Case C‑131/12, Google and Google Spain v Mario Costeja Gonzales, Protection of personal data, Fundamental rights

Google's responsibility for the protection of personal data

Last Tuesday (13/5) the CJEU ruled in what must be considered a landmark case, concerning the protection of personal data and what responsiblity search engine operators are obliged to take when providing such data to the public. The Court decided that not only is a search engine operator responsible for the information they provide through links, but they can also be obliged to remove the links from its index. The Court's decision open's the door for individuals to bring action against Google for the purpose of removing links to data which they don’t want public.

The issue

The case concerned Mr. Mario Costeja Gonzales, a Spanish national that lodged a complaint with the Spanish Data Protection Agency against La Vanguardia Ediciones (daily newspaper,) on the ground that when an internet user entered Mr Costeja González’s name in Google, he would obtain links to two pages of La Vanguardia’s newspaper on which an announcement mentioning Mr Costeja González’s name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts.

The Data Protection Agency rejected the complaint in relation to the La Vanguardia but upheld it in relation to Google Spain.  The agency argued that it had the competence to require the withdrawal and access to certain data when that data could compromise the fundamental rights of union citizens. This led Google to bring actions against the Agency decision in the National High Court which referred the question to the CJEU. The National High Court's seeked the CJEU to clarify the compatibility of the Agency decision in relation to Directive 95/96 on the protection of individuals, with regard to the processing of personal data and on the free movement of such data, as well as the compatibility with the right to data protection as stipulated in article 8 of the Charter of Fundamental Rights.

Processing and controlling data

The purpose of the Directive 95/96 is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data (art. 1 Directive 95/96).

The CJEU assessed whether the activity a search engine operator conduct's when finding, indexing, storing and providing information which is placed on the internet by a third party, constitutes “processing of personal data”, for the purpose of the Directive 95/96. Likewise, the Court assessed whether the Directive was applicable to an international search engine operator and whether it is possible, falling within the scope of Union law, to impose an obligation on such a search engine operator to withdraw information.

Google argued that the activity was not to be considered “processing of personal data”, asserting that the search engine lacks knowledge and control about the data.  The Court on the other hand, asserted that the search engine automatically, constantly and systematically search for information which it collects and makes available. By referring to the earlier case C-101/01 Lindqvist, where the Court ruled that to place information on the internet is processing personal data, the Court concluded that the activity Google conducts is processing of data in the same sense,  notwithstanding that a third party is responsible for the publication of that data.

In addition, the Court held that since the search engine operator determines the purpose and means of the data it carries out within its own activity, such an operator must also be considered controller and responsible for that process which has the potential of affecting individual fundamental rights.

Applicability and withdrawal

For the matter of whether the Directive is applicable to an international search engine, the court argued that the criteria for applicability, is whether the processing of data is  ‘carried out in the context of the activities’ of an establishment of the controller, on the territory of a Member State. The court held that it does not matter that Googles processing of data is not located in Spain, apparently it was enough that Google Spain has an office in Spain where they advertise and promote Google, to fulfill the criteria “carried out in the context of the activities” .

Considering the last part of the assessment, whether a national agency can oblige Google to withdraw information from its index, the Court argued in relation to articles 7 and 8 of the Charter of Fundamental Rights whereby concluding that an national agency can oblige Google to withdraw information. The Court held that considering the right to private life and protection of data, such an interest of an individual, to protect data, normally outweighs the financial interest of a search engine operator and the public interest to find that data when searching for an individual’s name. However, according to the Court, that could depend and considerations must be made to the nature of the information and the sensitivity for the data subject’s private life. Thus, in reality it comes down to a proportionality assessment by a national athourity, balancing the interest of the public in relation to the interest of the individual.

C‑293/12 and C‑594/12 Digital rights Ireland, Human rights

Validity challenge to the Data Retention Directive

The Case C-293/12 and C-594/12 on the retention of data is probably one of the most interesting and anticipated cases this year and I’ve been meaning to write about it since it was published.The Data Retention Directive has been subject to a lot of political debate and it raises questions about integrity, human rights and state control. The fact the Court invalidated the Directive opens the door for those discussions again and it might be a healthy injection in that debate    

The Directive and fundamental rights

On the 11th of August 2006 Digital Rights Ireland (hereinafter DRI) decided to challenge the validity of the Data Retention Directive (Directive 2006/24) and the transposing national law, in an Irish court. DRI challenged the Irish authorities’ measures concerning the retention of data from a mobile phone DRI had registered on the 3 of June 2006.  At the same time in Austria Mr. Seitlinger and 11 129 other persons, in a group challenge in the Austrian court, brought action against the national law transposing the Data Retention Directive. Both the Irish and the Austrian courts’ decided to halt the proceedings and to refer the cases to the CJEU that ruled on the invalidity of the Directive on the 8th of April.

