Europe court ruling reboots Web privacy rules for Google, others

In a sweeping ruling, Europe’s highest court placed unprecedented power in the hands of consumers to determine what personal information can be displayed in Web search engine results.

The so-called “right to be forgotten” case specifically targeted Google, but legal experts said the decision is likely to affect a broad range of U.S.-based Internet companies, such as Facebook and Wikipedia, that do business in Europe.

Critics of the decision Tuesday say these companies could soon be facing a deluge of consumer requests to scrub embarrassing or old personal information, even if it’s accurate.

The ruling immediately sparked a heated debate between those who hailed it as a landmark victory for consumers’ rights and privacy and those who condemned it as a blow to freedom of speech. The ruling also highlights the cultural differences between Europe and the U.S. when it comes to both issues.

For the moment, the ruling has no direct effect on users in the United States. Observers on both sides of the debate said they would be watching closely to see whether it fundamentally alters the types of content found online and the discussions about privacy in this country.

“I have an optimistic view that it will raise privacy standards not only in Europe, but also in the U.S.,” said Marc Rotenberg, president and executive director of the Electronic Privacy Information Center in Washington. “That would be a positive outcome.”

Google said it was surprised by the ruling, which is final and can’t be appealed.

“This is a disappointing ruling for search engines and online publishers in general,” said Matt Kallman, a Google spokesman. “We are very surprised that it differs so dramatically from the advocate general’s opinion and the warnings and consequences that he spelled out.”

The Court of Justice of the European Union made its ruling in a case filed by a Spanish man who was angry that a search of his name turned up links to an auction notice of his repossessed home posted on the website of a newspaper in 1998.

The man, Costeja González, argued that the debt issue had been resolved and that it shouldn’t haunt him online for the rest of his life. He sued Google, citing EU data protection rules, which are generally stricter than those in the United States.

In its ruling, the court said that if a user searches for his or her name, and the results link to sites that contain personal information about the user, the user may ask the company to remove that information from its results. If the company, such as Google, refuses, the user can “bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.”

In siding against Google, the court upheld the right “to be forgotten” when such personal data “appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purpose for which they were processed and in the light of the time that has elapsed.”

The definition of those terms or the decision about who would be “competent authorities” was not spelled out.

Legal observers said Google and other Internet companies will have to quickly create systems to handle the requests and comply with the ruling. Google already has a system that allows users to request that information be deleted, but the burden to make the case rests with users, and in many instances Google has referred them to the owners of the underlying sites that contain the information.

Now Google must take down the information unless it can make the case that it shouldn’t have to. That means that in the short term, users in different regions of the world may see very different search results in some cases.

“EU data protection rules are much stricter and broader in scope than U.S. privacy rules,” said Pamela Samuelson, a professor at the Berkeley Center for Law and Technology. “So the ruling is not all that surprising. But it obviously complicates the task for search engines of giving folks access to content that’s lawful in most jurisdictions.”

Jeff Rosen, president of the National Constitution Center in Philadelphia, said the decision could make it increasingly difficult for U.S. Internet companies that depend on the collection of data to fuel their advertising-driven businesses to operate in Europe.

He also said that over the next decade, Europe’s strong cultural belief in and legal protection of the right to privacy is likely to be increasingly at odds with the United States’ embrace of freedom of speech. Rosen wondered who would decide whether the years-ago arrest of a politician running for office was still “relevant” or in the public interest, as stated in the ruling.

“This is a big ruling with significant implications for the future of free speech on the Web,” he said. “The standards for removing content are vague and malleable. That’s what makes the decision so alarming.”

Rotenberg, however, said concern about the effect on speech was just people “kicking up dust.” He said the ruling represented an important precedent in giving users more control over their personal information.

“Many users are concerned about the dissemination of their personal information online,” he said. “Google plays a big role in the harvesting of personal data. The court has told the company that it needs to respect people’s privacy.”