Google Must Delete Search Result Data at Users’ Request If ‘Manifestly Inaccurate’: EU Court

The Google logo at the entrance to the Google offices in London on Jan. 18, 2019. Hannah McKay/Reuters

Privacy advocates have scored a win against Big Tech in a “right to be forgotten” case as the European Union’s top court has ruled that Google must honor requests to delete search result data at the request of people in Europe—as long as they can prove the information is “manifestly inaccurate.”

The Court of Justice of the European Union (CJEU) made the Dec. 8 judgment in a case involving two managers from a group of investment companies who had asked Google to scrub search results linking their names to certain articles that were critical of the group’s investment model.

The executives, who have not been named, argued that the articles made false claims and wanted Google to remove them from search results, according to the CJEU. But the tech giant refused on grounds that it did not know if the information in the articles was accurate or not.

The pair also wanted Google to delete thumbnail photographs of them from a list of results of an image search made on the basis of their names but Google also refused to comply with this request.

The managers sued, and the case was brought before the German Federal Court of Justice, which sought the opinion of the CJEU to interpret the rules in the context of the EU’s strict data privacy directive that governs the right to erasure, often referred to as the “right to be forgotten.”

In its ruling, the CJEU sought to strike a balance between privacy concerns and people’s right to access information.

“The operator of a search engine must de-reference information found in the referenced content where the person requesting de-referencing proves that such information is manifestly inaccurate,” the court said in its ruling.

As a general rule, people’s right to protect their private life and personal data overrides the right of internet users to access the information in question, the CJEU said in a press summary of the ruling.

That balance, however, may depend on the relevant circumstances of each case, in particular on the nature of the information and its sensitivity to the data subject’s private life weighed against the interest of the public in obtaining that information.

‘Right to Be Forgotten’

Privacy rights advocates have clashed with free speech supporters in Europe in recent years over people’s “right to be forgotten” online.

Under the “right to be forgotten” principle of the General Data Protection Regulation (GDPR), people in the EU have the right to ask Google and other search engines to delete links to outdated or embarrassing information about themselves, even if that information is true.

But organizations don’t always have to comply with such requests.

“The right to be forgotten is much more complicated than an individual simply requesting that an organization erase their personal data,” a GDPR fact sheet explains.

For instance, the right to erasure holds if there are significant errors within the data or if the information is being stored unnecessarily.

“But this is not an absolute right,” EU authorities said in the fact sheet.

“If it were, the critics who argue that the right to be forgotten amounts to nothing more than a rewriting of history would be correct. Thus, the GDPR walks a fine line on data erasure,” it added.

Besides inaccuracy and lack of storage necessity, the list of conditions for the “right to be forgotten” to be applied successfully includes a situation in which the organization in question processed that data unlawfully.

Another condition is if the organization is processing personal data for direct marketing purposes and the data subject objects to such processing.

The “right to be forgotten” rule can be trumped under circumstances that include the data being used to “exercise the right of freedom of expression and information” or if the data being processed is necessary for public health purposes. Also in cases where the data comprises “important information that serves the public interest, scientific research, historical research, or statistical purposes,” and its erasure would impair progress toward those goals.

‘Manifest Inaccuracy’

In an opinion accompanying its ruling, the CJEU explained how this “balancing exercise” between free speech and privacy protection is to be applied, with a key condition being information accuracy.

“The tendency of the right to freedom of expression and information to override the right to private life and the right to protection of personal data where the data subject plays a significant role in public life is reversed where it is established that the information covered by the request for de-referencing is untrue,” wrote Giovanni Pitruzzella, an Advocate General at the CJEU.

“In this case, the applicable prevailing criterion, rooted in one of the fundamental values of the European Union, is that of human dignity,” he added.

In a summary of the ruling, the CJEU elaborated on the “manifest inaccuracy” condition.

“Where the person who has made a request for de-referencing submits relevant and sufficient evidence capable of substantiating his or her request and of establishing the manifest inaccuracy of the information found in the referenced content, the operator of the search engine is required to accede to that request,” the court stated.

While the court did not explain in detail how the “relevant and sufficient” criterion should be met, it did say that in cases where the inaccuracy is not obvious, the person requesting the data scrub must bring the matter before a supervisory authority or court for the “necessary checks” to be carried out.

Google said in a statement that it welcomed the decision of the court.

“Since 2014, we’ve worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people’s rights of access to information and privacy,” Google stated.

“The links and thumbnails in question are not available via the web search and image search anymore; the content at issue has been offline for a long time,” the company added.

The “right to be forgotten” received considerable press after a 2014 ruling by the CJEU that set the precedent for the right to erasure.

In that case, a Spanish man, Mario Costeja González, sued Google after the company refused to delete information about an auction notice of his repossessed home.

“I was fighting for the elimination of data that adversely affects people’s honour, dignity and exposes their private lives. Everything that undermines human beings, that’s not freedom of expression,” Gonzalez told the British newspaper The Guardian at the time.

“Like anyone would be when you tell them they’re right, I’m happy,” he said of the ruling, in which the court determined that Google and other such organizations are “data controllers” under the EU’s privacy laws rather than neutral intermediaries and so must comply with rules on processing personal data.