The European Court of Justice, the highest EU court dealing with various EU treaties and Directives, has established a "right to be forgotten" on the internet. In ruling on a case between a Spaniard and Google, the Court has ordered Google to remove any links to irrelevant or outdated information about them at an individual's request. The court confirmed the individual's right to control their personal data as paramount.
The European Commission proposed a law giving users the "right to be forgotten" in 2012.http://www.bbc.co.uk/...
It would require search engines to edit some searches to make them compliant with the European directive on the protection of personal data.
In its judgement, the court in Luxembourg said people had the right to request information be removed if it appeared to be "inadequate, irrelevant or no longer relevant".
The accompanying press release (.pdf) gives the reasoning.
In today’s judgment, the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results. Those operations, which are referred to
expressly and unconditionally in the directive, must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect.
The Court further holds that the operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing. The Court observes in this regard that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements. This is the only way that the guarantees laid down by the directive will be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.