Legitimising the “right to be forgotten”

The European Court of Justice now has the opportunity to define the boundaries of the “right to be forgotten” by search engines, says José Antonio Perales Gallego

In January 2011, I presented an argument to the Spanish Audiencia Nacional (Federal Court) that the “right to be forgotten” protects a person’s ability to clear the Internet of all irrelevant information about them and to preserve their reputation – but it is not a new right.

In 1890, US Magistrate TS Louis Brandeis defined the right to privacy as “the right to be left alone” – the right to decide which parts of our lives are accessible to others, how and when such information can be used, and how we can control its spread. The need to define the boundaries of this right, in a Spanish and European Union (EU) context, or rather the demand to respond to a rising social desire, determines why we are here today.
A year after my presentation of the case, the Audiencia Nacional faces almost 200 cases concerning internet privacy and has referred a preliminary ruling on the “right to be forgotten” to the European Court of Justice (ECJ), through an interpretation of Article 267 of the TFEU (the Lisbon Treaty) regarding Google’s consistent publication of undesired information via its search engine. Mission accomplished.
As a legal representative of the Spanish Data Protection Agency (AEPD), I have had difficulty finding similar case-law in Spain or elsewhere. I did find judgements relating to individuals who, to protect their reputation in reference to information published in search engines, had requested its withdrawal or removal, but they usually involved a claim for financial compensation – not the case here.
In the proceedings in which I have defended the AEPD, there has never been a case involving an economic claim in favour of an individual; the goal has always been to resolve a particular legal issue not to seek economic redress. Yet in all these cases, the fact that injury existed was obvious.
Google has now filed an objection to the Federal Court’s referral in the form of a single defence: that there are no grounds for prosecution. But it also claims a decision against it may infringe its freedom of expression – the search engine’s results merely reflect the information available (and it will find expert evidence to substantiate). Google may go further and state that if a Spanish citizen wishes to exercise a right to oppose or cancel the inclusion of their personal information in the search engine’s findings, they can seek redress before the California Courts, but nothing can be achieved through legal proceedings in Spain.
This is a legitimate position by Google, but totally unacceptable. The protection of rights cannot depend on the willingness of the service provider to abide by them, nor where the provider is based.
The ECJ has an extraordinary opportunity to resolve this and other issues surrounding internet privacy, including the question of whether Directive 95/46/EC on Data Protection, in light of Article 8 of the European Convention on Human Rights, can apply in the Member State where the conflict originates, in this case in Spain, which would allow for the more effective protection of EU citizens’ rights.
Under Spanish Data Protection law, Article 2.1.c applies where the controller of personal data is not established in an EU territory, but the data processing is carried out through equipment on Spanish territory, unless used for transit purposes only. Similarly, Article 4.1.c of EU Directive 95/46/E states that national law applies when the data controller is not established in Community territory and, for the processing of personal data, equipment, automated or not, is located in the territory of that Member State, except where used only for the purposes of transit through EU territory.
The question is whether Google’s data processing terminals are situated within Spanish territory. If so, then the judicial precedent established would be far-reaching and provide an effective protection of EU citizen’s right to privacy that has so far been denied.
While it is hard to imagine that the individual who filed a claim through the AEPD requesting the deletion of Google links to their data, including their “right to be forgotten”, could have foreseen where their actions could lead, they may ultimately result in an entirely new understanding of the internet.

La sentencia preliminar interpuesta ante el Tribunal Europeo de Justicia, en relación a la legitimidad de los vínculos personales no deseados del buscador Google, define los limites relativos al “derecho de olvido” dentro del marco europeo, lo cual tiene implicaciones en cuanto a la privacidad en toda la red.

Click here to read the article in Spanish