Spanish Court Limits Scope Of EU's Right To Be Forgotten

from the more-clarity-needed dept

EU's 'right to be forgotten' is still relatively new -- the original ruling was made less than a year ago. Since then, the EU courts and companies have been trying to work out what it means in practice, which has led to some broadening of its reach. But an interesting court ruling in Spain seems to limit its scope. It concerns the following case, reported here by Stanford's Center for Internet and Society: The claimant was a Spanish citizen who found that when typing his name on Google Search, the results included a link to a blog with information about a crime he had committed many years ago. While the official criminal records had already been cancelled, the information was thus still findable on the internet. The Spanish Data Protection Authority (DPA) made two rulings. One was that Google should remove the information from its search engine, and the other was that Google should remove personally identifiable information from a blog hosted on its Blogger platform. When these decisions were reviewed by Spain's National High Court, it confirmed the first ruling, and clarified that Google needed to remove the link to the criminal records information from its search results. However, it did not confirm the second ruling: The National High Court reversed that and held that the responsible for the processing is not Google but the blog owner. It further held that the DPA cannot order Google to remove the content within a procedure for the protection of the data subject's right to erasure and to object. This is significant, because it says the "controller of the processing" -- a key concept in EU data protection law -- is the blog owner, not Google, and so the latter cannot be forced to take down a blog post. The Center for Internet and Society post notes: Arguably, under the rationale that the platform is not the controller of the processing, other user generated content sites such as YouTube or social networking sites might also fall outside the scope of the right to be forgotten. Well, not entirely outside the scope: presumably, search engines could still be required to remove links to user-generated content, but it would be the creator of that content that would be asked to remove it entirely, not the hosting company. Clearly, further cases will be needed to clarify how exactly this will work in Spain, and whether it applies anywhere else.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community. Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis. While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: blogs, eu, right to be forgotten, search engines, social media, spain

Companies: google