May 20 Update: see our full analysis of the ruling here.
In a ruling with far-reaching implications for online privacy, the European Court of Justice has ruled that online search companies are subject to the European Data Protection Directive, (Directive 95/46/EC) . Search engine companies that are based in the EU, or multi-national search engine companies that have a branch located in the EU, fall under the jurisdiction of this ruling and are considered “data controllers.” From the Court of Justice:
“In today’s judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the directive, must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect.
The Court further holds that the operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing. The Court observes in this regard that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements. This is the only way that the guarantees laid down by the directive will be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.”
WPF is still analyzing the full ruling. An early reading, however, makes it clear that search engine links to individuals’ names must be removed when requested. There are differences in the application of the ruling to individuals who are public figures, and the ruling does not apply to individuals’ activity in public life.
The court press release noted: “The Court points out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.”
This ruling is a game-changer for online privacy. We will be writing additional analysis.