IT Law: Right to be Forgotten

This report provides a comprehensive analysis of the Google Spain SL and Google Inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja Gonzalez (2014) case, focusing on the 'Right to be Forgotten.' It details the background of the case, the court's judgment, and the implications of the decision for search engines and data subjects within the European Union. The report examines the balancing test employed by the court between the right to privacy and other rights, such as freedom of expression and access to information. It also discusses criticisms of the court's broad interpretation of 'data controller' and the potential for abuse of the 'Right to be Forgotten.' The report concludes by summarizing the key implications of the decision, including its impact on companies operating within and targeting the EU market, and the need for further regulatory clarity.

INFORMATION
TECHNOLOGY LAW

Table of Contents
INTRODUCTION...........................................................................................................................1
Background of the Case..............................................................................................................1
Judgement...................................................................................................................................2
Analysis and Implications of the decision..................................................................................3
Brief Implications of the decision...............................................................................................7
CONCLUSION................................................................................................................................8
REFERENCES..............................................................................................................................10

INTRODUCTION
The newly emerged 'Right to be Forgotten' has attracted immense controversy and uproar
on an international platform, especially in connection to European Union. This jurisprudential
development was undertaken in May, 2014 through the judgement of Court of Justice in the case
of Google Spain SL and Google Inc v. Angencia Espanola de Proteccion de Datos (AEPD) and
Mario Costeja Gonzalez (2014). The court upheld the validity of a new right which entitles every
person to have their personal data forgotten from internet. The application of this right is sought
in EU and in pursuance to the same every person in the region has the right to put forward a
request to the search engines, to have their data deleted from the digital memory. The impact of
this judgement can be felt across the world and has made a significant impact on the manner in
which internet is operated.1 A specific impact of this decision is made on the extent to which any
person can access data on internet in respect to specific individuals. It is important to note that
the business impact of this decision is not only detrimental for Google alone, the broad
construction of the decision has the capability to make other internet operators liable for breach
of privacy. In order to gain a better understanding on the issue the instant study seeks to analyze
the judicial pronouncement of the 2014 case and illustrate the impacts which it has on all the
search engine, in addition to Google.
Background of the Case
This case involved a Spanish national who approached Spanish Data Protection Agency
(SDPA) to remove an internet article published by a newspaper. The compliant was made against
Google, as it was alleged by him that on searching the name of the applicant a particular article
from 1998 is shown in the results. It was further alleged that the article revealed certain
information in respect to an auction which was conducted to recover certain forms of debt
against him. In pursuance to the complaint of applicant, SDPA directed Google Inc. and Google
Spain to conceal the concerned personal data or remove it from internet. In response to the same
a legal proceeding was instituted by Google before the National High Court in Spain. The matter
was referred to European Court of Justice (ECJ).2 The specific legal issues which were made fro
referral were:
1 McNealy Jasmine E. ‘The emerging conflict between newsworthiness and the right to be forgotten’. (2012).
2 ‘Google Spain SL and Google Inc v. Angencia Espanola de Proteccion de Datos (AEPD) and Mario
Costeja Gonzalez’ (2013). <https://h2o.law.harvard.edu/collages/34645> accessed on 1st April 2017
1

