Even if you are not a lawyer, you must have heard about the so called “right to be forgotten.” You may know that it is a privacy right that allows you to demand removal of your personal information from web search results produced by a search engine and published on the Internet. The question is who is obligated to remove your personal data from the Internet upon your request. The answer is simple – the operator of that search engine, even if it is not located in your country of residence. For some mysterious reason, this simple answer does not appear to be clear to everyone.
Recent cases in several EU Member States have revolved around the question of who can be a respondent in a dispute about removing name search results from the Internet. Why is that even a question? If somebody borrows your book and does not give it back, who will you demand your book from? This is not a trick question – from the person who has borrowed and still has it. If somebody publishes a translation of your book without your permission, who will you sue for a copyright violation? That publisher, of course, even if it is established and operates in another country. In such cases, as a rule, you would have to go to court in that foreign country. However, if you want your name removed from the search results published on the Internet by a search engine operated by a foreign operator, you can do that before the competent authorities in your own country of residence, in accordance with your national law. And that is the bottom line of the Costeja Judgement.
The term “right to be forgotten” was coined and elaborated upon in the Judgment of the Court of Justice of the European Union in Case C-131/12 Google Spain SL and Google Inc. vs the Spanish Data Protection Authority and Mr. Mario Costeja González. The Court determined that Google Inc. USA, as the operator of Google Web Search engine, may be subject to the jurisdiction of Spain as regards the processing of personal data of the Spanish citizen, Mr. Costeja Gonzalez, in connection with displaying of his name search results on the Internet. The Court decided that the fact that there was a Google-affiliated company registered and operating in Spain, Google Spain SL (which performed no personal data processing activities in the relevant context), was sufficient basis for Mr. Costeja Gonzalez, as a Spanish citizen, to enforce his right to privacy against Google Inc., an American company, before the Spanish competent Data Protection Authority under Spanish data protection law, although Google Inc. would otherwise have been outside the territorial reach of Spanish law and jurisdiction.
The Court of Justice determined that an affiliated company of a foreign search engine operator established and operating in a Member State is deemed a sufficient establishment for the purpose of extending the jurisdiction of that Member State and the application of its data protection laws to that foreign operator, even if that local affiliate does not perform any data processing operations for that foreign operator. This means that a foreign company may be reported to the national Data Protection Authority or may be sued in a national court to have personal data removed from the Internet. The role of the local affiliate can be imagined as a bridge between the foreign operator and the national law and jurisdiction. However, such a role does not make the local affiliate responsible for the activities of the foreign operator. The local company neither operates the search engine nor processes personal data. Hence, it will be unable to remove name search results from the Internet.
In conclusion, in the Costeja Judgment, the Court of Justice clarified the following four main points in the Judgment: (i) an operator of a web search engine processes personal data as a data controller; (ii) an affiliated company established by such a foreign operator in an EU Member State is considered an establishment of that foreign operator in that Member State sufficient for data protection purposes; (iii) European citizens may require that the foreign search engine operator remove their personal data from the name-based search results published on the Internet and may enforce this right before competent authorities in their own country, under their national laws; and (iv) a removal request may be declined, if the public interest to have access to that information prevails.
By Olena Manuilenko, Head of IP & TMT, Divjak Topic & Bahtijarevic
This Article was originally published in Issue 4.2 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.
