Europe vouches for Web privacy

SAN FRANCISCO — In a sweeping ruling, Europe’s highest court placed unprecedented power in the hands of consumers to determine what personal information can be displayed in Web search-engine results.

The so-called “right to be forgotten” case specifically was aimed at Google, but legal experts said the decision is likely to affect a broad range of U.S.-based Internet companies, such as Facebook and Wikipedia, that do business in Europe.

Critics of last week’s decision say those companies could soon be facing a deluge of consumer requests to scrub embarrassing or old personal information, even if it’s accurate.

The ruling immediately sparked a heated debate between those who hailed it as a landmark victory for consumers’ rights and privacy and

See

Page

those who condemned it as a blow to freedom of speech. For the moment, the ruling has no direct effect on users in the United States. Observers on both sides of the debate said they would be watching closely to see whether it fundamentally alters the types of content found online and the discussions about privacy in this country.

“I have an optimistic view that it will raise privacy standards not only in Europe, but also in the U.S.,” said Marc Rotenberg, president and executive director of the Electronic Privacy Information Center in Washington. “That would be a positive outcome.”

Google said it was surprised by the ruling, which is final and cannot be appealed.

“This is a disappointing ruling for search engines and online publishers in general,” said Matt Kallman, a Google spokesman. “We are very surprised that it differs so dramatically from the advocate general’s opinion and the warnings and consequences that he spelled out.”

The Court of Justice of the European Union made its ruling in a case filed by a Spanish man who was angry that a search of his name turned up links to an auction notice of his repossessed home posted on the website of a newspaper in 1998.

The man, Costeja Gonzalez, argued that the debt issue had been resolved and that it shouldn’t haunt him online for the rest of his life. He sued Google, citing EU data-protection rules, which are generally stricter than those in the United States.

In its ruling, the court said that if a user searches for his or her name and the results link to sites that contain personal information about the user, the user may ask the company to remove that information from its results. If the company, such as Google, refuses, the user can “bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.”

In siding against Google, the court upheld the right “to be forgotten” when such personal data “appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purpose for which they were processed and in the light of the time that has elapsed.”

Legal observers said Google and other Internet companies will have to quickly create systems to handle the requests and comply with the ruling. Google already has a system that allows users to request that information be deleted, but the burden to make the case rests with users, and in many instances Google has referred them to the owners of the underlying sites that contain the information.