Right To Forget and Search Engine (ECJ Google Spain Decision)

European Court of Justice C-131/12

In a ruling which is already being commented as a landmark decision the European Court of Justice held that the search engine provider Google Spain has to delete certain links from its search result index if those links lead to information provided by third parties that is personal data the processing of which by the search engine at this point in time is not any more covered by the legal requirements of processing such personal data. Google search index still provided a link to newspaper reports from 16 years ago about the auctioning of property of an individual who was in debt. The debt was paid off.

According to data protection law the data controller, here the search engine provider, has to ensure that personal data are processed fairly and lawfully, collected for specified, explicit and legitimate purposes, not further processed in a way incompatible with those purposes, adequate, relevant and not excessive in relation to the purpose for which they are collected or processed, accurate, kept up to date, kept in form which permits the identification of data subjects for no longer than is necessary for the purposes for which the data were collected or processed. The controller must take every reasonable step to ensure that data which do not meet those requirements are erased or rectified.

The decision supports the individual's so called "right to forget" in the digital world. It also holds non EU companies, particularly US companies, liable under EU data protection law if they do business directly or through their entities in Europe.