In a landmark decision, the exact consequences of which seem hard to fathom at this stage but will go very far, the European Court of Justice (ECJ) decided that internet search engine operators are responsible for the processing that they carry out of personal data which appear on web pages published by third parties. The case, which involved Google’s ubiquitous search engine, made it clear that search engines are not simply seen as a referencing service to other web content, but they “enable any internet user, when he makes a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet.” The Court observed that “this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty.”
If one combines this decision with the tendency of privacy enforcers in Europe to require “explicit prior consent” from data subjects before their personal data can be processed it becomes clear that Internet search will have to be entirely rethought. But such a rethink will probably apply to the rules as well. In its recent decision on the data retention directive the court based itself on the fundamental right to privacy. Those rights cannot be changed easily if at all, so that decision will be hard to overturn. But today’s decision is different and is based on the EU’s existing Data Protection Directive. That directive can be changed, and what is more, a proposal to replace the directive by a General Data Protection Regulation (GDPR) is going through the two chambers of the EU Legislature. The European Parliament approved its version in March, after having considered more than 4000 amendments. The Council is not yet that far and has identified a number of issues where the member states find it hard to reach a compromise. Today’s ECJ decision will almost certainly lead to calls to amend the proposal and include provisions in the GDPR which undo some of the damage that the decision has done.
Such calls will pit the search engines against the data subjects whose personal data they index and display. But those data subjects are also the users of their services and can hardly imagine going on the internet without the use of their preferred search engine. What is needed now is to find the right balance between users’ legitimate interests in seeing their privacy protected and their desire to be able to easily find relevant information on the internet. Today’s decision has not set that balance; it has given the European legislator the task to find it. According to our own research on what topics are most talked about in light of the elections, we have found that data protection is very important. As the graph below shows, it is especially in the German speaking social media that the subject is very popular. Thus the new European Parliament which will be elected between 22 and 25 May has its duty cut out for it. The Council no longer has the chance to delay things lest it will frustrate Europe’s Digital future and the desires of EU citizens.