Searching for answers – Google v Gonzalez

Data protection unusually made headline news yesterday when the Grand Chamber of the European Court of Justice (the ECJ) handed down its landmark judgment on Google Inc. v. Mario Costeja González.[1]

Google must remove certain links relating to Spanish newspaper articles on the repossession of Mr González's property from its search results, potentially opening the floodgates for similar actions by individuals to remove links – not only against Google and other search engines, but possibly social media websites and similar companies.

Against last year's recommendation of Advocate General Jääskine, the ECJ held that Google was a "data controller” in accordance with Article 2(d) of Data Protection Directive 95/46/EC.  This finding seems to be on the basis that “the purposes and means of that processing are determined by the operator of the search engine” and the search engine plays "a decisive role in the overall dissemination".  Such a finding may not be entirely consistent with related case law on search engines, whose automatic collection processes mean that they are generally regarded as mere facilitators under EU law. 

As data controllers, Google and other search engines now have to carry out a balancing act to decide whether to keep or remove disputed links, weighing up the data subject's right to privacy with the publication rights and economic interests of the website (as well as their own).  In this instance, the ECJ ruled that Google should remove the disputed links to respect Mr González’s right to data privacy and his "right to be forgotten".

Whether the ECJ has opened the floodgates to similar actions against Google and other companies will become apparent in the coming days and weeks.  For now, the judgment raises more questions than it answers.  How the balancing act should be carried out properly in practice is not yet clear, but the actual procedure could potentially resemble existing copyright takedown procedures.  It also remains to be seen whether the process is limited to search engines and whether jurisdiction disputes will arise.

It could be that this judgment will be clarified or even overturned by the draft Data Protection Regulations.  But, as there is no appeal, now it only remains to be seen how Silicon Valley responds.

[1] Case C-131/12 Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos and Mario Costeja González