Google’s search engine subject to EU data protection laws

The Court of Justice of the European Union has ruled that citizens have a right to request that Google delete their data from search results. In a case involving Google Spain, the court rules that although US-based, the search engine is the data controller for the processing, as Google Spain is a subsidiary of Google Inc. on Spanish territory. It is therefore, an ‘establishment’ within the meaning of the EU Data Protection Directive.

Google is responsible for the processing of personal data that it carries out which appear on web pages published by third parties. Data subjects may approach the operator directly and, contact Data Protection Authorities if their request is not met.

London-based data protection lawyer, Eduardo Ustaran, told PL&B what this means for search engines in general: “First they are regarded as being responsible for processing personal data irrespective of whether they are aware of the nature of the information. Secondly, search engines will now need to take steps and decide whether each request for erasure should be honoured.”

“This decision confirms that under the current directive, there is a 'right to be forgotten' that can be applied in relation to search engine results, except for those cases where the interest in keeping that information available prevails. This decision could have very serious implications for the way in which we all access information on the Internet."