Yesterday’s decision of the Court of Justice of the EU in C-131/12, Google Spain v. Agencia Española de Protección de Datos, has generated quite a lot of media commentary, some of it, in my opinion, a bit overheated. I thought it was worth doing a quick overview of what the decision does, and more importantly does not say, and to consider the implications for the future of your information privacy.

 What’s It About?

In 1998, a Spanish newspaper, La Vanguardia  published a report of a court-ordered foreclosure auction to pay social security debt. In 2009, having paid off his debt, the debtor, Mr Costeja González, discovered that Googling his name led to a link to the report.

Relying on the Data Protection principles that data should, inter alia, be kept up to date, be relevant and not excessive to the purposes for which they are processed, and be stored for no longer than is necessary, Mr. González asked the newspaper to take the information down. After all, the information was, in a sense, no longer accurate, and its publication no longer legally required.  The editor refused, as the publication had originally been made by order of the Ministry of Labor and Social Affairs. I should add that, on free speech grounds, no newspaper should ever remove, let alone be required to remove material from its web archive, provided it was legal to publish that material at the time (this includes cartoons). Mr González then asked Google Spain to stop referencing the link in its search results and also complained to Spain’s Data Protection Authority, the Agencia Española de Protección de Datos (AEPD).

The AEPD asked Google to stop indexing the link, but refused to ask the newspaper editor to take the original information down, as the publication was legally justified. Google appealed, and the Spanish court referred a number of questions to the CJEU. Yesterday’s decision was the outcome of that reference.

What Were The Issues?

The Spanish Court referred three questions to the CJEU. The first regarded the question of the Jurisdiction of the relevant Directive, and need not detain us here. The second was a multi-part question that asked:

• Whether Google’s indexing of pages containing the personal data of individuals, and ranking and publishing of search results, is “processing” under Data Protection rules. The Court answered that it is.
• Whether Google, in processing this data, is to be considered a “Data Controller” and therefore placed under certain obligations by Data Protection Rules. The Court answered that it is.
• Whether these obligations are excluded when the the personal data has already been lawfully published by third parties and is kept on the web page from which it originates. The Court answered that they are not.

The final question was whether there is a “Right to be Forgotten” by search engines, even where the articles in question have been (and remain) legally published online? The Court answered that there is.

What Does it Mean?

If an individual wants irrelevant or incorrect personal information about themselves “forgotten”, they may ask a search search engine to remove it. The search engine is not required to automatically comply, but it must examine the merits of the request.

Whether the request should be granted will depend “on the nature of the information and its sensitivity for the data subject’s private life and on the interest of the public in having that information”. For example, where a public figure seeks to remove embarrassing details about him from the public record, the public’s right to know may override his privacy rights.

This is perhaps the most problematic aspect of the decision, that it leaves it to Google to decide who is a public figure, what the public interest is, and whether to release old information back into the search results after a person becomes a public figure. No doubt courts will be addressing these questions for years to come.

What Does it not Mean?

This is not a freedom of speech issue, and attempts to frame it as one are inaccurate if not mischievous. The right to speak, to publish and to be be published is unaffected. Google are not creators of original content, but a company that indexes the content of others for commercial purposes. No piece of writing that was available online before yesterday has been censored because of Google Spain v AEPD. This statement from the Index on Censorship says the judgment “is akin to marching into a library and forcing it to pulp books”. This is arrant, hysterical nonsense. The article that sparked the case is still available on the website of La Vanguardia. Indeed, it is presumably available, unpulped, in its original paper form in some Catalan libraries. Nothing in the decision prevents anything being published online, anywhere. Certainly, it won’t stop Wikipedia from publishing true and accurate information. In this regard, Jimmy Wales’ infringement of Godwin’s Law yesterday looks fairly ridiculous.

What is at play here is the right to Freedom of Information. This is a different right to Freedom of Expression, although the two are linked. Google provides an amazing service, one some of us can hardly imagine living without it. But we did once live without it, and quite happily too. The idea that we have a right to access to all published information about any other person is a new one. The concept would have seemed absurd a few years ago. The information, remember, is still out there. Whether the relative recent convenience of having it all in one place is the stuff of human rights is debatable. Certainly, we all feel more positive about freedom of information when it’s us googling other people than when they are googling us.

That debate is one we are going to be having a lot in the coming years. For all that we complain about the NSA or the Gardaí knowing our intimate  business, we are very laid-back when it comes to Google or Facebook making their money out of it. Imagine for a moment getting stamps for free in exchange for allowing the postman to read your letters and then try to sell you stuff on the doorstep. Because that is what Google is – an advertising company. We tell them all about ourselves and they use this information sell ads directed, with amazing precision, at us. We get nothing in return, except a free but completely unconfidential email service. There has been a lot if talk in recent years about whether this bargain is an acceptable one.

It is not enough to say that people have the right to keep their own information to themselves. If you want to live in the modern world, that is simply not an option. A straight choice between surrendering your privacy or going to live in a cabin in the woods need not be the only option. We have laws precisely to avoid forcing such choices upon us – nobody now suggests that road traffic should be completely unregulated, because you have a choice of whether to drive or not. For years the tide of this debate ran in favour of the corporations that make their money out of your data. Yesterdays judgement, though imperfect, is a good start in refocusing the debate to take the individual’s rights into account.