The European Court of Justice (ECJ) has ruled that European citizens have a "right to be forgotten" in a landmark case against Google.
The decision by the EU’s supreme court means that companies can be forced to remove personal information from websites if such data is deemed "inadequate, irrelevant or no longer relevant".
Google spokesman Al Verney said: "We are very surprised that it differs so dramatically from the Advocate General’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."
The ruling applies to any company that is established in Europe, meaning that even American companies providing services within the union will have to obey requests to remove links and information if a public interest case cannot be made.
Luca Schiovani, analyst at Ovum, said: "This move may sound reassuring for individuals and their personal freedom; however, it also looks difficult to enforce on a large scale, and may be very disruptive for the functioning of search engines going forward."
"Policy makers in the EU have long advocated for the introduction of a clear "right to be forgotten", which is included in the draft of the new Data Protection regulation under discussion in the EU Parliament and Council. However, these provisions should only apply to the direct controllers of personal data (e.g. a social network complying with the request to fully delete information related to an account); involving search engines for something they are not directly responsible for is likely to entail a burdensome cost, especially if the amount of requests of erasure should escalate in the future."
Content from our partners
Speaking to Reuters, Larry Cohen, a partner at law firm Latham & Watkins, commented: "This will result in added costs for Internet search providers who will have to add to their take-down policies the means for removing links to an individual’s data, and develop criteria for distinguishing public figures from private individuals."
Mario Costeja González filed a complaint with the Spanish data protection agency, AEPD, complaining that when he googled his own name two pages from the Spanish newspaper La Vanguardia appeared, detailing a real-estate auction to recover González’s welfare debts in 1998.
The AEPD dismissed the complaint against the newspaper, but upheld it against Google, requesting that the search engine remove the results. Google subsequently brought actions to the Spanish high court, which referred the case on to the ECJ.
Index on Censorship criticised the move, calling it "a retrograde move that misunderstands the role and responsibility of search engines and the wider internet", calling it "akin to marching into a library and forcing it to pulp books".
Europe is set to update its privacy rules before the end of this year, though a survey conducted by Trend Micro revealed a quarter of IT decision makers did not believe it would be possible to adhere to the rules. The ECJ’s decision adds to burgeoning regulations that could set firms back millions of pounds, euros and dollars in compliance costs and fines.
"Businesses must take responsibility to know what consumer information they hold, where they hold it, and how to destroy or delete it securely," said Christian Toon of data firm Iron Mountain. "It would be advisable to prepare for these demands now before the law compels them to do so."