 Whether the applicant was entitled to directly approach Google for removal of the
concerned personal data, which has been published by a third party;
 Whether Right to object or erasure, given under the European Union Directive
95/46/EC entitles the data subject to request removal of such personal data on the
ground of right to privacy, even after passage of a considerable time or even if the data
was uploaded lawfully at that point in time.
The Directive provides for processing of personal data as well as on free movement of
such data.
Judgement
Considering the European Union Directive 95/46/EC it was stated by ECJ that this
regulation is responsible for processing of data as well as grant rights to such people to raise
objection on processing of any form of personal data on grounds which are reasonable and
justifiable in nature. In accordance to this provision the data subject is entitled to complaint the
same to the concerned person who is responsible for processing the data. It was found by the
court that the activities being carried out by Google are well within the definition of processing
the personal data as suggested in the Directive. In light of these deductions Google Inc. and
Google Spain shall be considered well within the scope of the Directive.3 In the event the request
is not fulfilled at this level the data subject may approach the judiciary or other supervisory
authorities. The court while considering the facts of the case in hand stated that the nature of
personal data involved in the present case has the potential to fundamentally impact their
respective right of privacy. Considering the nature of interference which the applicant is being
subject to it can be stated that publication of such a personal data cannot be solely justified for
the economic interests which the concerned processors of information may have in the matter.
The respective search engine was considered to be under obligation to process the data
completely in accordance to the Directive 95/46/EC. In furtherance to the same the court while
interpreting the right to object under the Directive as inclusive of the 'right of erasure or to be
forgotten' in connection to the personal data which is published on internet.4 In light of this
3 Erik Werfel J. D., CIPPUS IGP, and CEDS CISSP. ‘What Organizations Must Know About the 'Right to
be Forgotten'. Information Management 50 2 (2016) 30.
4 Dumas Agnès, ‘The right to be forgotten: a change in access to insurance and loans after childhood
cancer?.’ Journal of Cancer Survivorship (2017) 1-7.
2

interpretation every person is entitled to request the search engine operators to either erase the
data which is prejudicial in nature or allow it to be forgotten after lapse of certain time period.
Further, the court also considered Article 12(b) of the same Directive which in essence
empowers the data subjects to require the operators to erase or block certain personal data,
processing of which is not in accordance to the Directive 95/46/EC. The incompatibility of
personal data could be in terms of inaccuracy, inadequacy, irrelevancy and exaggeration in
respect to the purpose of publication of the concerned data.5 Thus, in conclusion it was stated by
the court that the right of data subject in relation to prejudicial personal data shall have an
overriding effect on the economic interests which the operators may have in such data.
Moreover, the court also indicated towards an exceptional situation wherein this right shall not
be made available to the data subject, i.e. in the event the data subject is a public figure and
publishing of such a data is in preponderant interest of public. Since the facts of the instant case
in hand does not fall within the periphery of the situation of exception, the concerned search
engine operator was directed to remove the concerned personal data from the internet.
Analysis and Implications of the decision
The judgement pronounced by court in this case has led to eruption of numerous legal
issues, which are from the perspective of both the public in general as well as search engine
operators responsible for processing of the data on internet. In concern to the human rights of an
individual, the court has considered Article 7 and 8 of the Charter, in pursuance to which it has
been stated the operators are under an obligation to strike a balance between the interests of
public to access the data and the interests of data subjects under Article 7 and 8 of the Charter.
The two articles provides for right to private life as well as protection of personal data. However,
it can stated that the judgement has failed to establish the degree to which the right to be
forgotten can be exercised by the data subject. Moreover, this decision ought to have an
implication on the other fundamental rights, specifically in relation to freedom of expression.
Moreover, it shall also have a detrimental impact on the obligations which the other internet
operators are required to exercise, beyond Google. After ascertaining the resolution to the
preliminary issues the court considered the balancing test which shall be assessed for application
of the balancing test. It was observed by the court that the processors are permitted to process
5 Kerr Julia. ‘What Is a Search Engine: The Simple Question the Court of Justice of the European Union
Forgot to Ask and What It Means for the Future of the Right to Be Forgotten.’ Chi. J. Int'l L 17 (2016) 217.
3

