AmCham Slovakia

Background
If an Internet user in 2009 searched on Google for the name “Costeja González”, results of the search would have included links to the web pages of La Vanguardia (a Spanish daily newspaper). The links contained reports of a real estate auction from 1998 which had been organized in order to recover social security debts owed by Mr. González. It was Mr González’s opinion that the links to La Vanguardia´s report containing his personal data was no longer relevant because he had paid off his debts. He therefore asked Google to delete the links which appeared on search results and La Vanguardia to delete the announcement from its website. After they refused to do so, Mr González turned to The Spanish Data Protection Agency (AEPD).

The AEPD ordered Google Spain and Google Inc. to remove the links to the article in La Vanguardia. It, however, rejected the request to delete his personal data from La Vanguardia ´s web page. This was because it had been published lawfully in the newspaper. Google Spain and Google Inc. brought two actions before the National High Court to have the decision of the AEPD annulled. The case was escalated to the CJEU. The most controversial question was whether individuals can require search engines to remove links to web pages which contain their personal data.

Privacy is more important than freedom of speech
First of all, it should be noted that the judgment of the CJEU is in stark contrast to the opinion of the Advocate General. He said that the right to be forgotten results in censorship and that as a consequence individuals should not have such a right. The CJEU disagreed and laid down the foundation of the right to be forgotten by the Internet search engines. It performed a balancing exercise (“public interest test”) in which it weighed various conflicting rights, in particular: the right to privacy on the one hand, and freedom of speech, access to information and Google´s business interests on the other.

The CJEU ruled that potentially serious breaches of privacy shall prevail in importance over Google´s business interests and the wider public interest in being able to access data through the search engine. At the same time, the CJEU acknowledged that deleting search results containing personal information may be burdensome for Google.

Google is forced to become a “data protection judge”
Since May 13, 2014, individuals can ask Google for the removal of any links to third party web pages that contain their personal data if the data is: (i) inadequate, (ii) irrelevant, (iii) no longer up to date, (iv) excessive in relation to the purposes and (v) excessive in the light of the time that has elapsed. Google will therefore need to evaluate thousands of requests and determine whether proposed links shall be deleted or not. The decisions will be taken by humans (not by algorithms) who will (as part of endless arguments with the concerned individuals) have to weigh the right to privacy on one hand and freedom of speech on the other. It will undoubtedly be difficult to determine exactly what information is inadequate, irrelevant or how much time must elapse before information about persons becomes irrelevant. Borderline requests will likely result in complaints to data protection authorities or lengthy litigation.

A database full of embarrassing facts
In reality, the right to be forgotten will mutate into a “right not to be embarrassed” as it is highly likely that people will ask Google to remove predominantly (if not exclusively) embarrassing personal data. As a consequence, it may be expected that Google will shortly possess the biggest database of embarrassing facts and sensitive data in the world. Access to such database will undoubtedly attract the attention of hackers. The question of who should cover the costs of the security measures in relation to this huge database  was not answered by the CJEU.

Mr. González will be remembered forever Ironically the very man, Mr González, who sought to conceal his social security debts from the whole world and who is directly responsible for EU citizens now being able to enjoy the right to be forgotten, will himself never be forgotten. Information about him and his past financial problems will forever be recorded in the CJEU´s decision. Is it too absurd to wonder whether one day he will ask Google to remove the link to the CJEU´s judgment?

The newly-created right leads to many absurdities. One of them is that even though the links are deleted, the data itself is not; it stays on the original website. Another is the fact that the very personal data thus concealed from EU Internet users will still be visible to any users searching on Google from outside the EU. 

 1  C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González

Zuzana Hečko, Associate (Head of IP), Allen & Overy Bratislava