The CJEU's Google Spain judgment: failing to balance privacy and freedom of expression

By Steve Peers

The EU’s data protection Directive was adopted in 1995, when the Internet was in its infancy, and most or all Internet household names did not exist. In particular, the first version of the code for Google search engines was first written the following year, and the company was officially founded in September 1998 – shortly before Member States’ deadline to implement the Directive.

Yet, pending the completion of negotiations for a controversial revision of the Directive proposed by the Commission, this legislation remains applicable to the Internet as it has developed since. Many years of controversy as to whether (and if so, how) the Directive applies to key elements of the Web, such as social networks, search engines and cookies have culminated today in the CJEU’s judgment in GoogleSpain, which concerns search engines.

The background to the case, as further explained by Lorna Woods, concerns a Spanish citizen who no longer wanted an old newspaper report on his financial history (concerning social security debts) to be available via Google. Of course, the mere fact that he has brought this legal challenge likely means that that the details of his financial history will become known even more widely – much as many thousands of EU law students have memorised the name of Mr. Stauder, who similarly brought a legal challenge with a view to keeping his financial difficulties private, resulting in the first CJEU judgment on the role of human rights in EU law.

The Court’s judgment

The CJEU addressed four key issues in its judgment: (a) the material scope of the Directive, ie whether it applies to search engines; (b) the territorial scope of the Directive, ie whether it applies to Google Spain, given that the parent company is based in Silicon Valley; (c) the responsibility of search engine operators; and (d) the concept of the ‘right to be forgotten’, ie the right of an individual to insist (in this case) that his or her history be removed from accessibility via a search engine. The details of the Court’s ruling have been summarised by Lorna Woods, but I will repeat some key points here in order to put the following analysis into context.  

Material scope

Does the Directive apply to search engines? The CJEU said yes.  The information at issue was undoubtedly ‘personal data’, and placing it on a website was ‘processing’. A search engine was processing personal data, even though it originated from third parties, because (using the definition in the Directive) it ‘collects’ data from the Internet, then ‘retrieves’, ‘stores’ and ‘discloses’ it. It was irrelevant that the material had been published elsewhere and not altered by Google, as the CJEU had already ruled in the Satamedia case (in the context of tax information published on CD-ROM). Moreover the definition of ‘processing’ does not require that the data be altered.

A second – and perhaps more important point – was whether Google was a ‘controller’ of the data, with the result that it has liability for the data processing.  Again the key issue was Google’s use of data already published elsewhere. The Advocate-General had concluded from this that Google was not a data controller – but the CJEU reached the opposite conclusion. On this point, the Court, ruling that there must be a ‘broad definition of the concept’ of a ‘controller’, distinguished between the original publication of the data and its processing by a search engine: Google undoubtedly controlled the latter activity, by means of its control over the search process. One is unavoidably reminded of the Machiavellian search-engine billionaire who frequently appears on episodes of The Good Wife – although of course he is nothing like the executives of Google.

In particular, the Court ruled that the activities of search engines make information available to people who would not have found it on the original web page, and provides a ‘detailed profile of the data subject’, and so have a much greater impact on the right to privacy than the original website publication.

Territorial scope

Does the Directive apply to search engine companies based in California, with a subsidiary in Spain? The national court suggested three grounds on which this might be the case: the ‘establishment’ in the territory; the ‘use of equipment’ in the territory (as regards crawlers or robots, the possible storage of data and the use of domain names); or the default application of the EU Charter of Fundamental Rights.

The Court found that Google Spain was ‘established’ in the territory, and therefore the data protection Directive, in the form implemented by Spain, applied. It was not necessary to rule on the other possibilities as regards the scope of the Directive, which are very significant in the context of the Internet, so those issues remain open. It should be noted, however, that in light of the objectives of the Directive, the rules on its scope ‘cannot be interpreted restrictively’, and that it had ‘a particularly broad territorial scope’.

Why was Google Spain established there, even though it did not carry out any search engine activities? The CJEU said that it was sufficient that the company carried out advertisingactivities, these being linked to the well-known business model of Google (selling advertising which was relevant to search engine results).

Responsibility of search engine operators

The CJEU ruled that search engine operators are responsible, distinct from the original web page publishers, for removing information on data subjects from search engine results, even where the publication on the original pages might be lawful. It confirmed that the right to demand rectification, erasure or blocking of data did not apply only where the data was inaccurate or inaccurate, but also where the processing was unlawful for any other reason, including non-compliance with any other ground in the Directive relating to data quality or criteria for data processing, or in the context of the right to object to data processing on ‘compelling legitimate grounds’.

