Already on 14 May 2013, at the request of a subsidiary of a Luxembourg group, Germany’s highest civil court, the Bundesgerichtshof, ordered Google to erase certain false and defamatory events from the list of results appearing after a search was made on the name of that corporate group’s president.
Now, decision No. C-131/12 of 13 May 2014, in Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, the Court of Justice of the European Union (“CJEU”) has upheld and added specifics to that solution.
In the latter decision, the CJEU confirms that a search engine operator was the controller for the processing of personal data on its web pages, and that the right to digital erasure should thus apply to internauts who request such erasure.
In the decision, the CJEU confirmed that by “collecting”, “organising” and “saving” personal data on servers, the operator of a search engine “processes” personal data as defined by Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the “Directive”), and that because a search engine operator determines the purposes and means of processing, it becomes the “controller” of that data.
Concerning the territorial scope of the Directive, the CJEU subjects companies established in third countries to the Directive provided that they have an “establishment” in an EU Member State. The CJEU does not refer solely to the place of the data processing establishment, but also to any form of establishment, including as in this case, an establishment in a Member State that permits the promotion and sale of advertising space on search engines.
When these substantive requirements are met, the Court requires the search engine operator, under certain conditions, to erase from the list of results appearing after a search is made using the name of a person, the links to web pages published by third parties containing information on that person.
The Court specifies that the right of erasure is not absolute and that a “fair balance” should be sought between the rights of the person to manage his personal data and the right to privacy, on the one hand, and the public’s interest in accessing information, on the other hand, including that on public figures and the bad reputation of an establishment. To benefit from this right of erasure, the Court uses as criteria published data qualified as “inadequate, irrelevant, or no longer relevant, or excessive”, depending on ”the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life”.
On 28 May 2014, Google put on line a form allowing the request for deletion of search results from the search engine concerned. Processed data will only be deleted on the express and reasoned request of the person concerned. Google thus specified that the treatment of such requests will be effectuated by an investigation carried out by a natural person, and reserved to itself the right to examine the well-foundedness of the request.
In case of dispute, Luxembourg’s regulatory authority, the National Commission for the Protection of Data (Commission Nationale pour la Protection des Données, or CNPD), or a national judge in case of litigation, will adjudicate on the well-foundedness of the request.
The decision rendered in this case will facilitate the protection of the virtual image of natural persons, the personal data of which are protected in Luxembourg. That being said, the decision does not clearly examine the issue of natural persons, although the legislation of certain EU Member States characterizes as personal data those of both natural and legal persons.
Our clients should thus be aware of how their virtual image is treated and, if necessary, file a request with Google or any other search engine concerning any false/misleading data they wish to have deleted.