Feeds

Google CAN be told to delete sensitive data from its search results, rules top EU court

Judgment: Ad giant 'controls' and 'processes' our stuff

Providing a secure and efficient Helpdesk

Google and other search engines can be held responsible for the type of personal data that appears on results pages it serves up, the European Union's Court of Justice ruled in a landmark case this morning.

Its decision (PDF) is a rare example of the CoJ disagreeing with an earlier advocate general opinion from June last year, when top judge Niilo Jääskinen said that Google was not obliged to remove sensitive legal content from its search index.

His opinion came after a man complained to Google's Spanish office in 2010 about search results that showed a link to a newspaper article which was first printed in 1998, reporting on a real-estate auction connected with attachment proceedings prompted by social security debts.

In its ruling today, the Luxembourg court - which is presided over by 28 judges, each representing one of the EU member states - cited the 1995 Data Protection Directive. It said:

In today's judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine "collects" data within the meaning of the directive.

The Court considers, furthermore, that the operator, within the framework of its indexing programmes, "retrieves", "records" and "organises" the data in question, which it then "stores" on its servers and, as the case may be, "discloses" and "makes available" to its users in the form of lists of results.

Those operations which are referred to expressly and unconditionally in the directive, must be classified as "processing", regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.

The CoJ added that the likes of Google could be considered the "controller" in the context of the aged Directive, which has undergone a draft rewrite and has MEP support but won't be subjected to a legislative overhaul this side of the European Parliament elections. Besides that, it is yet to be scrutinised by the Council of Ministers, which could yet stall progress of the bill indefinitely.

Interestingly, the EU's top judges seem to have found wiggle room within the current rules to demonstrate that people living in the 28-member-state bloc have the right to be forgotten online.

The court said that Google was wrong to argue that processing of personal data on its search engine was not carried out by its Spanish subsidiary, in specific relation to the 2010 case. It said:

The court holds, in this regard, that where such data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member state, has an establishment in a member state, the processing carried out "in the context of the activities" of that establishment, within the meaning of the directive, if the establishment is intended to promote and sell, in the member state in question, advertising space offered by the search engine in order to make the service offered by the engine profitable.

In short, Google and other search engine operators are obliged - in some circumstances - to kill links to web pages that are published by third parties.

Individuals can approach Google and ask it to delete such links from its search engine. If it refuses, the complainant can take their gripe to a national data watchdog, the court ruled.

“This is a disappointing ruling for search engines and online publishers in general," a Google spokesperson told The Register. "We are very surprised that it differs so dramatically from the Advocate General’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."

Google has long argued that such erasure of data amounted to censorship. But cynics may note it could also hit the company's bottom line. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.