In 2012, a bevy of internet companies and web sites waged a successful campaign against bills in Congress -- the PROTECT IP Act and Stop Online Piracy Act (SOPA) -- meant to combat copyright privacy. In the face of this opposition, the proposals were dropped (although their legacy survives). One of the major claims by the opponents was that the bills would "break the Internet" by requiring the disabling of URLs and removal of online links to sites that include unauthorized uses of copyrighted materials (although not all agreed with this assessment).
Now, the European Court of Justice has issued a decision (summary) that could require search engines to remove links to online information about individuals that is "no longer necessary in the light of the purposes for which they were collected or processed." The court's decision does not discuss how the removal of these links should be accomplished.
The court's decision stemmed from a case brought by Spanish citizen Mario Costeja González, seeking removal from a newspaper's web site images of pages from January and March 1998 that included announcements for a real estate auction stemming from attachment proceedings for the recovery of social security debts owed by Costeja González. He complained to Spain's Agencia Española de Protección de Datos (Spanish Data Protection Agency; AEPD) (Spanish site; English resources), seeking removal of the information from the paper's website and from Google's search results.
AEPD held that the newspaper need not remove the material, since it published it under a legal directive. But it upheld the complaint against Google, saying that Costeja González had the right to shield the information from public view via the search engine. Google appealed to Spain's Audiencia Nacional (National High Court). That court sought an advisory opinion from the European Court of Justice -- the highest court in the European Union -- regarding the applicability of EU privacy laws to the case.
European law embodies a concept of privacy that is in many ways alien to American law, and would be unconstitutional under our First Amendment. This includes a right to bar or recover for publication of true but "private" information that is readily available publicly, and a right to shield dated information, often referred to as a "right to be forgotten."
The question before the court was whether the EU directive embodying these notions (Directive 95/46) applied to Google. This, in turn, depended on whether Google could be considered a content provider. The court held that it was, even though the information that Google collects and displays in its search results is already published online by someone else. Since Google is a content provider, the court held, it is obliged to follow the privacy directive.
Inasmuch as the activity of a search engine is therefore liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.Google Spain SL v. Agencia Española de Protección de Datos (AEPD), Case C‑131/12 (E.C.R. May 13, 2014), para. 38.
The court also ruled that Google was subject to Spain's jurisdiction, including its law applying Directive 95/46, because of Google's web site directed at the country (www.google.es). The court rejected Google's argument that it was Google, Inc., in the United States that performed the indexing and search functions at issue, rather than the Spanish subsidiary: "Since that display of results is accompanied, on the same page, by the display of advertising linked to the search terms, it is clear that the processing of personal data in question is carried out in the context of the commercial and advertising activity of the controller’s establishment on the territory of a Member State, in this instance Spanish territory." Id., para. 57.
After finding that the directive applies to Google, the court held that the search engine could be ordered to remove links to the objectionable material from search results for Costeja González's name.
[I]n order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.Id., para. 88.
The irony -- expressed in the last sentence above -- is that the court also observed that the newspaper that posted the notices of the auctions in the first place could not be required to remove those postings because they were published "solely for journalistic purposes," which is included within "the right to receive and impart information" guaranteed in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, and referenced in the directive.
The court justified the different treatment of the newspaper and Google by staing that "first, the legitimate interests justifying the processing may be different [for the newspaper and the search engine] and, second, the consequences of the processing for the data subject, and in particular for his private life, are not necessarily the same." Id., para. 86.
Indeed, since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.Id., para. 87 (emphasis added).
The court acknowledges that these "rights override ..., not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name. " Id., para. 97. The court adds that this may not be true in the case of a promient person in public life, which may mean that the public interest in disclosure would outweigh that person's right to privacy.
But since Costeja González is not a public person, he may request removal of the articles from Google's search results even though he cannot request removal of the same articles from the newspaper's website. Again, this would not be the case under United States law, regardless of the plaintiff's status as a private or public figure. In the U.S., privacy law generally does not provide a remedy for the dissemination of true information that is already publicly available; moreover, the compelled removal of such information would raise serious issues under the First Amendment as prior restraints on speech.
The case now returns to the Spanish Audiencia Nacional for a specific decision in Costeja González's case, which can be appealed to Spain's Supreme Court. But the EU court's decision is binding on member states of the European Union, and could lead to more efforts by Europeans to have embarrassing or other material removed from web search results, even when the original site containing the material has no obligation to remove it.
Google has stated that it is "analys[ing] the implications" of the ECJ ruling, but requiring the modification of search results in response to what will likely be a flood of complaints from residents of EU countries puts Google in the difficult (if not impossible) position of either managing these complaints at significant cost or taking a blunderbuss approach to removal of content. And would such results persist outside the EU? Content filtering by country is not a new concept, but this ruling has the potential to create a dramatically different Internet in Europe.
There could also be a significant impact on the news organizations that, as the ECJ acknowledges, have the right to publish this information. The ECJ, in its ad hoc balancing of interests, seems blind to the fact that news organizations depend on search engines and other online intermediaries in order to reach their audiences. Allowing the subjects of news coverage to use these intermediaries as a choke point because the intermediaries are not themselves journalists threatens the primary benefit of the Internet -- namely, the networked dissemination of information.
Operating on the Internet has always posed challenges in complying with the laws of multiple countries. Search engines in particular have had problems in the past dealing with Great Britain's privacy laws, France's laws against Nazi memorabilia, and China's web restrictions. But this ruling by the European Court of Justice might just be the straw that breaks the camel's -- or the Internet's -- back.