The purpose of the Data Retention Directive is to harmonize the retention of data so as to prevent and investigate organized crime and terrorist threats. The Directive establishes tools for national authorities to get access to all data of all communication done by all individuals by stipulating rules and obligations for how public communication networks must retain data of electronic communication. The Directive covers practically all electronic communication and it requires the retention of all traffic data concerning fixed telephony, mobile telephony, internet access, e-mail and internet telephony. It covers all subscribers and registered users and according to the Court of Justice of the European Union it entails an interference with the fundamental rights of practically the entire European population (p. 56).

“[The data the communication networks must retain] include data necessary to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment, and to identify the location of mobile communication equipment, data which consist, inter alia, of the name and address of the subscriber or registered user, the calling telephone number, the number called and an IP address for Internet services.” (p. 26)

In the joined challenge brought by the applicants the Court decided to assess the validity of the Directive in the light of the right to respect for private life art. 7 CFREU (the Charter) and the right to protection of personal data in art. 8 of the Charter. Furthermore, the Court held that since the Directive enables national authorities to make specific conclusions of individuals’ life, with the potential consequence of people feeling limited to communicate with technology covered by the Directive, it could also be an infringement of the freedom of expression and information as stipulated in art. 11 of the Charter.

On the compatibility of the Directive in the light of the respect for private life, the Court held that an obligation on communication networks to retain information about peoples’ communication is an infringement of the respect for private life per se. Likewise, the Court held that the way the Directive provides for the processing of data is in breach of the right to protection of personal data. In addition, the fact that information is retained and used without the concerned person’s knowledge and that national authorities have access to that information increases that infringement. Whether the Directive was infringing on rights established by the Charter was clearly not hard for the Court to answer but that in itself however, does not give effect for the annulment of the Directive.

Limitations and justification

Limitations on the rights established by the Charter can be made if those limitations genuinely meet the objectives of a general interest and the limitations are proportionate to that aim art 52(1) of the Charter.

The fight against serious terrorism in order to secure international peace and the fight against serious crime in order to secure public security is such a general interest (see to that effect Kadi and Al Barakaat, Tsakouridis).  Since the purpose of the Directive is to ensure that data are available for the purpose of the investigation, detection and prosecution of serious crime, it fulfills a justification on the basis of that general interest.

Concluding that the limitations satisfies the requirement of a general interest, the Court applied its traditional proportionality test, assessing whether the limitations are appropriate to achieve the aim of the general interest and whether it is necessary to achieve that aim.

The Court argued that even though the limitations are appropriate to achieve the general interest they cannot be considered necessary. The Directive stipulates that all information should be retained, consequently affecting all people within the EU irrespectively of when, where or whether the person concerned actually has a connection to crime. Furthermore, the Directive does not entail any objective criteria for when it is necessary for national authorities to gain access to retained information and it does not provide for any minimum requirements concerning security or safeguards against abuse. Therefore, because of the Directives broad and general application and the absence of security and safeguarding provisions, the Court concluded that the Directive cannot be considered necessary in the sense that it provides for the least violating measures in order to achieve the aim of preventing and investigating serious crime. Since the infringements could not be considered proportionate to the aim of a general interest the Court declared the Directive invalid.

Conclusion

Firstly, it must be noted that the Court’s decision to declare the Directive invalid was not because it infringed of the right to private life and the right to protection of data, rather the annulment was made because those infringements were not considered necessary to the aim of preventing and investigating serious crime. That is an indication by the Court that the retention of data can be used by member states and justified in relation to fundamental rights granted by the Charter, if the measures are less general and provide for safeguards concerning the processing of the data.

Secondly, what is quite controversial about this judgment is that the Court identifies the ambition to prevent serious crime as the purpose of the Directive. This is contrary to a previous validity challenge brought by Ireland in 2009 (see to that effect C-301/06 Ireland v The Council and the Parliament).  In that case the Irish government claimed that the Directive should have been enacted with another article than art. 114 TFEU as legal ground and to support their argument they held that the purpose of the Directive was to prevent serious crime. The court however, held that the purpose of the Directive was to harmonize how telecom providers retain information and consequently rejected the Irish claim. This raises question about how to define the purpose of a directive but also what the decision could have been if the Court’s proportionality test had been applied to the purpose defined by the Court in 2009.

Thirdly, from a Swedish perspective the judgment has had some interesting effects. Several swedish communication networks has stopped retaining data and Swedish Post and Telecom Authority, the authority responsible for enforcing the directive, has stopped with all actions based on the Data Retention Directive, despite that the transposing national law is still valid from a constitutional perspective. While that might be good from a human rights perspective it is also troubling since it precludes the possibility of challenging the validity of the Swedish law in relation to the Charter in a preliminary ruling.

Lastly, according to EU-commissioner Cecilia Malmström, the 3 million Euro that Sweden got in a fine in May last year (see to that effect case C-270/11), for not implementing the Data Retention Directive in time, will be repaid.