The Court of Justice of the European Union has issued a ruling that affects privacy and data protection for millions of people. But the ruling is also significant because of what it says about whether companies should comply with the law of the countries in which they do business.
In its May 13 decision, the court ruled that internet users can request information about them be removed from search results by search engines like Google.
The decision points to a certain tension between EU and US law. This is particularly significant given that most of the major global players in social networking and e-commerce operate out of the US but also do a huge amount of business in Europe.
The case turned on the interpretation of the European Data Protection Directive, which describes rules on all kinds of digital material. Originally adopted in 1995, a new version is currently being debated by EU lawmakers.
The so-called “right to be forgotten” is the most widely discussed aspect of this debate. The Google case all started when a Spanish man claimed Google should stop linking to a 1998 newspaper article about him. The article was factually accurate but detailed the repossession of his property, about which the claimant was unhappy.
In practice, addressing this dilemma meant answering a series of questions, and those answers may be significant well beyond this particular debate.
Don’t forget where you came from
Google’s first line of defence was that its activities were not subject to the Data Protection Directive. It argued that its search engine was not a business carried out within the European Union. Google Spain was clearly subject to EU law, but Google argued that it sells advertising rather than running a search engine.
The court was asked to consider whether Google might be subject to the Directive under various circumstances. A possible link was the use of equipment in the EU, through gathering information from EU-based web servers or using relevant domain names (such as google.es). Another suggestion was that a case should be brought at its “centre of gravity”, taking into account where the people making the requests to delete data have their interests.
But the court never reached these points. Instead, it found the overseas-based search engine and the Spain-based seller of advertising were “inextricably linked”. As such, Google was found to be established in Spain and subject to the directive.
The message being sent was an important one. Although this ruling is specific to the field of data protection, it suggests that if you want to do business in the EU, a corporate structure that purports to shield your activities from EU law will not necessarily protect you from having to comply with local legislation. This may explain the panicked tone of some of the reaction to the decision.
One must not go too far with this though. Contrary to some headlines, this decision does not mean that Google or others must act on all requests, nor does it necessarily establish “large-scale private censorship”.
What the decision does mean, in respect of the “right to be forgotten”, is that search engine operators (and potentially others) must consider requests under the terms of the existing EU directive. In some cases, this will require action; in other cases, it will not.
Realistically, the result may be pressure for a clearer sets of rights and obligations, perhaps borrowing from the notice and takedown systems used for the liability of intermediaries in cases where material is alleged to infringe copyright, for example. These themselves are somewhat controversial.
Whatever procedure is adopted, the situation will need to be carefully monitored. This is not least because of the potential impact on the freedom of expression of the search engine operator and the authors of websites.
I continue to doubt whether private internet intermediaries are best placed to balance the rights of various parties, or indeed whether the “right to be forgotten” properly acknowledges the whole range of interests protected by the EU’s charter of fundamental rights.
In the longer term, the broad approach taken by the court over how to define what data processing is and what it is to control data and, in particular, being subject to EU law, may be the most significant elements of this debate.
It is surely in the public interest that those doing business in the EU comply with the democratically adopted laws of the union, rather than the less burdensome laws of the United States. At a time when multinational corporations are being subjected to long-overdue scrutiny about their tax payments, the court has tried to re-establish the link between the benefits of doing business in a jurisdiction and the obligations of complying with the will of the voters of that same jurisdiction.