The decision came unexpectedly and dropped like a bomb. After data protection experts had spent years in a mostly futile battle for improvements in data protection at internet giants such as Google and Facebook, aid has now come from the Court of Justice of the European Union (CJEU). In Google Spain and Google v AEPD the CJEU for the first time affirmed that search engine operators are obliged to remove links to websites with contents that violate data privacy rights. The case referred for a preliminary ruling concerned links to online pages of a daily newspaper published 16 years ago and containing classified adverts which, while mentioning the name of the person concerned, related to the auction of a plot of land in connection with attachment proceedings relating to social security debts. The CJEU proceeded on the assumption that, as a matter of principle, owing to the ubiquitous nature of the internet and the potential for compiling detailed personal profiles via search engine queries, the fundamental rights to respect for personal privacy and the protection of personal data take priority over the financial interests of the search engine provider as well as the interest of the general public in finding the information in a search conducted on the basis of the name of the person concerned. The decision suddenly moved the problems of data privacy protection and search engine operation into the public eye. Whereas search engines were long considered to be access providers within the context of liability, merely arranging for access to contents, the CJEU emphasized the freedom enjoyed by search engines and, contrary to the opinion of the Advocate General, assumed the capacity as “data controller” instead of a mere “data processor”. Similarly, in its “Autocomplete” decision the German Federal Court of Justice considered search engines to be providers of their own information (s 7, German Telemedia Act (TMG)) and affirmed a verification obligation of the search engine operator in a specific case within the context of the principles of duties of care (Storerhaftung). In the field of information science the independent role of search engines has long since been discussed under the catchword “gatekeeper”. It now appears that the courts increasingly impose obligations on search engines in view of their pivotal function in searching for information on the internet. Criticism has already been voiced that the CJEU—diverging from the earlier Lindqvist decision—has principally established the priority of data privacy rights over the interest of the general public in obtaining information, priority which gives rise to different legal situations in the online world vis-a-vis the offline world as regards the right to be forgotten.
Read full abstract