The Court of Justice of the European Union (CJEU) recently handed down a long awaited judgement in the case of Google Spain C131/12. This case involved a challenge brought by Spanish man, Mario Costeja Gonzalez, against Google Spain and Google Inc (amongst others) and sought to oblige Google to remove links to web pages published by a newspaper, La Vanguardia, that came up when an internet user entered Mr Gonzales name into the Google search engine.

The legal challenge and the Court’s determination focused on the provisions of the Data Protection Directive 95/46 that provide for a right of a data subject, such as Mr Gonzales, to object to data processing and a right to erasure of personal data.

The Spanish Court referred three questions to the CJEU relating to the territorial scope of the Directive, the material and personal scope of the Directive and thirdly and most significantly, the question of whether or not data subjects have the right to object to data processing and seek erasure when it comes to search engine displays and results.

With regard to the first question, the Court held that the search engine was within the territorial scope of the Directive. In relation to the second question, the Court determined that the operator of a search engine “processes” data for the purposes of the Directive. A search engine collects, retrieves, records, organises, stores and makes available data and the Court held that such acts constitute processing personal data bringing the actions within the material scope of the Directive.

The third question hinged on the so-called right to be forgotten and this is the most significant area of the Court’s judgement. Here, the Court held that in certain circumstances, the operator of a search engine is obliged to remove links to web pages that are published by third parties and that contain information relating to a person in the list of results displayed following a search of that person’s name. It noted that such search results potentially concern a vast number of aspects of an individual’s private life and without the search engine the information could not have been interconnected or could have been accessed only with great difficulty. The Court also noted however that an internet user, that is the person searching, may have a legitimate interest in the search results and that a fair balance must be sought between that legitimate interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court went on to comment that the processing of data may become incompatible with the Directive when the data is inadequate, irrelevant, no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.

The Court has therefore not identified an absolute right to be forgotten. Rather, it has stated that there may be a legitimate interest in accessing the data about a data subject. It has highlighted the limitations imposed by the Directive in relation to data processing. A data controller, which in this case was the search engine, may not be permitted to display personal data via search engine results, where the data displayed is inadequate, irrelevant or excessive. The judgment clearly imposed great restrictions on search engines in relation to the results that it may lawfully display and there are likely to be a wide array of situations where individuals have strong grounds to request search engines to remove offending links.

The full press release from the European Court of Justice that summarises the judgment can be read here.