Protection of personal data in a digital world

This decision was rendered on the basis of the Charter of Fundamental Rights of the EU, which provides that “Everyone has the right to respect for his or her private and family life, home and communications” (Article 7) and “Everyone has the right to the protection of personal data concerning him or her” (Article 8).

It enshrines the principle of a ‘right to be forgotten’. The context was a complaint filed by a Spanish national before the Spanish Data Protection Agency (SDPA), against Google Inc and Google Spain, to obtain the removal of personal data from his index, and prevent access to it in the future. This Spanish national requested inter alia that his data should no longer appear in the search results of a large-circulation Spanish newspaper, in which his name was related to a real estate auction held following proceedings performed for the recovery of debts dating back to 1998. The SDPA dismissed the complaint, considering that the newspaper had legally published the data.

However, the SDPA asked Google companies to take all measures to remove such data and make it inaccessible in the future in the search engine. Google then appealed to the Spanish court, which itself applied to the CJEU for a preliminary ruling.

"Faced with the potential gravity that such interference may pose, the operator must remove such data if it has become inadequate or obsolete over time."

Before the CJEU, Google Inc and its subsidiary argued that, pursuant to EU Directive 95/46/EC of October 24, 1995 on the protection of individuals with regards to the processing of personal data and on the free movement of such data (JO No L 281, 23/11/1995), the activity performed by search engines is not “processing” of the data appearing on the third parties’ web pages that are in the list of search results, but only a processing of accessible information on the internet, with no distinction between mere information and personal data and, as an operator of a search engine, it could not be held responsible for data that a priori it did not know and could not control.

On this point the CJEU replied that the search engine activity of finding information published by third parties, indexing them automatically, storing them temporarily and disseminating them in an order of preference, is to be qualified as the processing of personal data.

The question then was whether Google Inc, the search engine operator, could be held responsible for this data processing. The CJEU indicated in this respect that under Article 2(d) of the directive, “the natural or legal person [...] which alone or jointly with others determines the purposes and means of the processing of personal data” must be held responsible for data processing. According to the CJEU, in this case, the activities of the parent company domiciled outside the EU and those of its subsidiary in Spain are inextricably linked. According to the court, Google Inc cannot avoid the directive’s obligations and guarantees, and must be held responsible.

Finally, the CJEU held that links to web pages published by third parties that contain information on a person, appearing in the results of searches conducted on the name of that person, and which in the absence of any search engine could not be interconnected, are an interference with his private life that cannot be justified by the economic interests of the search engine operator.

Faced with the potential gravity that such interference may pose, the operator must remove such data if it has become inadequate or obsolete over time (except in special cases in view of the nature of the information in question, or the interest of users to have this information, especially in view of the role played by the person in public life).

In another case, the CJEU invalidated Directive 2006/24 (concerning data generated or processed during the provision of public electronic communications services or public communications networks) for violation of the rule of proportionality. In a judgment of April 8, 2014 (joined Cases C-293/12 and C-594/12), the CJEU held that the text of Directive 2006/24 exceeded what is necessary to achieve its objectives, due to inaccuracies, lack of limits and lack of protection imposed by the text. A new text will have to be adopted promptly.

Aurélia Marie is a partner at Cabinet Beau de Lomenie. She can be contacted at: amarie@bdl-ip.com