This week two sentences have been published on the Right to Forgetfulness that puts Google back in the spotlight. But what is the Right to Oblivion and at what point are we?
Today I will talk about the famous judgment of Google Spain and Case C-136/17 GC and others against CNIL, in which the legal reasons for the processing of special category data are explained. FUNDAMENTAL to understand what data we can ask to be removed from us, and why.
The right to be forgotten is essentially the concept that people have the right to request that their data be deleted (collected by others).
But really, what are the rights that are at stake here?
The right to privacy and the right to freedom of expression. And what suppression requests demonstrate is that balancing the interests of privacy and freedom of expression IS ALWAYS VERY COMPLICATED.
Let’s talk first about the Right to Privacy, contemplated in Article 8 of the European Convention on Human Rights (ECHR), which prohibits any interference with the right to privacy. BUT, this prohibition is not absolute, since paragraph 2 of the same article shows that the right to privacy may be limited by other interests, such as public safety, or by the rights of others, such as FREEDOM OF EXPRESSION.
The ECHR interprets the right to privacy broadly does not define its scope because it wants to give a dynamic approach. Even providing a lot of protection to the right to privacy, it does not consider it an ABSOLUTE right, but interpretable according to the circumstances.
What happens to the Right to Freedom of Expression?
This right is contemplated in article 10 ECHR. And the ECHR also “grants” limitations. Specifically, in the 2nd paragraph:
Therefore, the right to freedom of expression may be limited by “the protection of the reputation or rights of others, to prevent the disclosure of confidential information”.
Both rights have the same weight in the jurisprudence of the European Court of Human Rights. And, depending on the circumstances of each case, one right prevails more than another.
What else do we have to consider here to address the right to be forgotten?
On the one hand, Article 8 of the Charter of the Fundamentals of the European Union:
And, on the other, to the RGPD, specifically its article 17, which contemplates the Right of suppression, or the Right to oblivion https://www.privacy-regulation.eu/en/17.htm
Let’s continue with the case that was a before and after in the Right to Oblivion, and thus be able to see how the Court of Justice of the European Union applied the rights to privacy, data protection and freedom of expression.
A Spanish citizen, Mario Costeja González, together with the National Data Protection Agency of Spain, sued both a Spanish newspaper and Google, Inc. because when an Internet user searched his name in the search engine, the list of results showed links to two pages of the newspaper La Vanguardia, from January and March 1998, containing an announcement of a real estate auction organized following the embargo procedures for the recovery of social security debts owed by Mr. Costeja González, and That information that suggested I had financial problems was outdated.
The National Court asked the Court of Justice of the European Communities (ECJ) to clarify whether Google should remove the data from the index of its search engine and the news aggregator, even when it was not responsible for producing the content in its search results .
- If the community and national regulations on data protection can be applied in this case or, as stated by Google Inc., those affected should go to the courts of California (USA) where the parent company of the company is domiciled. group.
- If the search engines, when they index the information, are carrying out a personal data processing, if they are responsible for that treatment and must therefore attend to the rights of cancellation and / or opposition of the affected person directly, even if the information is maintained at the original source because it is considered lawful.
- If the data protection includes that the affected person refuses to have information referred to his person undone and disseminated, even though it is lawful and exact in its origin, but that he considers it negative or harmful for his person.
Therefore, it raises 3 ESSENTIAL issues:
- Scope of territorial application
- If Google is RESPONSIBLE for the Processing of the Data, or is only IN CHARGE.
- If information that affects the reputation of a person can be deleted, even if it is lawful and exact in origin.
Google defends itself by saying that they are only IN CHARGE of the treatment because they do not know the data or exercise any rights over them.
Let’s see what the Court said about the questions raised
The first refers to the territorial scope.
Google Search provides services worldwide through www.google.com. The Spanish version of Google Search is provided through www.google.es, a domain registered since September 16, 2003.
Google Search not only facilitates content hosted on indexed web pages, but also takes advantage of this activity to include advertising associated with search patterns.
Google uses a subsidiary company, Google Spain, to sell advertising generated at www.google.com.
Google Spain has its own legal personality and registered office in Madrid, created in 2003. Google Spain directs its activity to companies based in Spain, thus acting as a commercial agent of the Google group, and its corporate purpose is to promote and procure the sale of advertising and advertising. Marketing of this advertising.
Well here, the definition of “establishment” is crucial to know if Google Spain works for Google Inc. as an establishment located in Spain, or not.
TJCE ruled in favor of the Spanish citizen (C-131/12), citing that according to art. 4.1 a) of the Data Protection Directive 95/46 / EC, that Directive applies to search engine operators if one or more of the following three conditions are met:
- When the company providing the search engine creates an office or subsidiary in a Member State intended for THE PROMOTION AND SALE OF MOTOR ADVERTISING SPACES, which directs its activity to the inhabitants of that State.
- If the parent company designates a subsidiary company in a Member State and is responsible for two filling systems related to the data of the interested parties of that Member State, or
- If the branch / subsidiary forwards to the parent company outside the EU any request and requirement of the interested parties or of the authorities in charge of monitoring the right to data protection, even if these resendings are made voluntarily.
The first circumstance occurs, so the scope of application is resolved, and the national and community regulations regarding data protection are applied.
That this first circumstance occurs answers the question of data processing.
The ruling considers that there is YES personal data processing and that Google is RESPONSIBLE for that treatment.
And what happens to the third of the questions raised?
Well, the Court affirmed the right of interested parties to request search engine companies to remove links that contained personal information about the interested parties, namely:
1) data deletion may be required under certain conditions, for example, when the information is inaccurate, inadequate, irrelevant or excessive for the purposes of data processing; Y
2) that the law was not absolute and should be balanced with other pressing rights, such as freedom of expression.
Why is the Google Spain ruling so important?
Because it determines that:
- Google is RESPONSIBLE for the data processing
- The law of the Union and of the Member States is applicable
- We have the right to remove links that contain personal information that is inaccurate, inappropriate, irrelevant or excessive for the purposes of data processing.
Also published on Medium.