EU Court of Justice Clarifies Responsibilities of Internet Search Engines Regarding So-Called "Right to be Forgotten"

On May 13, 2014, the Court of Justice of the European Union ("CoJ" or "Court") adopted a judgment[1] that resolves several questions about the interpretation of the EU Data Protection Law (Directive 95/46/EC) in relation to the activity of internet search engines.

The judgment is significant because, for the first time, the CoJ expressly recognized the application of the EU Data Protection Law to the activities carried out by search engines and clarified the responsibilities of these types of companies as regards the "right to be forgotten."

Key points of the judgment include the following.

Classification of Activity Carried Out by Search Engines under EU Data Protection Law

The activity carried out by search engines was classified by the CoJ as a processing of personal data. The Court held that the activity of search engines—locating information published or included on the internet by third parties, indexing it automatically, storing it temporarily, and making it available to internet users according to a particular order of preference—constitutes a processing of personal data according to the terms established in article 2 of Directive 95/46/EC when that information contains personal data of third parties.

The judgment considered a search engine operator to be acting as a controller, since the operator determines the purposes and means of this activity. The search engine operator must be regarded as the "controller" within the meaning of Article 2(d) of Directive 95/46/EC.

Application of EU Data Protection Law to Search Engine Operators

The CoJ held that the activity of search engines is subject to the EU Data Protection Law if (i) the search engines are operated by an undertaking that has its seat in a third state, (ii) the search engine operators have an establishment in a Member State, and (iii) the processing of personal data is carried out "in the context of the activities" of that establishment.

The CoJ made an "extensive interpretation" of article Article 4(1)(a) of Directive 95/46/EC and considered that it is not necessary for the processing of personal data to be carried out "by" the "local" establishment in question but that it is sufficient for this processing to be carried out "in the context of the activities" of that establishment.

In the case at hand, the Court considered that the processing of personal data is carried out in the context of the activities of the local establishment if the latter is intended to promote and sell advertising space offered by the search engine in that Member State. The Court determined that the activities of a search engine operator and those of its establishment located in the Member State are inextricably linked since the activities relating to the sale of advertising space constitute the means of rendering the search engine at issue economically profitable.

"Right to be Forgotten" and Responsibility of a Search Engine Operator

The judgment recognized an individual's "right to be forgotten." Individuals are entitled to request that the search engine remove search results that affect them, under the conditions of Directive 95/46/EC, even though this information has not been deleted by the publisher, nor has the publisher requested its de-indexation. If that request is not met, individuals are entitled to seek the involvement of competent authorities.

A search engine operator must guarantee the right to be forgotten in certain circumstances. The CoJ found that the operator of a search engine is obliged to remove from the list of results, following a search made on the basis of a person's name, (i) links to web pages published by third parties containing information related to that person and (ii) where that name or information is not erased beforehand or simultaneously from those web pages, even when its publication on those pages is lawful.

The right to be forgotten is not an absolute right and has a limited range. The Court stressed that a fair balance should be sought between the legitimate interest of internet users in potentially having access to that information and the data subject's fundamental rights (especially the right to privacy and the right to protection of personal data). In this regard, the Court recognized that the individual may request the removal of links if the personal data has become inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which it was processed, taking into account the time that has elapsed.

As a general rule, the Court held that the right to be forgotten prevails generally over the "mere economic interest of the manager of the search engine," unless the claimant has public relevance, and access to information is justified by the public interest.

Lawyer Contacts

For further information, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com.

Paloma Bru
Madrid
+34.91.520.3985
pbru@jonesday.com

Jonathon Little
London
+44.20.7039.5224
jrlittle@jonesday.com

Stefano Macchi di Cellere
Milan / London
+39.02.7645.4104 / +44.20.7039.5959
smacchi@jonesday.com

Undine von Diemar
Munich
+49.89.20.60.42.200
uvondiemar@jonesday.com

Olivier Haas
Paris
+33.1.56.59.38.84
ohaas@jonesday.com

Laurent De Muyter
Brussels
+32.2.645.15.13
ldemuyter@jonesday.com

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.