This meant that data subjects could request that search engines delete personal data from their search results, and complain to the courts or data protection supervisory authorities if they refused.  As for Article 7(f) of the Directive, which provides that one ground for processing data (where there was no contract, legal obligation, public interest requirement or consent by the data subject) was the ‘legitimate interests of the controller’, this was a case where (as Article 7(f) provides) those interests were ‘overridden’ by the rights of the data subject.

There has to be a balancing of rights in such cases – including the public right to freedom of expression – but in light of the ease of obtaining information on data subjects, and the ‘ubiquitous’ nature of the ‘detailed profile’ that results from search engine results, the huge impact on the right to privacy ‘cannot be justified by merely the economic interest’ of the search engine operator. The public interest in the information was only relevant where the data subject played a role in public life.

In light of the greater impact of search engine results on the right to privacy, search engines are not only subject to a separate application of the balancing test, but a more stringent application of that test – meaning that the information might remain available on the original website, even if it was blocked from the search engine results. The CJEU states that search engines cannot rely on the ‘journalistic’ exception from the Directive.

The ‘right to be forgotten’

Finally, the CJEU accepts the arguments that the Directive’s requirements that personal data must be retained for limited periods, only for as long as it is relevant, amounts to a form of ‘right to be forgotten’ (although the Court does not say that such a right exists as such). While it leaves it to the national court to apply such a right to the facts of this case, the Court clearly guides the national court to the conclusion that the data subject’s rights have been violated.

Comments

The essential problem with this judgment is that the CJEU concerns itself so much with enforcing the right to privacy, that it forgot that other rights are also applicable.

As regards the right to privacy, the Court’s analysis is convincing. Of course, information on a named person’s financial affairs is ‘personal data’, and it has long been established that prior publication is irrelevant in this regard – a particularly important point for search engines. Equally, the Court had previously ruled (convincingly) in the Lindqvist judgment that placing data online is a form of ‘data processing’. 

While it is less obvious that Google is a ‘data controller’, given that it does not control the original publication of the data, the Court’s conclusion that search engines are data controllers is ultimately convincing, given the additional processing that results from the use of a search engine, along with the enormous added value that a search engine brings for anyone who seeks to find that data. In this sense, Google is a victim of its own success.

Similarly, as regards the territorial scope of the Directive, it would be remarkable if Google, having established a subsidiary and domain name in Spain and sought to sell advertising there, would not be regarded as being ‘established’ in that country. The sale of advertising in connection with free searches is, of course, the key element of Google’s business model (leaving aside the many other companies, such as YouTube and Blogger, that Google has acquired over the years), and making money is surely one of the ‘activities’ of any business that aims to make profits.

The separate liability of Google as a ‘data controller’ obviously justifies the Court’s conclusion that it might, in appropriate cases, be required to take down material from its search engine results that infringes the data protection directive. This is most obviously relevant where that data is inaccurate or libellous, but that is not the case here, where the personal data is simply embarrassing.

So, in the absence of another legitimate ground for processing (which will normally be the case as regards search engines), the case ultimately turns on the balancing of interests between the data subject, the search engine and other Internet users. And here is where the Court’s reasoning goes awry.

In its previous judgment in ASNEF, the Court ruled that Spanish law failed to apply the correct balance between data subjects and direct marketing companies, because by banning any use of personal data which was not already public, it implicitly did not give enough weight to the company’s right to carry on a business. But here the Court makes no reference to that right, even though Google’s methods are as central to its business model as the use of private personal data is for direct marketers. Indeed, Google’s highly targeted advertising (not as such an issue in this case) is itself obviously a form of direct marketing.

Also in ASNEF, the Court criticised the Spanish law for its automaticity, because it failed to weigh up the interests of companies and data subjects in individual cases. But in Google Spain, it is the Court which sets out an automatic test: the economic interest of the search engine is overridden if the individual is not a public figure.

The interests of other Internet users are only briefly mentioned, even though Article 7(f) requires only a balancing of interests between not only as between the data controller (ie, the search engine in this case) and the data subject, but also as regards third parties to whom the data are disclosed, ie the general public. Oddly, the Court does not expressly refer to the Charter right to freedom of expression (it’s in Article 11 of the Charter), and does not expressly link its statements about the balancing test to the case law of the European Court of Human Rights on the best way to balance privacy and freedom of expression.

