EU Court Ruling Creates Compliance Woes for Website Operators

A recent ruling by Europe's highest court creates huge compliance difficulties for U.S. Internet companies with operations in Europe and advances the idea that consumers have a right to ask companies to delete data about them.

On May 13, the European Union Court of Justice ruled that Website operators must remove links to obsolete or irrelevant personal information from search engines upon request by European citizens, even if the information is accurate and lawful.

“Companies can no longer hide behind their servers being based in California, or anywhere else in the world,” Viviane Reding, the European commissioner for justice, wrote on her Facebook page. “No matter where the physical server of a company processing data is located, non-European companies when offering services to European consumers must apply European rules.”

Some privacy experts say search giants—such as Google and Microsoft's Bing that have large operations in Europe—won't be the only companies affected by the decision. “The ruling will have significant implications for search engines, social media operators, and businesses with operations in Europe generally,” says Karen Retzer, a partner with law firm Morrison & Foerster.

The controversial case, Google v. Gonzalez, was filed by Mario Costeja González, a resident of Spain, against Google and a daily newspaper publisher in Spain for their refusal to remove links to a 1998 announcement in the newspaper about his personal debts and the forced sale of his home.

The Spanish Data Protection Agency did not require the newspaper to take down the pages but did order Google to remove the data from its search results. Google appealed to the National High Court of Spain, which sought advice from the ECJ for a preliminary judgment.

In finding against Google, the court ruled that European citizens have a “right to be forgotten” when links to Web pages published by third parties include personal data that is not only false or unlawful—the current stance of many EU member states—but also where it appears to be “inadequate, no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.”  

The court further ruled that Website operators are data “controllers” with respect to their search engine activity, and have an obligation to remove personal data, even if the information is true and comes from public records.

In the Google case, the newspaper that originally published the information has no obligation to remove the data. Instead, the court is effectively “punishing Google for information that is lawfully on the Internet,” says Craig Newman, a partner in the law firm Richards Kibbe & Orbe.

According to the court, the only exception for when Website operators may retain links to personal data is in cases where the public interest in having access to such information outweighs the privacy rights of the individual—but what that actually means was not clearly delineated by the court.

“Companies can no longer hide behind their servers being based in California, or anywhere else in the world.”

—Viviane Reding,

European Commissioner

for Justice

The ruling provides no clear, bright-line rules for when to remove links, effectively saddling Website operators to make these challenging decisions themselves. “Companies operating search engines for users in the EU will have the difficult task of assessing each complaint they process and whether the rights of the individuals prevail over the rights of the public,” says Retzer.

“I don't know that these deletion requests could ever be automated, because they require judgment calls,” says Newman. “I can't even imagine the sort of manpower costs that this is going to create for technology companies.”

“Compliance Nightmare”

Lynn Percival, an associate in the privacy and information security practice group with law firm Poyner Spruill, says the ruling means that Website operators may need to consider hiring a large number of compliance personnel to individually evaluate potentially tens of thousands of requests from European citizens who want their personal information deleted. “For big search engine operators, it's potentially a compliance nightmare,” he says.

According to British national daily newspaper The Guardian, hundreds of individuals already have made claims across Europe since the release of the ruling. “The floodgates have already opened,” says Newman.

To cite just a few examples reported by The Guardian, a doctor has requested to have negative patient reviews removed about him; a pedophile wants information about his conviction wiped; and an ex-politician seeking re-election wants scandalous information previously reported about him scrubbed.

According to Percival, one important question search engine providers will now need to decide in response to the ruling is whether to censor search results on the front end, or whether to censor search results only after an individual makes a request, and a court orders them to do so. 

GOOGLE V. GONZALEZ

Following is a partial transcript from a press released published by the Court of Justice of the European Union, summarizing its preliminary judgment in the case Google v. Gonzalez.

In today's judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects' data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programs, ‘retrieves', ‘records' and ‘organizes' the data in question, which it then ‘stores' on its servers and, as the case may be, ‘discloses' and ‘makes available' to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the directive, must be classified as ‘processing,' regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect.

The Court further holds that the operator of the search engine is the ‘controller' in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing. The Court observes in this regard that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive's requirements. This is the only way that the guarantees laid down by the directive will be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.

Source: Court of Justice of the European Union.

Adding to the compliance challenges is that the ruling is now open to interpretation by each of the 28 EU member states, “so you also have the possibility of inconsistent decisions,” says Newman. “What might be deleted in one EU state might not be deleted in another EU state.”

Industry Reaction

The Computer and Communications Industry Association, an advocacy group that lobbies for free trade and open markets on behalf of Internet, information technology, and telecommunications companies expressed disappointment with the decision. James Waterworth, head of CCIA'S Brussels office, said in a statement that the ruling “opens the door to large-scale private censorship in Europe.”

“It may open the floodgates for tens of thousands of requests to have legal, publicly available information about Europeans taken out of a search index or links removed from Websites,” Waterworth added. “This will likely affect all companies providing links on the Internet.”

Microsoft, whose search engine Bing falls under the scope of the ruling, declined to comment. Yahoo says it is “carefully reviewing” the decision to assess its effect both on its business and for its users. “Since our founding almost twenty years ago, we've supported an open and free Internet, not one shaded by censorship,” says Suzanne Philion, a spokesperson for Yahoo. 

One interesting question to come from the ruling is how companies that host search engines on their Websites—such as those powered by Google—will be affected by the decision, says Percival. “We can't tell from the ruling itself,” he says. "Industry will need to keep a close eye on developments in this area."

The ECJ's preliminary ruling cannot be appealed. The Google case now goes back to the Spanish National High Court, which must decide on the facts of the case while taking into account the principles highlighted by the ECJ.