Search engines can be made to remove irrelevant or excessive personal information from their results, Europe's top court ruled today.
The European Court of Justice (ECJ) upheld the complaint of a Spanish man who objected to the fact that Google searches on his name threw up links to a 1998 newspaper article about the repossession of his home.
Judges at the Luxembourg-based court, the highest court in the EU, said Google can be required to remove data that is "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed”.
The ECJ said the rights of people whose privacy has been infringed outweighed the general public interest, but Google said it was disappointed with the ruling, which contradicted a non-binding opinion from the ECJ's court adviser last year that said deleting sensitive information from search results would interfere with freedom of expression.
"We are very surprised that it differs so dramatically from the Advocate General's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications," said Google spokesman Al Verney.
Google has appealed to the ECJ after losing in the Spanish courts when the country’s data protection authority, AEPD, ordered it to remove certain links to information about individuals from its search results. AEPD said the test case was one of 220 similar ones in Spain whose complainants want Google to delete their personal information from the Web.
"We are very satisfied that there is an end now to the ferocious resistance shown by the search engine to comply with the resolutions of the Spanish data protection agency in this matter," a spokeswoman for the agency said.
The decision creates both technical challenges and potential extra costs for companies like Google and Facebook, but the ruling will likely only benefit ordinary people and not public figures, said Larry Cohen, a partner at law firm Latham & Watkins.
"The ruling will help certain people hide their past, making it difficult to access certain information, but not when it concerns public figures, or people in whom there is a genuine public interest," he said.
"This will result in added costs for Internet search providers who will have to add to their take-down policies the means for removing links to an individual's data, and develop criteria for distinguishing public figures from private individuals.”
The European Commission proposed in 2012 that people should have the "right to be forgotten" on the Internet though this was watered down by the European Parliament last year in favour of a "right to erasure" of specific information.
The proposal needs the blessing of the 28 European Union governments before it can become law and Google, Facebook and other Internet companies have lobbied against such plans, worried about the extra costs.
European Justice Commissioner Viviane Reding said that the court ruling vindicated EU efforts to toughen up privacy rules.
"Companies can no longer hide behind their servers being based in California or anywhere else in the world," she said on her Facebook page, calling the judgment a "strong tailwind" for data protection reform.