Google ruling will affect SA too
Landmark judgment on protecting people’s privacy
IN today’s modern digital age, can a data subject ever hope to have a so-called right to be forgotten?
In the first major ruling of its kind, the European Court of Justice paved the way this week for such a right by opening the door for data subjects to compel Google to prevent information about them appearing in its search engine.
The case was instituted by Costeja Gonzalez against a newspaper, as well as Google Inc and Google Spain.
He complained that when a user entered his name in Google’s search engine, the person would obtain links to pages of the Spanish newspaper from 1998 referring to attachment proceedings against him for the recovery of debts. He asked that personal data relating to him be removed or concealed because the matter had been resolved and the references were now irrelevant.
The regulator dismissed the complaint against the newspaper, but upheld the complaint against Google. Google appealed to the high court, which referred the case to the European Court of Justice.
It is a landmark decision, set to have far-reaching consequences not only for search engines like Google, but also for internet publishers generally.
The court held that, in principle, a person has a right to have personal information removed from the list of Google results if the information is no longer accurate and there is no good reason for it to remain available online
Although practically it is now for the Spanish high court to implement this recommen- dation, the indication from the court of justice is clear: Gonzalez has a right to have his past misdeeds forgotten.
The decision obviously has no binding effect on South Africa. But it will offer useful guidance on how our Protection of Personal Information Act will likely be applied once it is brought into force, especially because of the substantial similarity between the EU data-protection laws and the Protection of Personal Information Act.
There are several important implications of the Google decision. First, the court was satisfied it had the power to make such a recommendation, even though Google is based in the US and not Europe.
The court’s view was that even though Google Spain did not perform any role in the search function, it was still an establishment of Google Inc and the activities of the two were inextricably linked.
The finding opens the door for South Africans to seek recourse against not only South African search engines (or other responsible parties), but also South Africa-based entities of international search engines.
Second, the court ruled that in exploring the internet au-
The data subject has a right to have past misdeeds forgotten
tomatically, constantly and systematically, a search engine fell within the definition of “processing” in terms of the data-protection laws (as it would under South Africa’s new laws). This was despite the fact that the information was not altered by Google.
The court then reached the conclusion that Google was a “controller” of this data (or a “responsible party”, under the South African act) because it determined the purposes and means of the processing.
It is significant that the Spanish court gave these terms a broad interpretation, looking at the main objective of the law to ensure the complete protection of someone’s right to privacy.
Having decided that Google was an operator, it followed that it was also required to comply with all the obligations imposed on an operator under the data-protection laws.
This included the requirement that personal information be processed fairly and lawfully, be collected for a specific, explicit and legitimate purpose, and be kept for no longer than necessary for the purposes for which it was collected.
The crux of this judgment is that when it is found that a search engine displays results that are inadequate, irrelevant or excessive in relation to the purpose for which it was collected, and in light of the time that has lapsed (even if the information remains true), that information and links must be erased.
Here, the right to privacy overrides the economic interests of the operator of the search engine, as well as the legitimate interests other internet users may have in this information. (Interestingly, the court did note that this may not always be the case, such as when the person is a public figure.)
South Africa’s act imposes similar obligations on responsible parties. The flip side is that a person has a right to request that his personal information be corrected or destroyed. The case is an extreme example of how far data-protection laws may go in protecting people’s privacy. It highlights what South African companies and the public sector are about to experience — the ball is now in the data subject’s court.