Furthermore, unlike in ASNEF, the Court makes no mention of Article 52 of the Charter (the provision dealing with limitation of Charter rights, including in the interest of protecting other rights, which also requires consistent interpretation with the ECHR). It should also be noted that, in deciding the key freedom of expression issue itself, the Court has departed from its prior approach (in Satamedia and Lindqvist, for instance) of leaving it to the national courts to decide on this issue.

The Court’s dismissal of the journalistic exception also contradicts its willingness to agree, in Satamedia, that merely sending personal tax data by text message to nosy neighbours could constitute ‘journalism’. Here, of course, it is not Google which is the journalist; but Google is a crucial intermediaryfor journalists. If journalism can consist of sending out tax information by text message, it could also equally consist of commenting (for whatever reason, and in whatever forum) on an individual’s past financial problems. And there is no reason why the passage of time should count against the exercise of the right of freedom of expression – although that factor should be relevant, as the Court says, as regards the right to privacy.

Consequences of the judgment

Obviously, today’s judgment only concerns search engines, but it may have broader relevance than that.  Its relevance to social networks will soon be considered in another post on this blog. For search engines, those which are less successful than Google might not have an ‘establishment’ within the meaning of this judgment, which raises the question of whether they would otherwise have an establishment, use equipment on the territory, or can be covered due to the Charter.

More broadly, any non-EU company with a subsidiary selling advertising in an EU Member State in connection with its Internet services must obviously be regarded as covered by the data protection Directive by analogy with this judgment, without prejudice to those broader possibilities.

As for those search engines which do fall within the scope of the judgment, most obviously Google, it seems that their legal obligations are considerably greater than what they had thought them to be. They must respond to individual complaints that the personal data which can be found about that individual is simply too old to be relevant any more, whether it is accurate or not, and they can be challenged before the courts or a supervisory authority if they do not comply.  In fact, an individual could also take action to this end before a supervisory authority.

Could a supervisory authority act of its own motion to enforce this judgment? Probably not, because the rights at issue in this case are triggered by individual complaints. Some people assiduously search Google to see what results they can find on themselves; in this context, I should point out that I am not the same ‘Steve Peers’ from Essex who has been convicted for non-payment of council tax. But others are unaware of, or don’t care about, or couldn’t be bothered to challenge, or are positively thrilled about, the existence of old information about them which can be found by means of using Google.

So not everyone who might conceivably be embarrassed by such old information will complain to Google, but a considerable number are likely to do so. Google’s liability extends to responding to such individuals, but not to completely changing the way it processes personal data in the absence of such complaints. 

Interesting questions may arise, however, as regards the interpretation of the rules set out in the judgment: what exactly is a public figure, and how long has to pass before personal data is no longer relevant? For instance, a job applicant can certainly object to Google if its search results include pictures of her dancing drunkenly on a table in 1998. But she could hardly argue that a record of last night’s debauchery must be 'forgotten'  already - even if she cannot remember it herself. 

Such disputes may well prove an opportunity to argue that the remit of this judgment is narrower than it first appears, or even to request (which any national court can do) that the Court reverse at least some aspects of its judgment. For now, however, the CJEU has established a potentially far-reaching right to be forgotten, with possible significant impacts at least on the activity of search engines. While in the Lindqvist judgment, the Court was keen to ensure that the data protection Directive was adapted to the reality of the Internet, in Google Spain it seems to demand that the Internet should rather be adapted to the Directive. 

As for the initiative to amend the Directive (to be replaced by a general data protection Regulation), this judgment might speed that process up, since Internet companies now have an incentive to use the process as an opportunity to limit their liability compared to what it would otherwise be - rather than (before the judgment) an interest in slowing the process down, in order to avoid an increase in that liability. Time will tell what the result of that negotiation will be.

Barnard & Peers: chapter 9

Read More

Applying the EU Charter of Rights to Member States' internal market derogations

By Steve Peers

Today’s judgment of the Court of Justice of the European Union (CJEU) in Pfleger confirmed an important issue as regards the scope of the EU Charter of Fundamental Rights – but also raised some implicit questions about its added value in such cases.

