Antitrust Law Daily Wrap Up, PRIVACY NEWS: EU Article 29 Data Protection Working Party supports Court of Justice ruling on Internet search engines, (May 27, 2014)
Organizations Mentioned:Google Spain SL | Google, Inc.
By Linda O’Brien, J.D., LL.M.
The European Union (EU) data protection authorities comprising the Article 29 Working Party (WP29) on May 23 announced their support of a May 13 ruling by the European Court of Justice (ECJ), affirming an individual’s right to request the removal of information from Internet search results. According to the WP29, the ruling (Google Spain SL v. Agencia Espanola de Proteccion de Datos) sets a milestone for EU data protection and retains a wide interpretation of “establishment” for determining the applicability of the EU Directive 95/46/EC and national law to search engines. It also clarifies the concepts of “data processing” and “controller” with respect to the processing of personal data by search engines.
In the case, an individual filed a complaint with the Agenica Espanola de Proteccion de Datos against Google and the publisher of a daily newspaper. The individual contended that, when an Internet user entered his name in the search engine, the list of results displayed links to out-of-date information from the newspaper. The ECJ was requested to rule on the search engine’s legal qualification regarding the processing of personal data through its search engine service, the applicability of Directive 95/46/EC, and the data subject’s right to obtain the deletion of the links in the search results to information infringing his rights to data protection.
In its judgment, the ECJ ruled that search engine providers are data controllers with respect to the processing of personal data carried out by the search engine, since their activity is to automatically index information published online and to provide such information to web users according to a particular order of preference. This specific activity comes in addition to that of web publishers and search engines providers could therefore be liable for affecting data subjects’ rights.
The ECJ also confirmed the applicability of Directive 95/46/EC to the Google search engine insofar as the processing of personal data is carried out in the context of the activities of a subsidiary on the territory of a Member State, set up to promote and sell advertising space on its search engine in the Member State with the aim of making that service profitable.
On that basis, the ECJ concluded that the data subjects have the right to directly request from the search engine provider the deletion of the links to web pages containing information breaching their rights under the Directive, even if the publication of the information on the web pages in question is lawful in itself.
The ECJ indicated that the rights to privacy and to the protection of personal data contained in the EU Charter of Fundamental Rights, although they override the search engine’s economic interest, are not absolute, and that the right to delete information will have to be determined on a case-by-case basis, depending on the nature of the information in question, on its sensitivity for the data subject, and on the interest of the public to have access to that information, considering in particular the role played by the data subject in public life.
A first exchange of views between the EU data protection authorities will take place at the WP29 plenary meeting of June 3-4, 2014 in order to analyze the consequences of the ECJ’s ruling and to identify guidelines in order to build a common approach of EU data protection authorities on the implementation of the ruling.
The Article 29 Working Party on the protection of individuals with respect to the processing of personal data is an independent advisory body on data protection and privacy. The body is composed of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor, and the European Commission. The Article 29 Working Party can examine any question covering the application of the data protection directives in order to contribute to the uniform application of the directives and carries out its task by issuing recommendations, opinions and working documents.
Companies: Google Spain SL; Google, Inc.
News: IndustryNewsTrends Privacy