A European Union top court ruling that may require technology companies to delete personal information on request pits Europeans’ rights to privacy against the freedom to publish.
Google Inc. risks being ordered to remove search results where citizens’ fundamental rights are harmed by personal information posted online and where there is no public interest in publishing it, the EU Court of Justice said yesterday.
Granting citizens a so-called right to be forgotten could “open the floodgates for tens of thousands of requests to have legal, publicly available information about Europeans taken out of a search index or links removed from websites,” said James Waterworth, the head of the Brussels office of the Computer & Communications Industry Association.
Yesterday’s decision highlights Europe’s focus on privacy, even at the cost of sharing information online. Max Mosley, the former Formula One president, has won legal cases against Google and News Corp. for displaying information referring to a “Nazi-themed” sex party. Google was fined 1 million euros ($1.4 million) in Italy last month over privacy violations by its Street View cars, which photographed people across the country without their knowledge.
The EU court said in a statement it sought a balance between “the legitimate interest of Internet users potentially interested in having access to that information” and privacy rights.
While a person’s rights “override as a general rule” the “interest of Internet users,” such a balance may depend on the information, its sensitivity for the person and whether the person has a role in public life, the court said.
A person may ask search-engine owners to remove personal information and can ask a court or a data-protection authority to step in if the company refuses, the Luxembourg-based tribunal ruled. The court said Google both processes and controls personal data and must abide by EU law.
It’s the latest data-protection blow to Google, which faces privacy investigations around the world as it adds services and steps up competition with Facebook Inc. for users and advertisers.
The case also comes amid heightened trans-Atlantic tensions over data protection following revelations that U.S. spies snooped on EU citizens including German Chancellor Angela Merkel. The discovery led to a European backlash, including a clamor for even tougher privacy standards.
“As for Europe, they just seem to have a higher standard for personal privacy,” Danny Sullivan, founding editor of SearchEngineLand.com, said in an e-mailed statement. “There’s a real concern if this turns out to be abused, if done to prevent easy access to legitimate public records.”
While the ruling targets Google directly, its impact may be felt by the press, social media sites and any other business that publishes links to personal information online, said John Armstrong, a lawyer at CMS Cameron McKenna LLP in London.
“Any individual will be able to require any of the businesses affected to re-examine whether” they should continue to grant access or link to information elsewhere on the Internet, he said.
Google, whose headquarters are in Mountain View, California, said the decision was “disappointing” for search engines and online publishers, according to Al Verney, a spokesman for the company in Brussels. The operator of the world’s largest search engine now needs to analyze the implications, he said.
“When will a European Court demand that Wikipedia censor an article with truthful information because an individual doesn’t like it?” Jimmy Wales, the co-founder of Wikipedia, asked in a Twitter post.
Twitter Inc., Microsoft Corp. and Facebook representatives declined to comment.
A Spanish court sought advice from the EU’s top court for Google’s challenge to an order by the Spanish data-protection authority for it to remove information on a man whose house was auctioned off for failing to pay taxes, one of 200 instances where Spain has asked Google to pull content.
Newspaper La Vanguardia published the information in the case in 1998 and years later it could still be found through a Google search.
The ruling sets out a right to be forgotten that the European Commission proposed in 2012 as part of an overhaul of data-protection rules that may be finalized later this year. The decision is binding on courts across the 28-nation bloc.
The case should mark “a turning point for Google’s behavior,” said Jose Luis Rodriguez Alvarez, the head of Spain’s Data Protection Agency, in an e-mailed statement. Google has “consistently challenged” the Spanish authority which has had to deal with an increasing number of complaints over the company’s refusal to remove personal information, the agency said.
Mina Andreeva, a spokeswoman for the commission, said regulators welcomed the court’s finding that EU data-protection law applies to Google and other search engines operating in Europe.
The case is: C-131/12, Google Spain, S.L., Google Inc. v. Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez.