We now know the Advocate General's Opinion in the most eagerly followed data protection case in the history of the European Court of Justice (ECJ). After the prolific enforcement actions of the
We now know the Advocate General's Opinion in the most eagerly followed data protection case in the history of the European Court of Justice (ECJ). After the prolific enforcement actions of the Spanish data protection authority to stop Google showing unwanted personal data in search results, their court battles were escalated all the way to the ECJ. Whilst the final decision is still a few months away, the influential Opinion of the Advocate General (AG) is a clear indication of where things are going.
The ultimate question is whether Google, in its capacity as a search engine provider, is legally required to honour individuals' request to block personal data from appearing in search results. For that to be the case, the court will have to answer affirmatively a three-fold legal test:
1. Does EU law apply to Google? The AG's Opinion is YES if the search engine provider has an establishment in a Member State for the purpose of promoting and selling advertising space on the search engine, as that establishment acts as the bridge between the search service and the revenue generated by advertising.
Unfortunately the AG does not deal with the question of whether Google Inc. uses equipment in Spain, so we don't know whether an Internet company with no physical presence in the EU will be caught by EU law.
2. Does a search engine process personal data? The AG's answer here is also YES, because notions of ‘personal data’ and ‘processing’ are sufficiently wide to cover the activities involved in retrieving information sought by users.
3. Is Google a controller of that data? Crucially, the AG's answer is NO, because a search engine is not aware of the existence of a certain defined category of information amounting to personal data. Therefore, Google is not in a position to determine the uses made of that data.
So the conclusion, according to the AG, is that a data protection authority cannot compel Google to stop revealing personal data as part of search results.
In addition, the AG goes on to say that even if the ECJ were to find that internet search engine service providers were responsible as controllers for personal data appearing in search results, an individual would still not have a general ‘right to be forgotten’, as this is not contemplated in the current Directive.
The ultimate question is whether Google, in its capacity as a search engine provider, is legally required to honour individuals' request to block personal data from appearing in search results. For that to be the case, the court will have to answer affirmatively a three-fold legal test:
1. Does EU law apply to Google? The AG's Opinion is YES if the search engine provider has an establishment in a Member State for the purpose of promoting and selling advertising space on the search engine, as that establishment acts as the bridge between the search service and the revenue generated by advertising.
Unfortunately the AG does not deal with the question of whether Google Inc. uses equipment in Spain, so we don't know whether an Internet company with no physical presence in the EU will be caught by EU law.
2. Does a search engine process personal data? The AG's answer here is also YES, because notions of ‘personal data’ and ‘processing’ are sufficiently wide to cover the activities involved in retrieving information sought by users.
3. Is Google a controller of that data? Crucially, the AG's answer is NO, because a search engine is not aware of the existence of a certain defined category of information amounting to personal data. Therefore, Google is not in a position to determine the uses made of that data.
So the conclusion, according to the AG, is that a data protection authority cannot compel Google to stop revealing personal data as part of search results.
In addition, the AG goes on to say that even if the ECJ were to find that internet search engine service providers were responsible as controllers for personal data appearing in search results, an individual would still not have a general ‘right to be forgotten’, as this is not contemplated in the current Directive.