Spanish court asks ECJ to rule on right to be forgotten lawfulness

The Audiencia Nacional, Spain's top court, wants the ECJ to rule on whether Spanish citizens have the right to request that Google delete the content even if they are not responsible for creating it, according to a report by Reuters.

Under proposed new EU data protection laws drafted by the European Commission, individuals would have a general 'right to be forgotten'. The general right would enable them to force organisations to delete personal data stored about them "without delay". Organisations that have made the data public will be liable for the data published by third parties and will be required to "take all reasonable steps, including technical measures" to inform them to delete the information.

Organisations will be able to oppose the deletion of information if they can show they have a right to publish the data under the fundamental principle of freedom of expression or if it is in the public interest for the data to remain in existence.

Under current EU data protection laws the 'right to be forgotten' does exist in less defined terms in that organisations are generally required only to collect and store personal data that is strictly necessary and proportionate for its purposes. Individuals have the "right to obtain, at his request ... the rectification, erasure or blocking of data which are incomplete, inaccurate or stored in a way incompatible with the legitimate purposes pursued" by organisations that hold their personal data.

"We support the right to be forgotten, and we think there are ways to apply it to intermediaries like search engines in a way that protects both the right to privacy and the right to free expression," a Google spokesman said, according to Reuters.

Both the right to a private life and the right to freedom of expression are guaranteed in the European Convention on Human Rights.

The referral to the ECJ appears to be related to a dispute between the Spanish Government and Google involving the right of individuals to have information deleted about them from the search engine's indexes. Last summer the Spanish Government ordered the internet giant to delete information relating to about 90 individuals.

The individuals all lodged formal complaints with Spain's Data Protection Agency (DPA). In one case a domestic violence victim discovered that her address could be found through Google, whilst one middle aged woman was able to find information about her arrest as a student through the search engine, the New York Times reported at the time.

The E-Commerce Directive protects service providers from liability for material that they neither create nor monitor but simply store or pass on to users of their service. The Directive prohibits member states from requiring that service providers generally monitor user activity in order to police against infringements. The Directive is implemented in the UK by the E-Commerce Regulations.

In a recent statement on how the 'right to be forgotten' would apply to search engines, the European Commission said that only "pure hosting services" that "have no ownership and no responsibility" for content posted by internet users would not be expected to delete information under the proposed regime, according to a report by technology news service ZDNet.

"Information services, including social networking and search engines, may exercise control on the content, conditions and means of processing, thereby acting as data controllers. If and when this is the case, clearly they have to respect related data protection obligations," the Commission said, according to the report.

In a recent blog posting Google privacy lawyer Peter Fleischer said that search engines should only have to update search rankings and help facilitate easier, faster deletion of content rather than delete the material themselves under the proposed 'right to be forgotten' rules.