The case concerned Austrian restrictions on gambling machines. In fact, the CJEU has decided very many cases relating to national restrictions on gambling, an issue which is not regulated by detailed EU legislation but which is nonetheless in principle subject to EU internal market law. Here, the parties challenging the enforcement of the Austrian law raised questions concerning the compliance of that law with the EU Charter, in particular as regards Articles 15 to 17 of the Charter (concerning freedom to conduct an occupation, to run a  business and the right to property) and Article 50 (the prohibition on double jeopardy).

Does the Charter apply?

Article 51 of the Charter limits the scope of its application to EU bodies, and to the Member States ‘only’ when they are ‘implementing’ EU law. At first sight, this rule narrows the established scope of the previous CJEU case law on the scope of human rights protection, which (going back to the 1991 judgment of ERT) had always held that any national derogations from EU free movement rights had to comply with human rights obligations as general principles of EU law. On a strict interpretation, such national derogations could not easily be seen as measures ‘implementing’ EU law, and many academics therefore wondered whether the Charter was narrower in scope than the general principles.

However, last year’s judgment in Fransson confirmed that the scope of the Charter was exactly the same as the scope of the general principles. Logically, it followed that national derogations from free movement rules are within the scope of the Charter, but the Pfleger case was the first opportunity that the Court has had to confirm this.

Comparing internal market rules and the Charter

Despite the importance of this case from a human rights perspective, the main issue in the Pflegerjudgment is the compliance of the national rules with EU internal market law. The CJEU, no doubt exhausted with the amount of litigation on this issue, simply reiterates its prior case law, and asks the national court to apply it to the facts. Also, the CJEU does state that if the national restrictions on gambling do not have any real link to combating crime or social problems, but are simply a means of increasing tax revenue, then this cannot be justified – but it relies on the national court’s findings in this regard.

What does the Charter add to this? On the facts of this case, not very much. According to the CJEU, if the national law restricted internal market freedoms, then it also restricted the economic rights in Articles 15-17 of the Charter. Equally, if it could not be justified under the internal market rules, then it could not be justified as a limitation on Charter rights pursuant to Article 52 of the Charter either.

It should be noted that the Court did not rule that an analysis of the internal market rules in the Treaty would always lead to the same result as the Charter analysis. The ruling expressly concerned ‘circumstances such as those at issue in the main proceedings’. So it is possible to imagine, for instance, that as regards a different aspect of the free movement of services more directly connected to human rights than gambling – broadcasting, for instance – a national restriction might be proportionate from the point of view of the internal market but a questionable restriction of freedom of expression. At the very least, a separate application of the internal market and human rights rules would surely be called for where (for instance) the content of communications is being restricted.

The Court did not touch on the separate question of whether the enforcement (as distinct from the substance) of the national rules needed to be judged from a human rights perspective, noting only that if the national rules breached the Treaty rules on internal market freedoms, they could not be enforced anyway. The Advocate-General’s opinion, in contrast, assumed that if the national rules were substantively in compliance with internal market law and the Charter, the details of their enforcement could still be tested for compliance with the Charter.

Implications of the judgment

While this judgment only concerned national derogations from internal market Treaty freedoms, there is no reason to think that its impact is limited to such cases. There is a lot of EU legislation on different issues which allows Member States to derogate in various ways from its rules, and there is no reason to think that the internal market Treaty provisions are in some way special as regards the scope of application of the Charter.

In particular, as discussed already on this blog, the national derogations from the e-privacy Directive, as regards data retention and other forms of interception of telecommunications, are subject to the Charter, even following the annulment of the data retention Directive. The Court has already examined such national derogations in the context of civil proceedings, and logically should do so as regards criminal proceedings too.


Barnard & Peers: chapter 9, chapter 16

Read More

When can Internet service providers be required to block access to websites?

Steve Peers

First of all, a confession. Until very recently, I had a sneaking (and very unfashionable) sympathy for the holders of intellectual property rights who sought to enforce those rights through heavy-handed injunctions against Internet users or service providers. After all, downloading music et al without paying for it is not really any different from shoplifting a CD. But then the BBC, having announced that the second series of The Bridge would be available on Iplayer for two weeks, curtailed that without warning to one week – leaving me unable to watch the final 20 minutes of the final episode of that series. (Note: this is not an invitation to send me spoilers.) I now have rather more sympathy for those who disdain copyright protection.

