On 13 May the Court of Justice of the European Union ("ECJ") delivered a ground-breaking ruling on the application of the Data Protection Directive 95/46/EC (the "Directive") to internet search engine operators. In its eagerly anticipated judgment, the ECJ ruled on key issues including the circumstances in which search engines must block certain information from being returned in the results of a search made against the name of an individual (even where those data were originally lawfully published by a third party), the so-called "right to be forgotten", and the territorial application of the Directive.

Much has been written already about the impact of the ECJ's decision on the right to be forgotten and its impact on the freedom of expression; however, the ruling on the long arm jurisdiction of the Directive is relevant for all international businesses which have EU operations, whatever the sector.

This judgment means very different things for different stakeholders.

  • For search engines and news aggregators with an EU presence, it means time and effort will be needed to gear up to meet what could be viewed as a new species of "take down" request from individuals featured on their sites.
  • For individuals, it means a bolstering of the "right to be forgotten" or "de-linked" from inappropriate or obsolete information, even where the original source of the objected-to information continues to publish the information.
  • For all international businesses with EU operations, even where no significant personal data processing occurs in the EU, the ruling means that processing of personal data occurring outside the EU may still be considered to be "in the context of" an EU establishment, thus coming under the aegis of the Directive. This means that in some cases EU establishments can be enforced against as a result of the actions of their overseas group members.

Background Some 16 years ago, a Spanish citizen had his house compulsorily auctioned to pay some social security debts. That process required the statutory advertisement of the auction, and his name, on a Spanish newspaper's website. The property was sold and the debts were satisfied. Many years later searches against his name made using Google Search were still returning links to the newspaper advertisement. The individual complained to the Spanish Data Protection Authority, which ruled that Google Inc. (which ran the Google Search service from servers in the U.S.) and Google Spain (the local subsidiary) were obliged to withdraw the data and/or prohibit access to the information complained of. Google Inc. and Google Spain appealed, which is how the ECJ came to consider questions of EU law which had been referred to it by the Spanish High Court.

Territorial scope of the Directive The ECJ provided significant clarification on the territorial scope of the Directive. When considering how the Directive applied to Google's activities, the ECJ confirmed that automatically indexing personal data on the internet, storing it temporarily and, finally, making it available to internet users constituted "processing".

Google had sought to argue that the operations of the search engine (and therefore the use of personal data) did not fall within the scope of the Directive because the search engine is operated by Google Inc., which is established in the U.S. Google Spain is a subsidiary company and its operations are limited to selling advertising space; it is not directly involved in processing of personal data which occurs in connection with the operation of the Google Search engine.

One of the required grounds for the Directive to apply is at Article 4(1)(a) "the processing is carried out in the context of the activities of an establishment of the controller". Until now, there has been no judicial consideration of this Article.

The court held that Google Spain constituted an "establishment" for the purposes of Article 4(1)(a) and that the relevant processing occurring (the operation of Google Search in Spain, provided by Google Inc.) was "in the context" of that establishment. The ECJ ruled that there was an inextricable and close link between the activities of the two companies because Google Spain's activities relating to the advertising space "constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed." On this basis, the court held that Google's activities fell within the scope of the Directive.

Search engines as "data controller" Having considered the territorial application of the Directive, the ECJ then went on to hold that Google was also a data controller within the definition provided by the Directive, since it determined the purposes and means of the processing. The court held that the processing carried out by Google was a separate and additional activity to the processing carried out by the original publisher. Google's activities in providing a list of results from the internet allowed users to gain a "more or less detailed profile of the subject" covering many aspects of their life. The ECJ held that this additional activity significantly affected an individual's rights to privacy and protection of personal data.

As a consequence of finding that Google acted as a data controller, the court held that the organisation is under a duty to comply with the Directive and any laws that implement it in Member States. Significantly, this includes:

  • Article 6, which requires, amongst other things, that personal data is relevant, kept accurate and up-to-date, and retained for no longer than is necessary
  • Article 7(f), which provides the circumstances in which personal data can be processed, including where processing is necessary for the controller's legitimate interests (or those of third parties to whom the data are disclosed) except where these are overridden by the interests or the fundamental rights and freedoms of the individual data subjects concerned.

The right to request the blocking and erasure of data The ECJ noted that there are two main provisions contained in the Directive that would allow data subjects to obtain the erasure of data, and held that these obligations could apply to Google even if the data subject did not also seek to have the data erased from the original publisher's website.

Under Article 14, a data subject can object on any "compelling legitimate ground" to the processing of their data. This concerns Article 7 in particular. The court stated that where this ground is relied upon, a balancing exercise must be carried out between the Article 7(f) legitimate interests of internet users in accessing the data complained of on the one hand, and the individual data subject's right to privacy and protection of his personal data on the other. In cases such as the present, the court stated that the rights of the data subject override those of the public in knowing the information. However, the court noted that where the data subject in question is a public figure, the result might be different as there could be a public interest in such information being available.

 Under Article 12(b) of the Directive, a data subject may obtain the rectification, erasure or blocking of data if the data do not comply with Articles 6 and 7. The ECJ stated that due to the Article 6 requirement that data is not kept longer than necessary, even processing that was initially lawful may become incompatible with the Directive due to the passage of time. The processing must be lawful in accordance with the requirements in Article 7, as outlined above, for as long as it is carried out.

The court clarified that where an individual's request to Google for "de-linking" was denied, that individual would then have the right to take the objection to their national supervisory authority (in the UK, this would be the Information Commissioner's Office).

Future impact Will this decision lead to a stampede by global, data-rich companies to withdraw from the EU? That seems unlikely. But it may cause some to consider carefully the international structuring of their operations; in particular, whether they can organise them in such a way that they could contend that no significant data processing was occurring within the context of an establishment in the EU. The ECJ has here shown a willingness to take a broad approach to the "establishment" test, so that may not be easy to achieve. At the same time, the ECJ acknowledged "the important role played by the internet and search engines in modern society, which render the information contained in a list of [search] results ubiquitous" and therefore search engines can perhaps be regarded as a special case in many ways.

Data protection issues look set to maintain their high profile, not least due to:

International skirmishes over data sovereignty - in particular transatlantic ones - appear to be entering a new chapter. This decision from the ECJ is surely more grist to the mill.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.