Court of Justice of the European Union Finds Individuals Have a “Right to be Forgotten” Under Data Protection Law

May 14, 2014

Court defines its territorial reach and obliges Google to remove “old” unwanted personal data from web search results

In a landmark ruling on 13 May 2014, the Court of Justice of the European Union (“CJEU”), the EU’s highest court, sitting as a “grand chamber” of 13 judges, found that Google was obliged to remove from its search engine databases the personal data of an individual even though that information was accurate and not “prejudicial.” The decision will have wide-reaching ramifications not only for search engines but also for other businesses operating on the internet.

In short, the CJEU found that Google Inc. (“Google U.S.”):

  • Was subject to Spanish data protection law, despite it being a US company with no direct presence in Spain, because it had a sales and marketing affiliate operating in Spain and the activities of those two entities were sufficiently close;
  • Was “processing” personal data in collecting information containing information about individuals and providing search results in response to searches on names; and
  • Was therefore subject to EU rules on “erasure” and “cessation” of processing, with the result that individuals have the right to require Google to remove personal data about them which is old (even if true) or is otherwise incompatible with European data protection requirements.

The case must also be considered in the light of proposals to enshrine a to-be-defined “Right to be Forgotten” within wider reform of EU data protection law. In its surprising judgment, the CJEU has in effect stated that that right already exists.

Unusually, the CJEU did not follow the advice of its Advocate General, who in 2013 gave an opinion favorable to Google.

Read "Court of Justice of the European Union Finds Individuals Have a “Right to be Forgotten” Under Data Protection Law."