This brings us to today’s judgment of the CJEU in UPC Telekabel Wien, the latest ruling of the Court addressing the tension between the interests of copyright holders, on the one hand, and the telecom industry, on the other. The starting point is the EU’s Directive on copyright protection in the information society, which provides that:

‘Member States shall ensure that rightholders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right.’

In this case, two film companies sought an injunction against UPC Telekabel Wien, an Internet service provider, to block access by its customers to a website which offered streaming of the copyright product of the film companies. The Austrian court sent questions to the CJEU to establish whether the relevant rule in the copyright Directive applied in this case, and if so whether the EU’s Charter of Rights prevented the injunction being granted.

This case is the latest in a long line of CJEU judgments on similar issues. First of all, in its 2008 judgment in Promusicae, the Court ruled that EU law did not require Member States to insist that national courts be able to order injunctions against Internet service providers to keep records of their customers’ access to copyright material. But nor did EU law prohibit Member States from doing so. If Member States took up this option, EU law required them to balance the property rights of the right-holders with the data protection rights of individual users of the Internet.

Subsequently, the Court was asked to rule on exactly where that balance lay. In Scarlet Extended, it ruled that it would be a disproportionate breach of the Charter rights to the privacy and freedom of expression of Internet users, and the right to carry on a business of service providers, to order an injunction against the latter to keep records of users’ Internet use indefinitely. However, in Bonnier Audio, it ruled that a much more targeted measure, focussing only keeping records of the users’ access to a particular website where those users were downloading copyright material on a large scale, struck the right balance.

 In today’s judgment, the data protection and privacy rights of the Internet users were not at issue, because there was no element of data retention raised by the proceedings. The Internet users would (if the injunction were granted) simply going to be blocked from accessing the copyright material. So the Charter rights in question were the property rights of the right-holders, on the one hand, and the right to carry on a business of the service provider, and the users’ freedom to receive information, on the other.

The Court first of all ruled that Internet service providers were ‘intermediaries’ for the purposes of the information services copyright Directive. Therefore the right-holders were entitled to apply for an injunction against them. This approach makes sense, as right-holders would hardly be able to enforce their rights in practice if they could not obtain injunctions against service providers.

Next, the Court turned to the Charter issues. In doing so, it provided some useful clarification of the Charter right to carry on a business, which ‘includes, inter alia, the right for any business to be able to freely use, within the limits of its liability for its own acts, the economic, technical and financial resources available to it’. The injunction infringed that right because it ‘constrains its addressee in a manner which restricts the free use of the resources at his disposal because it obliges him to take measures which may represent a significant cost for him, have a considerable impact on the organisation of his activities or require difficult and complex technical solutions’. However, it did not strike at the ‘very substance’ of the right, since it left the service provider free to take different measures and to avoid liability by showing that its steps were reasonable.

As for the freedom of expression, the service provider had to ensure that it ‘strictly targeted’ the actions it took, to ensure that Internet users could still access any information which they had a lawful right to view. Furthermore, in order to enforce that Charter right, Internet users must also have a procedural right to challenge any measure taken by the service provider. However, the service provider nevertheless had to do as much as it reasonably could to limit access to the copyright material.

Comments

The novelty of this case is that there are not just two, but three rights at issue, each held by a different party: the rights holder, the service provider and the Internet users. The service provider is the ‘piggy in the middle’, having to ensure protection of the right-holders’ property rights, as well as the users’ freedom of expression rights, while still being entitled to invoke its own right to carry on a business. While the concept of the right to carry on a business is very broadly defined here, that is counter-balanced by the Court’s reinvocation of its traditional case law making it easy to justify interferences with that right.

Overall, a reasonable balance between the three conflicting rights in this case has been struck by the Court. If it is technically possible to reconcile users’ access to legal information, the service providers’ business interests and the intellectual property rights of the right-holders, this is the ideal solution. Moreover, since a solution of this sort does not involve data retention, it does not infringe upon privacy rights and so it is not possible (or necessary) to bring proceedings against users. In fact, surely data retention is disproportionate when such highly targeted blocking measures can be taken instead. The judgment may not be satisfactory from the perspective of those who dislike the very existence of copyright law, but I still believe that the creators and publishers of music, film and books et al are entitled to a reward for their effort.

In the case of The Bridge, of course, that reward has already been provided for, by means of the payment of British TV-owners’ substantial licence fees to the BBC. So if I happened to download those final 20 minutes of the final episode inadvertently, I would obviously not be betraying my principles.


Barnard & Peers: chapter 9

Read More