Overview
Since the European Court of Justice (ECJ) startled the Internet sector and world at large last week by its finding in the Google v. AEPD case that there is a “right to be forgotten” under the EU Data Protection Directive, there has been extensive speculation what the decision will mean for Google and other search engines. Search engines will certainly face many requests for deletion of data, and will need to deal with these under somewhat different law in each of the 28 EU member states. We suspect that a practical approach will be developed that will be less burdensome than the worst protections—indeed, Google has announced that it will have a initial proposed approach within “weeks”—but however heavy the burdens, this is a terrible decision for freedom of expression. It seems likely that bad actors with large resources will be those who will benefit most from the decision by being able to hide old, troubling information.
However, I want to focus on this blog not on these direct effects of the decision, but on broader implications in three areas—(1) the ECJ’s holdings on the scope of the Data Protection Directive, (2) the ECJ’s judicial activism and (3) adverse effects on Internet business in Europe.
Scope of Data Protection Directive
On its way to finding a “right to be forgotten,” the ECJ reached two other very important and largely novel conclusions in Google v. AEPD—regarding who is a “data controller” and the extent of jurisdiction over foreign activities.
As to the scope of “data controller,” the court concluded that Google is a data controller with respect to the processing of search data. This makes any of Google’s search activities that involve “personal data" about identifiable individuals subject to data protection law. For example, beyond the data deletion requirement that the ECJ articulated last week, one could imagine a requirement that search results be ensured to be “accurate” under Article 6(1)(d) of the Directive. The mind boggles (or perhaps Googles) at the possibilities.
As to foreign jurisdiction, the search data at issue in Google v. AEPD were processed by US-based Google Inc. in various locations that Google keeps confidential (and which may or may not include EU servers). The Data Protection Directive ordinarily only applies to processing of data within the context of an “establishment” within the EU, so the ECJ chose to find jurisdiction not based on this processing of search data by Google Inc., but on the basis that Google Spain sells advertising targeted at the Spanish market. It is hard to argue with the conclusion that there is a tight business connection between Google Inc. and Google Spain, but this holding is nevertheless rather dramatic. Essentially, it is a partial application of the Data Protection Directive to the data of EU nationals wherever they are processed. Such an extension of the Directive is something that has been debated in the EU Council, Parliament, and Commission in connection with the proposal for a new Data Protection Regulation, but it is not part of EU law at present.
Practical application of this decision on jurisdiction is likely to be difficult, producing various conflicts of law and location. For example, many commentators have assumed that the search results required to be removed under the ECJ decision may still be displayed by Google in the United States and other non-EU markets. But the extension of jurisdiction to Google Inc., combined with the conflation of Google Inc. and Google Spain, seems to suggest that Google could be penalized by Spanish data protection authorities if the results in question are accessible anywhere in the world. This remains to be seen, and decided.
ECJ Activism
In a number of respects, the Google v. AEPD decision is a stunning in its judicial activism. Like the jurisdictional issue discussed above, a proposed “right to be forgotten” has been hotly debated in connection with the proposed new Data Protection Regulation, but until last week very few responsible commentators would have suggested that it already existed under existing EU law. Indeed, the EU’s own Advocate General had argued against the conclusion ultimately reached by the ECJ both on this issue and on the “data controller” issue discussed above.
This finding of rights that do not exist in the written law of the EU remind one of decisions of the US Supreme Court while Earl Warren was Chief Justice, such as the finding of a “penumbra” of US constitutional rights in Griswold v. Connecticut. I personally celebrate the finding of a right to use of birth control in that case, but it was nevertheless a remarkable decision at the time.
Google v. AEPD is not the only recent activist decision of the ECJ in the privacy sphere. Just last month in the Digital Rights Ireland decision, the ECJ found the EU Data Retention Directive invalid. The court concluded that the Data Retention Directive pursued legitimate law enforcement goals, but in a way that provided insufficient protections to satisfy the right of privacy under the Charter of Fundamental Rights of the EU.
Various EU institutions have long taken a more aggressive approach to personal privacy than in the US, and the ECJ appears to be emerging as the most powerful activist defender of this approach—and possibly as an increasingly activist court in other areas. However, the ECJ may discover that there are rights-oriented pitfalls on this course. In Google v. AEPD, as discussed above, the articulated rights also impose significant burdens on free expression. These are burdens that could never be imposed in the United States over the protections of the First Amendment.
Europe as a Location for Internet Business
Another unintended consequence of Google v. AEPD is likely to be reduced investment in Internet businesses in Europe. Put simply, most Internet businesses can be located anywhere, and the significant new restraints on use of data that the ECJ has imposed are likely to be a significant deterrent to choosing Europe as a location.
I spend a lot of my time on investment business, and frequently hear the question why various European hot spots for Internet start-up (London, Berlin, and others) struggle to compete with Silicon Valley in creating great Internet companies. There are various answers to this question, and generally I am a big booster of the prospects for Europe. But it is impossible to see Google v. AEPD as helpful. One wonders whether the ECJ, in its effort to defend the rights of European residents, has in fact dealt them a severe blow by handicapping Europe’s position in the most important growth sector of our century.
