• The "Right to be Forgotten"
  • March 11, 2015
  • Law Firm: Lee Tsai Partners Attorneys-at-Law - Taipei Office
  • EU Ruling on the Right to be Forgotten
    The Court of Justice of the European Union ("CJEU") issued a ruling on May 13, 2014 confirming that EU's 1995 Data Protection Directive 94/46/EC ("Directive") provides a citizen of the EU a right to be forgotten.

    In 2010, Mr. Consteja Gonzalez filed a complaint with the Spanish Data Protection Agency seeking to compel La Vanguardia, a Spanish newspaper, to remove or alter announcements made by the paper in 1998 for a real-estate auction related to attachment proceedings for his social security debts. He also filed complaints against Google Spain and Google, Inc. to have this information removed from search results under his name. His requests for removal were based on his claim that the attachment proceedings had been fully resolved, and therefore the references were no longer relevant. Mr. Consteja Gonzalez stated that, accordingly, he had a "right to be forgotten" under the Directive. The case was referred to CJEU for the Court to determine the following: (1) whether the Directive applied to search engines, e.g., Google Inc.; (2) whether the Directive applies to a company that has its data processing server located outside of EU, e.g., Google Spain’s data processing server was located in the United States; and (3) whether an individual has the right to request that his/her personal data be removed from search engine results even where this information was lawfully published.
    The CJEU confirmed in its May 13, 2014 ruling that, as to the first question, the Directive applies to search engines such as Google Inc., "[t]he activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data' within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller' in respect of that processing, within the meaning of Article 2(d)."
    The CJEU further affirmed that the Directive applied to Google Spain even where the data processing server was in the United States, "it must be held that the processing of personal data for the purposes of the service of a search engine such as Google Search, which is operated by an undertaking that has its seat in a third State but has an establishment in a Member State, is carried out ‘in the context of the activities' of that establishment if the latter is intended to promote and sell, in that Member State, advertising space offered by the search engine which serves to make the service offered by that engine profitable."
    As to the third issue, the CJEU stated that individuals have the right, under certain conditions, to ask search engines to remove links with personal information about them, "[e]ven initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed."
    Taiwan Perspective

    With regard to the instant case, the ruling of the Court of Justice of the European Union (CJEU) in relation to the Directive is in accord with Taiwanese data protection laws ("Personal Information Protection Act ") on several points:
    Paragraph 2, Article 51 of the Personal Information Protection Act provides as follows: "The provisions of this Law are applicable to the government agency and the non-government agency, when they collect, process or use the personal information of the citizens of the Republic of China outside the territory of the Republic of China." Taiwan's Personal Information Protection Act is applicable even to a foreign company established outside Taiwan (i.e. Google in the instant case) if the foreign company collects, processes, or uses the personal information of Taiwanese citizens. The CJEU has found that Google Inc. has a branch/subsidiary within the EU and that such branch/subsidiary promotes within the EU. Thus, even though the reason for the EU Data Protection Directive's applicability to Google Inc. is different, the result is largely the same.
    Subparagraph 4, Article 2 of the Personal Information Protection Act provides as follows: "Processing: To record, input, store, compile, correct, duplicate, retrieve, delete, output, connect or internally transmit information for the purpose of establishing or using a personal information file". Therefore, in the instant case, Google Inc.'s search engine engages in the compilation, storage, and retrieval of information. According to Taiwan's Personal Information Protection Act, search engines engage in the activity of processing personal information and are thus subject to Taiwan's Personal Information Protection Act.
    However, Taiwan has not directly addressed the "right to be forgotten" in its legislation, and Taiwanese courts have not issued relevant opinions. Paragraph 1, Article 11 of the Personal Information Protection Act is of relevance: "The government agency or the non-government agency should ensure the accuracy of personal information, and correct or supplement it, ex officio or upon the request of the Party." Paragraph 3 of the same Article provides as follows: "The information collected should be deleted, discontinued to process or use, ex officio or upon the request of the Party when the specific purpose no longer exists or time period expires. However, the preceding sentence may not be applicable when it is necessary for the performance of an official duty or fulfillment of a legal obligation, or when it is agreed by the Party in writing."

    Taiwan's Personal Information Protection Act currently only provides that a party may request correction when errors exist with respect to the party's personal information or deletion when the specific purpose no longer exists. Originally, "La Vanguardia" newspaper lawfully collected and used the personal information (reporting of a real-estate auction is in accord with the public interest) and the information was correct. The only issue was that the personal information was out of date after the passing of considerable time. As such, there would be room to dispute the expiry of the specific purpose and whether a request for deletion would be justified. This issue is still awaiting legislative resolution in Taiwan.