Google versus the Spanish Data Protection Agency

Google versus the Spanish Data Protection Agency
Page content

Case C-131/12

What happened to Mr. Mario Costeja Gonzalez could have happened to any of us. The location was Spain. The time – 1998. Mr. Gonzalez lost his home due to outstanding social security debts. A local Spanish newspaper published a listing of properties – including Mr. Gonzalez’s property - that were up for auction. Certainly not newsworthy.

Flash forward to 2009 when Mr. Gonzalez was surprised to find the 1998 auction listing was made available online as part of the newspaper’s web archives. After complaining to the newspaper and later to Google to have the irrelevant data removed, Mr. Gonzalez hit a brick wall. After no action was taken by Google or the newspaper, Mr. Gonzalez lodged a complaint with the Agencia Espanola de Proteccion de Datos (AEPD) – an agency of the Spanish government focused on protecting the personal privacy of Spanish citizens.

The AEPD agreed with Mr. Gonzalez that Google should remove the personal data. Google fought back and with several years of legal wrangling, the case ended up in the European Court of Justice as case C-131/12.

The European Court of Justice ruled in 2014 that citizens do have the right to be forgotten – under certain circumstances. Specifically, the data must be inaccurate, inadequate, irrelevant or excessive. Certainly in Mr. Gonzalez’s case, the data was found to be irrelevant. The court also ruled that the right to be forgotten is “not absolute.” It is a tough balancing act protecting the privacy of individuals with the freedom of expression and the need to provide public services.

This would stop abusers of this ruling from wiping out all personal data without reason. For example, should public figures and celebrities be able to scrub their personal data from the world’s search engines just because they want to hide from the limelight?

The Situation Today

Google complied with the European Court of Justice’s “right to be forgotten” ruling by altering search results for their European specific sites (e.g., Google Spain – google.es, Google France – google.fr) but did not otherwise alter results for the rest of the world.

A French regulatory body fined Google over $100,000 in March of this year for not delisting data on a wider scale. Google has since filed an appeal claiming that the European Court of Justice’s ruling does not apply worldwide and thus should not be forced to perform any further alterations.

At a basic level, I can see both points. If Google were to bow down to this order, it would set a dangerous precedent. A European judicial ruling that applies worldwide? Yikes. On the other hand, the very nature of search engines presents a problem. Search engines really cannot be compartmentalized to a single country. If Google results were showing inaccurate information, wouldn’t you want ALL of that inaccurate information scrubbed from search results whether it is in your home country or worldwide?

The Impact

It will be interesting to see how this case proceeds and whether or not the EU will adopt stricter privacy controls in light of the high court’s findings. On one hand, you certainly should be able to have search providers remove inaccurate or irrelevant links regarding your personal information. On the other hand, Google’s point is that the EU Court’s jurisdiction does not cover Google’s other sites – Google US for example. Should the EU’s courts be able to dictate what an American company can and cannot do outside of the EU?

It’s unfortunately Google didn’t have something in place to help protect citizens like Mr. Gonzalez. I can understand Google’s reasons for fighting the court order, but had they done the right thing in the first place – by giving people a way to request removal of inaccurate links - this whole case could have been avoided.

What are your thoughts on this matter? Leave a comment below!

References