The right to be forgotten

The right to be forgotten

1. People most often check a person’s name in a search engine: before a job interview, a deal or a first meeting. The search shows everything ever published about them, including old unpleasant stories that are long over. In 2014 the Court of Justice of the European Union decided whether a person can demand that such a link be removed from the results. The case shows what exactly can be removed and whom to ask.

2. The case began in Spain. On January 19 and March 9, 1998 the newspaper La Vanguardia, widely read in Catalonia, printed an announcement of a real-estate auction connected with the recovery of social security debts. The announcement named Mario Costeja González. The newspaper printed it on the order of the Ministry of Labour and Social Affairs, to attract as many bidders as possible. Later the newspaper’s pages went into its online archive.

3. Twelve years later a Google search for Costeja González’s name still showed those two pages, although the debt proceedings, he said, had long been closed. On March 5, 2010 he lodged a complaint with the Spanish Data Protection Agency, AEPD, against the newspaper and against Google. The agency rejected the complaint against the newspaper, because the announcement had been published lawfully. Google, however, it ordered to remove the data from its search results, and the company challenged that decision in court.

4. The Spanish court stayed the proceedings and on February 27, 2012 asked the Court of Justice of the European Union to interpret the EU directive on the protection of personal data. The directive was adopted in 1995, and search engines in their present form appeared later. There were two main questions: is a search engine responsible for personal data on other people’s pages that it merely finds, and must it remove a link at a person’s request.

5. The answer was not obvious. Google argued that its search treats all pages alike, does not single out personal data among them and does not control it, so a request should go to the publisher, who put the information online and can most easily remove it. Costeja González and the Spanish and Italian governments replied that the harm comes precisely from spreading it through search. The Advocate General, who prepares an opinion for the Court in the case, proposed answering that the directive gives no right to be forgotten.

6. On May 13, 2014 the Grand Chamber of the Court decided otherwise. A search engine collects data, organizes it, stores it and shows it to users, and that is processing of personal data. Its operator determines the purposes and means of that processing, so it is the controller, the one responsible for the processing. So where the conditions are met, it must remove from the results of a search by a person’s name the links to pages about that person, even when the page is lawful and stays online.

7. The Court explained this by the effect of search on private life. A search by name gives a structured overview of everything about a person online, and it adds up to a detailed profile of them; without the search engine that information would be hard to put together. So appearing in the results can interfere with privacy more seriously than the publication itself. Besides, true and lawfully published data can become irrelevant over time: by then the announcement was sixteen years old.

8. One objection remained: that European rules do not apply to an American company. The search engine is run by Google Inc. from the United States, while the Spanish Google Spain only sells advertising in it. The Court answered that the two activities are inextricably linked: advertising makes the search engine profitable, and the search engine provides the space for the advertising. So the data is processed in the context of the activities of the Spanish subsidiary, and European law applies.

9. Later the rule was written into law. Since May 25, 2018 the European Union has applied the General Data Protection Regulation, GDPR, and its Article 17 is titled “Right to erasure (‘right to be forgotten’)”. And on September 24, 2019, in Google v CNIL, a case against the French regulator, the Court settled the territory: the operator removes links in the versions of its search engine for all EU member states, but EU law does not require doing it worldwide.

10. The case is often retold as if a person could erase information about themselves from the internet. Yet the newspaper page stayed online: the agency rejected the complaint against the newspaper, and the Court did not consider it. The judgment concerns only links in the results of a search by the person’s name. And the right is not absolute: privacy is weighed against the public’s interest in knowing, so links about a person who plays a role in public life may stay.

11. Responsibility for personal data lies not only with whoever published it but also with whoever makes it easy to find: that is the main legacy of the case. In EU countries a person can send a request to the search engine operator and, if refused, turn to a data protection authority or a court. Expect a weighing, not automatic consent: the more public the person and the more recent the event, the lower the chances.