• European Union High Court Ruling Establishes Right to Be Forgotten, Requires Google to Delete User Data on Request
  • May 26, 2014 | Authors: Nathan S. Cardon; Tracy P. Marshall; Sheila A. Millar; Jean-Cyril Walker
  • Law Firm: Keller and Heckman LLP - Washington Office
  • Google Inc. must delete the personal data that turns up in its search results under certain circumstances if a user asks for the data to be deleted, the European Court of Justice (ECJ) ruled on Tuesday, May 13. The decision by the ECJ - the highest court in Europe - is the first to address a subject that has been hotly debated in connection with the proposed European Union (EU) Privacy Regulation: the “right to be forgotten.” For businesses, the ruling will greatly complicate maintaining an online presence that involves publishing data about an EU citizen online, and raises new jurisdictional questions on the reach of European data protection laws.

    The case arose after a Spanish lawyer’s search for his name using Google’s search engine turned up legal notices related to his debts and the forced sale of his property that were published in an online Spanish newspaper. The Spanish Data Protection Agency ruled against Google but did not require the newspaper to remove the data. Google appealed to the ECJ. The ECJ’s decision is contrary to a June 2013 opinion of the Advocate General that Google need not remove the links.

    This ruling is based on the EU’s 1995 Data Protection Directive (Directive 95/46/EC), which provides “data subjects” certain legal rights, including the right to access collected information and correct inaccuracies. The ECJ found that if a search engine’s inclusion of links to personal data in its search results contravenes the purposes of the Directive, the links and information in the results lists must be erased, even if initially including the links and associated information in search results was acceptable. In other words, given sufficient passage of time, initially-lawful processing of data may become incompatible with the Directive where the purposes behind providing the data diminish relative to the data subject’s interest in having the data erased or blocked. The ruling would permit links to such data to remain online, however, where there are particular public interest reasons justifying the public’s continued access to the information, such as the data subject’s role in public life.

    In the meantime, the proposed EU Regulation on Privacy, which the European Commission proposed in 2012, is expected to move forward, but passage seems unlikely before 2015, and it would not take effect for another two years. Other countries have adopted the EU’s approaches to privacy in various forms, which could result in similar requirements applying more broadly. Companies that maintain an online presence, and in particular provide information about the general public, must keep abreast of the EU and other countries’ decisions about the existence of a right to be forgotten, and consider the balance between rights to information and privacy rights in a global environment.