The so-called right to be forgotten was confirmed in the Court of Justice of the European Union’s judgment in the case Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (Case C-131/12), delivered on 13 May 2014. The case owes its roots to an earlier development in Spain.
In 2010, Spaniard Mario Costeja González requested the national Data Protection Authority (Agencia Española de Protección de Datos) the removal of content from a website, and the removal of links from Google search results. While the first request was turned down, the second was upheld.
Proceedings were initiated by Google. During the proceedings, the opinion of the Advocate General was sought as to whether the company could be considered a data controller; this clarification would eventually form the basis for remedy. AG Niilo Jääskinen opined that despite the EU’s Data Protection Directive (95/46/EC) being applicable to Google, the company could not be considered a data controller.
In reaching its judgment, the Court of Justice of the European Union took into consideration three issues (in addition to the AG’s opinion and to those of the governments of Austria, Greece, Italy, Spain, and Poland):
- Applicability. Was the Data Protection Directive applicable to this particular case, i.e., could Google Inc. be regarded as being subject to the European Union’s acquis? The Court decided that the directive was applicable to the company, agreeing with the AG’s opinion.
- Definitions. What was Google’s capacity in this particular case: the controller, the processor, or the recipient? Disagreeing with the AG’s opinion, the Court decided that Google was a controller.
- Remedy. If the directive was applicable to Google, and if under said directive Google was considered a controller, what should have Google done? The Court concluded that search engines, including Google, should remove search results, under specific guidelines set out in the judgment.
Subject to certain exceptions, a person’s right to be forgotten are said to override not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information resulting from a search related to that specific person.
The implications of this judgment were unparalleled. Search engines were required to facilitate requests for removal of results, and currently contend with thousands of requests every month. In parallel, the judgment triggered heated debates as to whether the right to be forgotten curtailed freedom of expression, freedom of speech, and freedom of the press.
Global developments have taken place at a fast pace, despite criticism by Google and other companies such as Facebook. Early in 2015, Google’s attempt to limit the applicability of the judgment to European websites, failed to gain broader support. A few months later, the French data regulator (Commission Nationale de l’Informatique et des Libertés) rejected Google’s appeal against the global enforcement of the right to be forgotten, requesting Google to comply with the formal notice with immediate effect. In the UK, the Information Commissioner ordered Google to remove links to news stories about content which was originally removed under the right to be forgotten.
Also last year, rules on the right to be forgotten were adopted in Japan; Russia approved the second amendment of a new law, whereas Colombia’s Constitutional Court ordered a journal to limit the possibility of users from accessing news on the claimant through online searches. In 2016, more courts and parliaments are expected to rule on the right to be forgotten.