In May 2014, the European Court of Justice ( hereafter, the CJEU) rendered an important judgment on the interpretation of the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. In the case C‐ 131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, the Court interprets the directive in the light of the fundamental rights to respect for privacy, protection of personal data and freedom of expression, strengthening what we call now the right to be forgotten.
The Google Spain case dealt with the question of responsibility of search engines to remove links to web pages from their search results but is also of general relevance to the individuals’ data protection on the Internet. The Court gave to individuals the possibility to request that personal information be removed from search results of a search engine, on the basis of Articles 12 and 14 of the Directive 95/46/EC. This right to be forgotten can be exercised without justification of any prejudice and despite the fact that the relevant personal data remains accessible on the websites of third parties.
The Google Spain case opens an important question in EU law: Under which circumstances the right to speak freely and to receive information, protected under the EU Charter of Fundamental Rights , can be overruled by the right to protection of personal data and respect for privacy? The Court triggered controversy as its judgment opened another related question: how might public interest of private and public data delineate the fundamental right to freedom of expression and information? Despite the complexity of the answers, it remains certain that the CJEU opened there a strong debate over a potential hierarchy between fundamental rights of privacy and freedom of expression, according to factual circumstances.
The risk faced by the CJEU was therefore to create an unfair supremacy of privacy and personal data protection over the freedom to receive information of the Internet’s users. This question has proven to be particularly relevant in the elaboration process of the new General Data Protection EU Regulation, proposed to replace the current Directive 95/46/EC. The Court of Justice already determined the extent of the fundamental right to privacy in its previous case- law. But the ruling elaborated in the Google Spain case is innovative and unrivaled in many ways. Moreover, The CJEU seemed also to depart from its previous jurisprudence while ruling on the fundamental right to freedom of expression issue itself: the Court used to leave the question of its scope to the national courts.
It is certain that the above mentioned controversy is also defined by the complexity of the Internet. In its first version, the Data Protection Directive did not take into consideration the internet sphere, simply not sufficiently developed at the time of its elaboration. Several amendments modified slightly its scope but the need for a new Regulation is increasing since several issues cannot find a satisfactory solution in the current instrument: the right to be forgotten is one of those!
The elaboration of a right for individuals to see their personal data erased from search engines’ pages became a burning issue in the context of the elaboration of a new General Data Protection Regulation. The Regulation, at its last draft, retakes several distinctions operated by the actual Directive and by the Court. It seems consequently very important to identify the main weaknesses of the Google Spain case and to understand its concrete consequences on the balance of fundamental rights, legal certainty and coherence.
Nevertheless, the judgment has demonstrated the European legislator exposure to risk in this area. We can only encourage the drafters of the new Data Protection Regulation to elaborate a comprehensive “right to be forgotten”, providing the data subjects with a precise regime which give them certainty regarding their claims to de-list their personal information from search engines results. The future will show us whether this regime will extend to any other claim of an individual to see its personal data erased from their source: the webpages relayed. The particular exposure and universal availability of the search engines results, mostly on Google, created an urgent need to give to the individuals a right to assert their right to privacy and protection of personal data. The Data Protection Directive has shown its limits in that matter and the elaboration of a new Regulation is therefore of great importance. In addition, the CJEU will have to ensure that a fair balance is operated between freedom of expression and information on the one hand and right to privacy and protection of personal data on the other, once their scope interfere. This will be the only solution to avoid any hierarchy between fundamental rights within the EU Charter.