information or data which is personal in nature which in effect serves to the economic interests
of the said controllers or other concerned parties. However, the said permission is not granted in
the instances wherein the overriding interests of data subject in terms of their fundamental rights
of privacy rights are being impacted. In accordance to the opinion of the court it is essential to
consider the seriousness of the interference which is being made by the alleged prejudicial data
in the rights of the data subject. Moreover, it is also important to consider the right of public to
access requisite data or information on the internet in respect to specific persons. In pursuance to
the same the preponderant interest of accessing the information shall be allowed and the right to
be forgotten of the data subject shall not be given priority.6
It has also been stated by the court that considering the supremacy and importance of
right to privacy of any data subject, the objection shall readily be approved even if it is found
that such a data is not prejudicial in any form. Apart from breach of the right to privacy, a data
subject has been entitled to raise an objection even if the data or information is not adequate in
relation to which it has been used, or is completely irrelevant to the context or even if it has
become irrelevant over the course of time. In addition, even in the cases where excessive or
exaggerated information or data has been published in relation to the purpose, then also the
search engines shall be required to remove the concerned data or links from the digital platform.
However, the decision of the court has been facing immense criticism from all the aspects of the
legal fraternity. Much of the criticism is explicitly based on legal arguments, in accordance to
which the decision of the court in relation to granting of right to erasure under the Directive and
other wise is completely outside the periphery of legality attached with the issue. Firstly, it is
being argued that the decision of the court to consider Google as a data controller under the
Directive is completely extraneous, and moreover application of the balancing test was wrong on
grounds of ignoring basic legal principles as well as rights of the concerned parties.
It can be observed that decision of the court has accorded unqualified powers to private
entities, whop are now empowered to regulate or censor the content to be published on internet.
The court has refrained from providing any form of guidance which could regulate the powers of
these private data subjects. Therefore, in pursuance to the decision of court unprecedented
powers have been given to the data subject. However, there has been another opinion in response
to this criticism, that the decision of court in presence of the concerned circumstances was a
6 Hovav Anat. ‘Responsible Innovation: The Role of MIS in the "Right to be Forgotten" Discourse.’ (2016).
4

reasonable interpretation of various rights which are available to all the parties involved in the
matter. It has also been highlighted by some that the critics shall direct their focus on shaping the
debate for introduction of a new regulatory system which is capable to govern the nuances of
modern technology and requirement of privacy protection.
The court while deciding the matter in hand, also made a very broad interpretation of the
definition of data controllers under the Directive to apply the right to privacy and right to object
against personal data. The British House of Lords while reviewing the decision of court
specifically lamented that the approach and interpretation of data controller was too wide and has
now the capacity to include all any of the entities which operate to aggregate the any form of
data which is available publicly. Thus, in effect to this misinterpretation the decision of the court
is applicable on all the such entities and institute a suit against them in the event of allegation of
right to privacy or publishing of prejudicial data. Moreover, it was opined by the court that the
overall interpretation of the Directive by the court in the present matter shall have been more
stringent in nature. It has the capacity to produce results which are completely absurd in nature
and shall have an effect of even including the users of these search engines, if assessed in a
logical manner.
The court while pursuing the balance test in connection to interpretation of the Directive
has given priority to the right to privacy over almost all the other rights which may be involved
in respect to all the parties which are under consideration. In result of this prioritization of the
privacy rights it is argued that the court has developed an exclusive super human right of data
erasure, irrespective of the fact that all the human rights available under law are not bound by
any form of hierarchical relationship.7 The focus of the court was entirely on granting of right to
privacy and in the process they completely ignored the application and importance of other rights
which may be available to parties. For instance the freedom of information and expression which
is one of the fundamental rights available to the public or other entities.
The interpretation of the court on the other hand is entirely based on the principle and
values underlying the wording of the Directive and hence, could not be considered inappropriate.
On analysing the description of the manner in which internet search operates, it can be stated that
both legal as well as intuitive description of 'data controller and processor' is mirrored in the
7 Xue Minhui, ‘The Right to be Forgotten in the Media: A Data-Driven Study.’ Proceedings on Privacy
Enhancing Technologies (2016) 4 389-402.
5

