Google and the right to be forgotten

The Court of Justice’s decision in Google Spain v AEPD  (C-131/12) makes grim reading for Google. It contains two key findings. First, Google’s U.S. search engine operations are subject to Spanish privacy law by virtue of its subsidiary in Spain. Second, Google is subject to a landmark “right to be forgotten”.  

The scope of the “right to be forgotten” is striking. You can ask Google to suppress any result returned on a search against your name that contains your personal data - even if the offending information is still lawfully and publicly available on the underlying website. Moreover, Google must comply with your request unless it can justify retaining that search result, for example because there is a public interest in continuing to make that information available. Why has the Court of Justice favoured privacy so heavily? The most important factor is the “mosaic” effect. A search on Google for your name can reveal data from multiple sources across the internet to produce a structured and invasive profile of your personal, professional and educational history. 

Whether this “right to be forgotten” is specific to search engines or extends to other businesses is unclear, but this development should be watched carefully in some sectors such as credit reference agencies and social media. Of likely wider application is the decision to extend the jurisdictional reach of European privacy laws. This could have serious implications for multinational companies, particularly U.S. tech companies, and may lead to more vigorous enforcement by European privacy regulators. 

Click here for a detailed analysis of the implications of this decision.