Europeans win the right to internet amnesia

Should people be allowed to control what information about them appears in Google or Yahoo search results? The highest court in Europe decided Tuesday they should, at least in some cases.

The Court of Justice of the European Union, based in Luxembourg, said search engines like Google must sometimes comply when an individual requests they remove from search results links containing personal information. Under the ruling, a person might be able to demand Google remove a link to an unflattering old newspaper article, for example, or a link to a webpage containing personal family details.

Critics say the court’s decision exalts individual privacy rights over freedom of information. Google said it was “surprised” by the ruling, and was weighing the implications. Other internet search engines like Yahoo and Microsoft’s Bing also will be affected, though it’s not clear exactly how the ruling will play out in individual cases. The decision only applies to Europe, but could widely impact how companies like Google handle requests to delete links.

The ruling came about after Spain asked the EU court to provide guidance for a group of internet privacy cases. One involved a Spanish lawyer who “Googled” himself and found links to an old newspaper notice about his property being up for auction because of an unpaid welfare debt.

The notice was published in a Spanish newspaper in 1998, and the lawyer, Mario Costeja González, argued that since the debt had been settled long ago, the Google link should be removed. The European high court’s decision implies requests like Costeja González’s should be granted—although his particular case will now return to Spanish courts for further review.

The terms of Tuesday’s decision would not require the Spanish newspaper to remove the 1998 property notice from the internet, but would only require Google and other search engines to remove their link to the notice if Costeja González so wished.

Because the original article would still be hosted online, the ruling is not the equivalent of asking a librarian, for example, to remove a book from the library. But it is similar to removing a book listing from the library catalog: The book will become much more difficult to find. That could protect some individuals from search results they believe invade their privacy or harm their reputation—but it could hamstring others who rely on search engines to learn about the reputations of doctors, lawyers, politicians, or other professionals with whom they want to do business.

In another of the Spanish privacy cases, a surgeon from Madrid wanted search result links to a 1991 newspaper story about him removed from Google. The article involved a malpractice lawsuit over an allegedly botched plastic surgery.

The court said a search on a person’s name on a Web indexing service like Google amounts to a personal profile that, under European privacy laws, an individual has the right to control. It rejected the argument that Google was not responsible because it only catalogued information hosted on other websites.

The ruling would be applied on a case-by-case basis, with the goal of balancing privacy and freedom of information. Explaining how Europeans could legally request a link’s removal, the court said people “may address such a request directly to the operator of the search engine … which must then duly examine its merits.” Search engines then must weigh “the legitimate interest of internet users potentially interested in having access to that information” against the right to privacy and protection of personal data.

The individual and the search engine should appeal to a local judge or regulator if they can’t reach an agreement, the court said.

Alejandro Tourino, a Spanish lawyer who specializes in mass media issues, said the ruling was a first of its kind and “quite a blow for Google.”

“This serves as a basis for all members of the European Union,” he said. “It is (a) most important ruling and the first time European authorities have ruled on the ‘right to be forgotten.’”

The European Parliament is still debating a law that would establish the principle of the “right to be forgotten.” The premise is that potentially private information about people should not be allowed to persist on the internet for an indefinite period of time.

Limited forms of the “right to be forgotten” exist in the United States and elsewhere, such as in regulation relating to bankruptcy or to crimes committed by minors. In such cases, the law often requires records to be expunged in some manner.

Tuesday’s case, however, has highlighted differing attitudes toward online information in Europe, where personal privacy takes precedence, and the United States, where many believe freedom of information should trump privacy.

Facebook, a California-based social media company, ran into that conflict in 2011, when German regulators warned its website’s automatic photo-tagging feature ran afoul of European privacy laws, which require that users be allowed to opt in to such features. Facebook required them to opt out. A year later, the company avoided a fine by deleting facial recognition data for all European users.

Critics worry the “right to be forgotten” could force companies like Google to play the role of censor, or allow convicts to delete references to past crimes and allow politicians to airbrush their records.

“We need to take into account individuals’ right to privacy but if search engines are forced to remove links to legitimate content that is already in the public domain but not the content itself, it could lead to online censorship,” said Javier Ruiz, the policy director at Open Rights Group, a London-based digital rights advocate.

Google, based in Mountain View, Calif., currently recommends people who want information removed from search results ask individual websites to take down the original pages, which will disappear from Google search results soon after. On a case-by-case basis, the company may fulfill requests to remove search results that could expose a person to financial fraud, like a social security number or an image of a signature.

But Google will not remove search results for a phone number, address, or date of birth posted online.

The Associated Press contributed to this report.