precise manner.8 Opinion of the court is strictly based on the processes which are undertaken by
Google or any such search engine in processing or controlling all the data which is displayed on
search. Moreover, in response to the criticism of the balancing test it has been stated that the
Directive itself provides for prioritization of rights and the court has acted completely in
accordance to the text of the Directive. After analysing the wordings of the Directive, it has been
ascertained that it acknowledges the importance of free flow of data to be accessed by the public,
but at the same it is also clear that this right is subordinate to the right of protection of
fundamental rights, especially in terms of the right to privacy. On the basis of this conclusion it
can be stated that the Directive itself provides for a hierarchical relationship between the Human
rights and the approach of court was completely in accordance to the Directive and hence, cannot
be considered as erroneous in nature. Moreover, the interpretation style of the court was
completely text-based and reasonable in nature, and also a reflection of the underlying principle
and values of the Directive.
The decision of court in respect to granting of an unqualified right to be forgotten to
private entities may also have consequences which prove to be detrimental in effect and has
some real world impacts. In pursuance to the opinion extra powers have been made available for
the entities as well as Google in connection to censoring the publicly available data and
information, without providing any form of guidance or instructions.9 The process has been made
extremely easy and simple for the entities to directly approach the operators of search engines
and impeding access to certain set of facts and information they longer wish to be available for
others. Though the court has provided for certain situations on the basis of which only the search
engines shall allow the request of data subjects, but these grounds are wide enough to include
almost reason which these entities could think of. Moreover, the fact that these requests have
been allowed to be made within the personal or private capacities of the concerned parties, it
completely eliminates the requirement of public accountability as well as scrutiny. In can be
inferred from this that the entire process of exercise of right to be forgotten shall be away aloof
of any form of scrutiny and authentication. This in turn gives unreasonable powers to both
Google (other search engines) as well as the data subjects to take decisions on a discretionary
8 Goldenberg David. ‘The Right to Abortion: Expansion of the Right to Privacy Through the Fourteenth
Amendment.’ The Catholic Lawyer (2017) 19
9 Rickless Samuel C. ‘The right to privacy unveiled.’ Browser Download This Paper (2016).
6

basis and take undue advantages.10 Therefore, the decision has left a large scope for Google to
exercise their discretion and undertake decisions which are not subject to any form of guidance
or qualification. Moreover, this in effect provides insufficient protection to the interests of public
in relation to the freedom of expression as well as access to information.
It is important to note that the approach of the court in evolving judgement of the case is
deeply tied to the text and values of the Directive. The Directive provides a clear indication of
prioritization of Right to Privacy over any other human rights, which forms basis of the decision
to empower private entities to exercise effective control over the processing and publication of
any form of personal data which is available online. Moreover, the decision to grant absolute
power to Google in determining the information which is allowed to be displayed in the search
results is derived from command of the Directive for the Controller. The command specifically
requires the controller to be assured of the quality of data being published. Moreover, the
Directive provides a very broad and vague language in relation to implementation of various
requirements, and hence, the court also did not take any initiative or played an active role in
developing guidance notes for Google or any other search engine.11 However, the court here has
left scope for these search engines and Google to develop their own parameters for entertaining
these form of requests.
Brief Implications of the decision
The implications of upholding the Right to be Forgotten can be briefly summed up in the
following manner:
 The application of this right is primarily within the jurisdiction of European Union, which
implies that all the entities or companies which are working within this region but also
having majority of their operations outside Europe shall also be made liable to adhere to
the same. Moreover, all the entities which are now covered within the broad definition of
'data controller' shall be required re structure their operations in accordance to the same.
 This decision shall also have an impact on the companies from other jurisdictions which
intend to target the EU market. The rationale behind the same is that though the company
10 Macenaite Milda. ‘From universal towards child-specific protection of the right to privacy online:
Dilemmas in the EU General Data Protection Regulation’ New Media & Society (2017)
11 Schulhofer Stephen J. ‘An international right to privacy? Be careful what you wish for.’ International
Journal of Constitutional Law (2016) 14.1 238-261.
7

