Revolution: that is the term which best represents the sentence’s impact (CJEU, case C-131/12, published on 13th May 2014 by the Grand Chamber), thanks to which, a few months ago, the European Court of Justice literally rewrote the rules concerning the right to be forgotten. Indeed, the decision made by the Grand Chamber of the Luxembourg Court revolutionised the principle for which the web “had worked its fingers to the bone”, that is to say, the mediator’s non-responsibility for the contents they indexed.
In short, up until a few months ago, whoever came across any publication containing their own data (name, surname, any criminal records, photos, videos, previous convictions) on any website, would have known that the only way to exercise the right to be forgotten would have been to submit a request for cancellation to the website owner who had been in charge of the specific publication. It is clear that it was necessary to submit as many requests as the web pages presenting such data.
Instead, the Court of Justice maintained that the search engine is the owner of all personal data indexed on its pages. Therefore, each European citizen who wants to have their own information deleted from the web – by removing the link between one’s name and the website – has to submit only one request to the search engine itself, e.g. Google. The same also happens when the information is correct and it has been published legitimately. If the search engine, after receiving an injunction, does not respect the request, the person involved can take action against it in the court where they live or they can turn to the Data Protection Authority.
Together, we will consider the most common cases. Tom receives a notice of investigation, but he is later exonerated. Dick chains himself up in front of the state-owned tax collection agency Equitalia, because his house has gone into foreclosure, but he collects a retirement fund below the minimum threshold. Harry utters slander against a traffic policeman and is convicted, but a long time has passed since then. These are all common examples of legitimate requests for removing personal data from the Internet. Up until a few months ago, the law firms were crowded with such requests, well aware that they should have sent dozens of injunctions to every website involved. Now, everything has changed. We have started a revolution in the right to be forgotten, which will have a strong influence on Internet service providers like Google. It is not difficult to imagine the plethora of injunctions that will flood Google mail every day: even Santa Claus, who receives plenty of letters, would turn pale!
Obviously, since it is impossible to evade an injunction, a compensation for damages will be claimed. However, if the search engine does not respond to the injunction, the person involved can choose – as an alternative to court – to turn to the Data Protection Authority. In this case, additional problems may arise too, because the Italian Data Protection Authority has always defined itself as unqualified to take care of those requests concerning the right to be forgotten, claiming that they have nothing to do with privacy in the strictest sense.
Drawing a conclusion, although the Court of Justice’s sentence would seem to simplify citizens’ protection on the web, it may cause such complex problems that are difficult to solve, thus leading to the opposite extreme, i.e. a complete lack of protection.
Analysing a specific case will help better understand the situation. A Spanish citizen appealed to the local Data Protection Authority against a newspaper and Google: by typing his name in the search string, the same pages always appeared, presenting a real-estate auction organised after an old foreclosure to his own detriment. The European Court of Justice rejected the appeal against the newspaper, but accepted the one against Google. A search engine’s activity – the Court writes as one of its motivations – can have a strong influence on the fundamental rights to private life and personal data protection. The search engine that indexes the results always has to respect the European privacy directive, in line with its responsibilities, duties and resources.