the offending links.  Mr Gonzalez lodged complaints about the publisher and Google with the AEPD.

In 2010, AEPD rejected the complaint against the publisher given the initial publication was a legal notice.  It upheld the complaint against Google, however, and this in turn led to the matter being referred to the European Court of Justice (ECJ).

In May 2014 the ECJ decided that:

• When personal information is put on the internet, then the locating, indexing, storing temporarily, and then making the information available to internet users, amounts to “processing data” under A2(b) of the Data Protection Directive.
• Google, in operating the search engine, was the “controller” of that data under A2(d) of the Directive.
• As Google’s Spanish subsidiary promoted advertising targeting the Spanish public, so this rendered Google Inc. subject to Spanish data protection laws.  The court rejected Google’s argument that as the search engine is operated and owned by its parent company, the data processing was not attributable to its Spanish subsidiary.
• Data will be unlawfully processed if it is “inadequate, irrelevant or excessive” for the purpose of processing; it is not kept up to date, or is kept longer than is required for historical, statistical or scientific purposes.

Fall-out
Coupled with the threat of a fine for non-compliance up to 1% of global turnover, the right of an individual to call for a data controller to rectify, erase or block certain information i.e. a “right to be forgotten”, has been a veritable bombshell to the industry.

Google in response apparently quickly produced an online application in which an individual can require the removal of links to searches conducted on their names, but how search engine and other online providers actually implement the new guiding principles, that are far from clear, is uncertain.

Further, the tracing and wiping clear of an individual’s data, which may be held on various servers with back-up copies, could potentially cost the online providers vast sums of money.

Many question whether this case has now wrongly tipped the scales of justice too far, such that the fundamental right to privacy now trumps the right of freedom of expression.

In particular, a recent House of Lords Committee has described the “right to be forgotten” as “misguided in principle and unworkable in practice” given global access to personal information has become part of the way of life.

This has resulted in proposals to limit the definition of data controller so as to exclude search engines and to delete the “right to be forgotten” from the proposed Data Protection Regulation.

Where the law now goes from here is unclear, but based on current EU thinking, not to weaken existing protection, so many commentators believe the right to be forgotten will not be discarded.

More likely, given the internet provides the means by which the majority of individuals and business now operate, plus the huge value the internet provides to economies in all EU countries, many expect to see that search engine providers will not in time be classed as ‘data controllers’.

In the meantime, the wider ramifications of the Google Spain case rumble on.  In Hegglin v Person (S) Unknown and Another (31 July 2014), the High Court ruled that a UK businessman, who previously lived in the UK but is currently resident in Hong Kong, may bring claims in England against Google to obtain injunctive relief for defamatory comments posted by anonymous individuals.

The court found that the Claimant had a claim under sections 10 and/or 14 of the Data Protection Act 1998 in principle and that there was a good arguable case for the grant of some sort of injunctive relief against the search engine.

The court held that as the Claimant had business interests, as well as a home within the UK, so the defamatory material damaged or risked damaging his reputation.

As a result, he was given leave to serve proceedings out of the jurisdiction as damages had been sustained within the jurisdiction or resulted from an act committed within the jurisdiction.

The High Court also found that, following the Gonzalez case, Google is under an obligation, enforceable in the UK, to comply with the requirements of the Data Protection Act, including the obligation to prevent the processing of personal data of the Claimant which is inaccurate and/or causes or likely to cause substantial damage or distress.

Tim Toomey
Partner, Commercial Litigation
27 August 2014