is not within the jurisdiction, the internet search findings shall be subject to the decision
and hence, shall be able to give restricted results.12 In turn this shall increase the difficulty
of these companies to target consumers from this region.
 A large number of companies primarily operating online shall be required to review all
the policies and assure the manner in which personal data of different entities is being
used. Moreover, the decision has been made applicable on all the entities,
notwithstanding any form of licenses, thereby covering all the alleged 'data controllers' to
comply with the ruling of the court in relation to Right to be forgotten.13
 Google has taken initiatives for establishing a forum in which people can make request to
remove data and information that they found to be private and does not want it to be on
Internet. Other than Google some other search engines such as Yahoo and Bing also have
taken steps for this and they have made plans for removal of the content from the
Internet.
CONCLUSION
European court have ruled in the case that EU citizens have been provided with the
“Right to be forgotten”. According to this they have been provided authority for requesting to
remove any data from the internet sources. Any pages that are deemed to be private can be
requested to be removed. It has been ruled out by the European court of justice that European
citizen has been provided with the right to request for removing links from personal search
engines. If these search engines are asked to remove content which individuals found private
than requests can be made under “Right to forgotten”. It has declined the economic interest of
the publishers and has given overriding power to the public interest to ensure access to
information. Data protection has been made easier with this and privacy of data can be
maintained by making use of this. In consequence to this decision it can be stated that any
personal data which has been uploaded many years back, shall also be entitled to be removed in
pursuance to the Right to be Forgotten. In pursuance to the same it has been stated that the status
of the personal data shall be assessed in accordance to the currently prevailing facts and
12 How Europe's Right To Be Forgotten Affects Your Business (2014)
https://www.forbes.com/sites/emmawoollacott/2014/06/27/how-europes-right-to-be-forgotten-affects-your-
business/#d4a6e4879569> accessed on 1st April 2017
13 Witt, Steve. 'Evolution of the Right to Privacy Within the American Library Association (2016) 1906-2002
8

circumstances. Therefore, any data which was lawful or relevant when uploaded on internet shall
be liable to be removed if the data subject is of the opinion that it is not longer relevant or
accurate for the purpose of actually uploading it. Apart from breach of the right to privacy, a data
subject has been entitled to raise an objection even if the data or information is not adequate in
relation to which it has been used, or is completely irrelevant to the context or even if it has
become irrelevant over the course of time. The application of this right is sought in EU and in
pursuance to the same every person in the region has the right to put forward a request to the
search engines, to have their data deleted from the digital memory. Thus, Right to be Forgotten
or Erasure has been granted to all the private entities to be exercised against the data controllers
or the operators of the search engine.
9

REFERENCES
Statute and Directive
European Union Directive 95/46/EC
European Union Charter
Books and Journals
McNealy Jasmine E. ‘The emerging conflict between newsworthiness and the right to be
forgotten.’ (2012).
Erik Werfel J. D., CIPPUS IGP, and CEDS CISSP. ‘What Organizations Must Know About the
'Right to be Forgotten'.’ Information Management (2016) 50(2) 30.
Dumas Agnès, ‘The right to be forgotten: a change in access to insurance and loans after
childhood cancer?’ Journal of Cancer Survivorship (2017) 1-7.
Kerr Julia. What Is a Search Engine: The Simple Question the Court of Justice of the European
Union Forgot to Ask and What It Means for the Future of the Right to Be Forgotten.’ Chi.
J. Int'l L (2016) 17 217.
Hovav Anat. ‘Responsible Innovation: The Role of MIS in the Right to be Forgotten Discourse.’
(2016).
Xue Minhui, ‘The Right to be Forgotten in the Media: A Data-Driven Study.’ Proceedings on
Privacy Enhancing Technologies (2016) 389-402.
Goldenberg David. ‘The Right to Abortion: Expansion of the Right to Privacy Through the
Fourteenth Amendment.’ The Catholic Lawyer (2017) 11.
Macenaite Milda. ‘From universal towards child-specific protection of the right to privacy
online: Dilemmas in the EU General Data Protection Regulation’ (New Media & Society,
2017)
Schulhofer Stephen J. ‘An international right to privacy? Be careful what you wish for.’
International Journal of Constitutional Law 14.1 (2016) 238-261.
Witt Steve. ‘Evolution of the Right to Privacy Within the American Library Association: 1906-
2002.’ (2016).
Rickless Samuel. ‘The right to privacy unveiled.’Browser Download This Paper (2016).
Online
Google Spain SL and Google Inc v. Angencia Espanola de Proteccion de Datos (AEPD) and
Mario Costeja Gonzalez (2013) <https://h2o.law.harvard.edu/collages/34645> accessed on
1st April 2017
How Europe's Right To Be Forgotten Affects Your Business (2014)
https://www.forbes.com/sites/emmawoollacott/2014/06/27/how-europes-right-to-be-
forgotten-affects-your-business/#d4a6e4879569 accessed on 1st April 2017
10