The CJEU’s judgment against Google has been hailed as a “Landmark Ruling“. I agree that this judgment is a landmark ruling – however, not for the reason everyone else is making it out to be. As noted earlier, the “Right to be Forgotten” isn’t really in the holding of the judgment. Further, the “long-arm” application of EU law isn’t something new (at least to US attorneys). What is new is the reason for allowing a right of deletion against a search engine and not the underlying publisher of the original facts.
What the Judgment does Mean
Search Engines as Data Brokers
For anyone who has been following the privacy debates for any length of time, the topic of Big Data, and data brokers has been front and center for some time. The big challenge for those of us in the industry, is how do you define “data broker”? Is it a company that generates profiles on individuals? If that is the case, then banks, your doctor, loyalty programs at grocery stores, and software companies will all be considered “data brokers”. In point of fact, I doubt that there would be a single business out there that couldn’t be considered a data broker using that definition. Obviously, this isn’t workable.
What is so instructive about the CJEU’s judgment in the Google case (and the reason that the judgment is truly a landmark judgment) is the reasons it uses to describe Google as a Data Controller.
Google argues in this case that it should not be considered a Data Controller. The argument goes something like: “we can’t be a data controller because all we do is index and direct traffic to the actual publishers.” Google argues that it doesn’t actually determine how the data gets processes – it just tracks how someone else determines processing. While not a bad argument, it seems to ignore the underlying concern that the Court has with businesses like Google.
The Court’s judgment states in pertinent part:
…that processing enables any internet user to obtain… a structured overview of the information relating to that individual that can be found on the internet – information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty…
This observation also is the basis for the justification of applying the deletion right to the search engine and not the underlying publisher of the prejudicial fact. The newspaper doesn’t have the capability to connect other sources of data with the newspaper’s data. It is this capability of multi-source, multi-variant interconnectivity which forms the basis of the Court’s reason for applying the deletion right against Google. Further, the Court notes that Google is paid for doing this kind of interconnectivity – via advertising dollars (which is also the justification for asserting jurisdiction over Google when the only activity directly undertaken in Spain is the sales of advertising).
I would offer that, while not coming out and saying this is what a data broker is, the CJEU’s judgment in the instant case is going to guide how other courts, and potentially regulators, view business models that make their money on data. It was one thing for a newspaper to publish data about an individual related to one aspect of his life. It is a completely different thing for a search engine to interconnect data related to all aspects of an individual’s life – and to then refuse any control over the interconnectivity to the individual. While an argument can be made that there is very little data about one’s self that we actually “own” (in the legal sense); there is no dispute that controlling how data about us interacts with other data about us in the on-line ecosystem is an individual’s right.