Europe’s Supreme Court Recognizes Internet “Right to be Forgotten”

The European Court of Justice (ECJ), which functions as the European Union’s Supreme Court, has recognized a controversial “right to be forgotten” -- a right to have references to oneself deleted from the Internet. The case is called Google v. Costeja Gonzalez and was decided on May 13, 2014.

The plaintiff in the ECJ case is a Spanish citizen whose property was auctioned to satisfy debts back in 1998. A Google search on his name produced links to a Spanish newspaper notice for the 1998 auction. He sued Google to remove the links, arguing that it was wrong to keep associating him with financial troubles that he had long-since resolved. The ECJ agreed with him.

The ECJ decided the case under the 1995 EU Data Protection Directive, which does not explicitly create a right to be forgotten, sometimes referred to as a “right of erasure.” However, the court inferred such a right from more general provisions of the Directive, when read in the context of the Charter of Fundamental Rights of the EU and its recognition of rights to private life and the protection of personal data. The ECJ held preliminarily that Google is a “data controller” engaged in the “processing” of personal data, and is therefore subject to the Directive. It then concluded that an individual’s privacy rights “override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information.” In a nod toward what we would think of as free speech issues, the ECJ acknowledged that the result might be different if, for example the subject played a role in public life, creating a “preponderant interest of the general public.” But this plaintiff was merely a private citizen.

The reaction to the decision has been both positive and negative, but virtually everyone has been astonished. The reason for the astonishment is that the EU has been debating a new Data Protection Regulation for several years. The single most controversial provision in the draft Regulation has been a “right to erasure or to be forgotten” just like the one the ECJ has just announced. Privacy activists have pushed for it, while both commercial and media interests have decried its potential to limit both Internet commerce and free speech. Now we learn that this hotly debated “new” right has been there all along.

The new Regulation is currently the subject of final negotiations between the European Parliament, which has approved the current draft, and the Council of the EU (composed of representatives of the national governments), which must also approve it. One view is that the ECJ decision will make final approval easier, since the right to be forgotten is in place regardless of whether the new Regulation is approved. Another view is that the decision will make opponents work even harder to rewrite the Regulation so as to undo the ECJ’s decision. That will be difficult, however, since the ECJ rooted the new right in the Charter, making its decision much like the U.S. Supreme Court’s declaration of a constitutional right.

The likeliest outcome is that the right to be forgotten is here to stay. If so, companies doing business in the EU or gathering or using personal data on EU citizens will have to prepare to deal with it.