Feeds

Google CAN be told to delete sensitive data from its search results, rules top EU court

Judgment: Ad giant 'controls' and 'processes' our stuff

The essential guide to IT transformation

Google and other search engines can be held responsible for the type of personal data that appears on results pages it serves up, the European Union's Court of Justice ruled in a landmark case this morning.

Its decision (PDF) is a rare example of the CoJ disagreeing with an earlier advocate general opinion from June last year, when top judge Niilo Jääskinen said that Google was not obliged to remove sensitive legal content from its search index.

His opinion came after a man complained to Google's Spanish office in 2010 about search results that showed a link to a newspaper article which was first printed in 1998, reporting on a real-estate auction connected with attachment proceedings prompted by social security debts.

In its ruling today, the Luxembourg court - which is presided over by 28 judges, each representing one of the EU member states - cited the 1995 Data Protection Directive. It said:

In today's judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine "collects" data within the meaning of the directive.

The Court considers, furthermore, that the operator, within the framework of its indexing programmes, "retrieves", "records" and "organises" the data in question, which it then "stores" on its servers and, as the case may be, "discloses" and "makes available" to its users in the form of lists of results.

Those operations which are referred to expressly and unconditionally in the directive, must be classified as "processing", regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.

The CoJ added that the likes of Google could be considered the "controller" in the context of the aged Directive, which has undergone a draft rewrite and has MEP support but won't be subjected to a legislative overhaul this side of the European Parliament elections. Besides that, it is yet to be scrutinised by the Council of Ministers, which could yet stall progress of the bill indefinitely.

Interestingly, the EU's top judges seem to have found wiggle room within the current rules to demonstrate that people living in the 28-member-state bloc have the right to be forgotten online.

The court said that Google was wrong to argue that processing of personal data on its search engine was not carried out by its Spanish subsidiary, in specific relation to the 2010 case. It said:

The court holds, in this regard, that where such data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member state, has an establishment in a member state, the processing carried out "in the context of the activities" of that establishment, within the meaning of the directive, if the establishment is intended to promote and sell, in the member state in question, advertising space offered by the search engine in order to make the service offered by the engine profitable.

In short, Google and other search engine operators are obliged - in some circumstances - to kill links to web pages that are published by third parties.

Individuals can approach Google and ask it to delete such links from its search engine. If it refuses, the complainant can take their gripe to a national data watchdog, the court ruled.

“This is a disappointing ruling for search engines and online publishers in general," a Google spokesperson told The Register. "We are very surprised that it differs so dramatically from the Advocate General’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."

Google has long argued that such erasure of data amounted to censorship. But cynics may note it could also hit the company's bottom line. ®

The essential guide to IT transformation

More from The Register

next story
Britain's housing crisis: What are we going to do about it?
Rent control: Better than bombs at destroying housing
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
GCHQ protesters stick it to British spooks ... by drinking urine
Activists told NOT to snap pics of staff at the concrete doughnut
What do you mean, I have to POST a PHYSICAL CHEQUE to get my gun licence?
Stop bitching about firearms fees - we need computerisation
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.