Right to be forgotten and global delisting: some news from Spain – Miquel Peguera

21 12 2017

In a recent ruling, the Spanish Audiencia Nacional – the high court that referred the Google Spain case to the Court of Justice of the European Union (“CJEU”) – has somehow expressed opposition against imposing global delisting obligations on search engines.

The debate about global delisting is a well-known one. May search engines be required to delist results globally based on EU data protection laws? This would mean removing the data not only from the European versions of the search engine’s website but also from any other version, including those under the .com domain and any non-European country-code domain. The CJEU didn’t expressly address this question in its 2014 Google Spain judgment, which recognized the so-called right to be forgotten. The French Data Protection Authority, the CNIL, strongly supports the view that removals must be global. Last July, the French highest administrative court, the Conseil d’Étatasked the CJEU for clarification on this point, and an answer is expected in the coming months.

In Spain, the Data Protection Authority seems to follow a more cautious approach. It appears to accept that it would be enough for the search engine to block access to the contested results by means of IP geo-blocking in searches carried out, in any domain, from computers located in Spain.

The Spanish Audiencia Nacional (“AN”) has now ruled in a case where a Paraguayan citizen requests the delisting of some links to information published in Paraguay. In December 2015, the Spanish DPA dismissed the claim on the grounds that the claimant is not an EU citizen, nor a resident of any EU Member State, and that he lacks any relevant link to the EU. The claimant appealed the decision before the AN, explicitly requiring the world-wide delisting of the search results. In its ruling – delivered on October 31st and not yet publicly reported –, the AN dismisses the appeal and upholds the DPA decision.

The claimant contended that, since data protection is recognized in the EU Charter of Fundamental Rights, the Data Protection Directive, and thus the right to be forgotten, must apply to any citizen, even to those lacking any relationship with the EU. To that effect, the claimant pointed to the Guidelines on the implementation of the Google Spain ruling, issued by the Art. 29 Working Party (WP29).

On the one hand, the Guidelines favor global delisting (though it is not clear if geo-blocking might suffice):

“20. Although concrete solutions may vary depending on the internal organization and structure of search engines, de-listing decisions must be implemented in a way that guarantees the effective and complete protection of these rights and that EU law cannot be easily circumvented. In that sense, limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the judgment. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com.”

On the other hand, the Guidelines limit “in practice” the right to be forgotten to data subjects with clear links with the EU:

“19. Article 8 of the EU Charter of Fundamental Rights, to which the ruling explicitly refers in a number of paragraphs, recognizes the right to data protection to “everyone”. In practice, DPAs will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State.”

The AN is not particularly clear in its ruling. It mixes the discussion about global delisting with that about claimant’s standing. While the reason for dismissing the appeal was the lack of standing for not having links with the EU, the AN does include some dicta that might reveal its opposition to global delisting obligations. But again, I find even those dicta hardly conclusive.

The AN states that it cannot accept either the claimant’s view that the protection covers any citizen in any country or his interpretation of the Guidelines in the sense that the protection must be carried out globally. This is the closest reference to rejecting the global delisting approach. To support that stance, the court says that while the Guidelines accepted delisting in the .com, that was in a case where the claimant was a European citizen, and that the Guidelines did not mean that the blocking should affect users of the search engine outside the territorial scope of competence. By “users” the court seems to mean data subjects, that is, affected individuals requesting the removal. So much for the opposition to global delisting. The argument of the court is again that the territorial scope of the Directive excludes the admissibility of claims where the claimant lacks relevant links with the EU. (It certainly does not discuss whether a claim from a non-EU citizen could be acceptable if the initial processing — that carried out by the newspapers — had taken place in the EU, as this was not the case before it).

The AN moves on to say that this is the interpretation followed by all European DPAs, and points to a decision by the Spanish DPA, which purportedly acknowledges that the Guidelines only encompass searches carried out in Spain (or in an EU Member State, for that matter). Here the AN probably tries to convey that, in that decision, the Spanish DPA was only concerned about ensuring that the contested results can’t be easily accessed in searches carried out in Spain. The implication would be that the protection should not extend to searches carried out in other countries, such as in Paraguay, which was clearly the aim of the claimant.

The AN then states that holding otherwise (which now seems to mean granting protection for searches carried out outside the EU) would entail a clear interference in the sovereignty of other States, which would run afoul of International Law — an argument that can be interpreted as dicta against global delisting, as it appears to mean that the DPA can’t order the removal on a non-European version of the search engine.

Summing up, the ruling is far from being clear regarding of global delisting, even though it may reflect the court’s reluctance to impose global obligations. We should wait for a case where the claimant is a citizen of the EU and see whether, in that scenario, the AN clearly rejects the imposition of global removal. In any event, the discussion may be moot in a few months, when the CJEU hands down its judgment on the CNIL v Google case.

This post originally appeared on the Center for Internet and Society blog and is reproduced with permission and thanks.


Actions

Information

One response

22 12 2017
subversivefreak

Interesting one. Wonder if a Spanish national can enforce their right in the UK on .UK domains after Brexit

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.




%d bloggers like this: