Google Must Honor Requests to Delete Some Links, EU Court Says

BRUSSELS - The highest court in the European Union decided on Tuesday that Google must grant users of its search engine a right to delete links about themselves in some cases, including links to legal records.

The decision by the European Court of Justice in Luxembourg is a blow for Google, which has sought to avoid the obligation to remove links when requested by European users of its service.

By ruling that an Internet company like Google must comply with European privacy laws when operating in the European Union - a consumer market of about 550 million people - the court is indicating that such companies must operate in a fundamentally different way than they do in the United States.

Instead of operating as a single around-the-world, around-the-clock forum for other people's information, Google - and potentially companies like Facebook and probably Twitter - would need in the 28 European Union countries to become more actively involved in refereeing complaints from users about information carried online. The companies would assume the responsibility and cost for removing that information if requested to do so by national data officials on behalf of people raising complaints.

'This sounds like a landmark judgment,'' said Peter Hustinx, a top European Union official for data protection. 'The court is saying that Google isn't just selling adverts in Europe, but is providing content along with those services. If you are a regular citizen, it gives you a remedy anywhere in Europe for you to ask companies to take down content connected to you.''

The ruling comes as momentum builds in Europe to adopt an even more far-reaching privacy law already under negotiation by lawmakers that includes a tougher so-called right to be forgotten, or 'erasure' as it is termed in draft legislation, that also would apply to companies like Facebook.

The judgment on Tuesday was based on a data protection law from 1995 that provides limited rights to object to the processing of personal information and to demand its erasure in certain situations.

The court decided that there were cases in which a company like Google should allow online users to be 'forgotten' after a certain time by erasing links to web pages 'unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public.'

It ruled that companies like Google could be 'obliged to remove links to web pages' even when the original 'publication in itself on those pages is lawful,' according to a summary of the judgment.

In what appeared to be an endorsement of the aggressive approach to privacy protection in Europe in the digital age, the court said in its summary that 'the effect of the interference with the person's rights is heightened on account of the important role played by the Internet and search engines in modern society.'

Favoring companies like Google in such circumstances, the court said, could not 'be justified by merely the economic interest which the operator of the engine has in the data processing.'

Al Verney, a spokesman for Google, said in a statement that the decision was 'a disappointing ruling for search engines and online publishers in general,' and that the company would 'take time' to analyze the implications. Google was 'very surprised' that the judgment 'differs so dramatically' from a preliminary ruling by the court last year that mostly went in the company's favor, he said.

The judgment on Tuesday reversed what had seemed a preliminary victory for Google in June 2013, when an adviser to the court, Niilo Jaaskinen, issued an opinion implying that Google did not need to remove the links.

Because the European Court of Justice is the highest court in the European Union, Google cannot appeal Tuesday's decision.​

Even as the European authorities feted a victory for their strict approach to online privacy protection, legal experts asked whether the drive by Brussels to introduce a tougher law was still necessary after such a sweeping ruling by the court.

'Most surprising is that the court has come down firmly in favor of a 'right to be forgotten,' ' said Richard Cumbley, a London-based partner at the law firm Linklaters. 'Given that the E.U. has spent two years debating this right as part of the reform of E.U. privacy legislation, it is ironic that the E.C.J. has found it already exists in such a striking manner,' he said, referring to the European Court of Justice.

But Mina Andreeva, a spokeswoman for the European Commission, the administrative arm of the European Union, told a news conference on Tuesday afternoon that incorporating the ruling into new legislation was still necessary.

The legislation, Ms. Andreeva said, would make it clear that a right to be forgotten is available to European users whose data was carried by non-European companies - even those companies that do not have a physical presence, like a computer server, in Europe. The new rules would also put an obligation on companies, rather than users as is currently the case, to prove whether data were still needed to be kept online. 'Today, it's up to consumers to prove this, but this is not very easy or effective,' she said. 'We have reversed the burden of proof.'

The case began in 2009 when Mario Costeja, a lawyer, objected that entering his name in Google's search engine led to legal notices dating back to 1998 in an online version of a Spanish newspaper that detailed his accumulated debts and the forced sale of his property.

Mr. Costeja said that the debt issues had been resolved many years earlier and were no longer relevant.

When the newspaper that had published the information, La Vanguardia, refused to remove the notices, and when Google refused to expunge the links, Mr. Costeja complained to the Spanish Data Protection Agency that his rights to the protection of his personal data were being violated.

The Spanish authority ordered Google to remove the links in July 2010, but it did not impose any order on La Vanguardia.

Google challenged the order, and the National High Court of Spain referred the case to the European court for advice on how to rule.

In his advisory conclusion, which the European court did not end up following, Mr. Jaaskinen had concluded that because Google merely aggregated information on the web and was a 'processor'' of information and not a 'controller' of it - the company was not the legal entity that must comply with the provision of the law in question. Mr. Jaaskinen also said that the 1995 law guaranteed a right to be forgotten only in cases where information was incomplete or inaccurate, which was not at issue in the Spanish case.

But the court deemed otherwise on Tuesday, ruling that Google is a controller of information - a distinction that, according to the court, means Google must comply with European privacy rules when operating in Europe.

​ ​