The EU Court of Justice has upheld the right of individuals to request Google remove personal information about them from its search results. The court found that the EU's privacy directive entails the right to be 'forgotten' if personal information becomes "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed". Only an overriding public interest could justify leaving the information online. Individuals may request Google remove such material based on a search of their name and obtain court orders to force the removal of the personal information.
The case was brought by a Spanish man that sought the removal of an article published in a Spanish paper in early 1998 over the forced sale of his property due to unpaid social security. Google appealed an order from the Spanish data protection agency AEDP to remove the links to the articles from its search results, and the Spanish appeals court asked the EU court for an opinion.
The Court of Justice notably found that search engines fall under the requirements of the EU privacy directive, in the sense that they collect, store, make available and control the processing of personal data, even if this is information already published elsewhere and the information is processed without regard to the content. The Court's advocate general, in its opinion on the case issued in June 2013, had found this not to be the case. According to the court's final decision, if search engines were not subject to the personal data protection rules, the objectives of the directive would be impossible to achieve.
The court also rejected Google's claims that its Spanish subsidiary could not be subject to the data protection rules in Spain, as it is not the entity processing the data - this is done by Google Inc. While Google Inc is established outside the EU, its search activities are intended to promote and sell advertising in the EU state, Spain, so it must still be considered an establishment subject to the privacy directive, the court said.
The ruling sets a precedent for a number of proposed amendments to the EU's privacy directive, such as the right to be forgotten and the extension of the rules to non-EU companies active in the territory. The European Parliament approved in March a preliminary version of a new regulation incorporating the changes, and the full directive will be considered next year by the Parliament and Council.
