The European Court of Justice (ECJ) ruled last week that individuals have a right to ask search engines to remove links containing personal data about them, if the information about the individual is “inadequate, irrelevant or no longer relevant”. The ECJ, ruling on a question referred to it by a Spanish court, held that Google is subject to EU data protection laws as its Spanish subsidiary promotes and sells advertising space, and processes and controls personal data. The case will now return to the Spanish court for it to apply the ECJ’s ruling and issue its own decision.
Some view the ECJ’s judgment as an important step towards recognising an individual’s right to privacy on the internet, while others argue that it is an attack on freedom of expression and the right to know and forces search engine operators to make difficult decisions as to what amounts to “inadequate, irrelevant or no longer relevant” information. The case has left many issues unresolved, such as is the judgment limited to the activities of search engines or can it be applied more broadly and will the processing of personal data by parent companies outside Europe also be caught? It has potentially far reaching implications both for businesses processing personal data and individuals seeking to exercise their rights. This decision may also result in additional costs for business not only managing the requests but also dealing with challenges brought by individuals.
Read our full briefing on this judgment here. For further information or for advice on how this could impact your business please feel free to contact any of the following individuals:
