After striking down the data retention directive, the CJEU yet again took a strong stand in favor of privacy. Interestingly, only twice in the entire judgment did the Court refer to freedom of expression.

Search engines enable us to seek, receive and impart information. They render online content accessible and useful. This is why limiting the reach of search engines and demanding the withdrawal of some links from search results should be done with caution. The important role of search engines has been recognized in 2012 by the Council of Europe Committee of Ministers, who considered it essential that search engines be allowed to freely crawl and index the information that is openly available on the Web and intended for mass outreach (see: Recommendation CM/Rec(2012)3 of the Committee of Ministers to member States on the protection of human rights with regard to search engines, adopted on April 4, 2012).

At the same time, search engines can retrieve and group widespread information of various types about a single person. These capabilities may significantly affect individuals, both in their personal lives and within society. In the recommendations mentioned above, the Committee of Ministers recognized the necessity to differentiate between various types of content. According to the Committee, there is a need to review search ranking and indexing of content that is not intended for mass communication or mass communication in aggregate. For example, the Committee proposed listing content sufficiently low in search results in order to strike a balance between the accessibility of the content in question and the intentions of its producer. The Committee recommended states “enhance transparency in the collection of personal data and the legitimate purposes for which they are being processed,” in order to “enable users to access easily, and, where appropriate, to correct or delete their personal data processed by search engine providers” and “develop tools to minimize the collection and processing of personal data, including enforcing limited retention periods, adequate irreversible anonymization, as well as tools for the deletion of data.” Today’s judgment of the CJEU is in line with the Committee’s concerns, and seems to take an even stricter approach regarding the obligations of operators of search engines.

The case of Google Spain and Google (C-131/12) originated from a complaint of a private person, a Spanish citizen, who demanded from Google the removal of a number of references from search results. The Spanish Data Protection Agency supported this request, but at the same time stated that the information available on the online page of the local newspaper, where it originally appeared, could stay there because of its lawful character. Spain’s highest court had doubts whether the decision about the removal of the data from search indexes was correct and referred it to the CJEU for a preliminary ruling. The national court asked, among other things, whether the complainant should be allowed to request from Google the de-indexing of information that refers to him personally.

The CJEU ruled today that, indeed, it is possible to demand from operators of search engines the removal of links from search results. This is possible even if the content linked to is lawful and its original source remains untouched – the Court clearly distinguished between the right to publish information and to display it in the search result. It underscored that these activities have a different level of impact on the individual and their right to privacy. Referring to Article 7 of the charter that guarantees the right to respect for private life and Article 8, which proclaims the right to the protection of personal data, and relying on the provisions of the Data Protection Directive, the Court decided that it is possible to order the operator of the search engine to remove links that are displayed in search results and that redirect to web pages published by third parties containing information relating to a person. The Court held that“given the ease with which information published on a website can be replicated on other sites and the fact that the persons responsible for its publication are not always subject to European Union legislation, effective and complete protection of data users could not be achieved if the latter had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites.”

Moreover, according to the Court individual rights override not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. At the same time, the Court acknowledged that there might be exceptions to that general approach.

While the Advocate General downplayed the role of search engines, claiming that is was passive, the CJEU underscored that search engines are a key actor in the overall dissemination of data and that they render it accessible to internet users who otherwise would not find it. Thanks to search engines, users can obtain a “structured overview” of information relating to individuals and establish their profiles and that “the activity of a search engine is (…) liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data.” According to the Court, activities of search engines not only constitute an independent processing of personal data, but operators of search engines are also data controllers and have all the obligations that follow from that fact.