The Court of Justice for the European Union (“CJEU”) issued a judgment in the case Google v. AEPD which has garnered a significant amount of attention. The two primary reasons for this attention (besides it is a case against Google – which usually is newsworthy) are 1) the seeming expansion of EU law into extra-territorial reach, and 2) the recognition of the “Right to be Forgotten”. Several authors have taken it upon themselves to spill quite a bit of ink on this judgment. And, there is some trepidation that business will be negatively impacted in a new and significant way under this judgment. A careful reading of both the Advocate General’s Opinion as well as the CJEU’s judgment in this matter does show how the EU is progressing in the matter of cross-border privacy protections. However, this judgment may not be as far reaching as some commentators have thought.
What the judgment doesn’t mean for businesses going forward
Scope of Judgment
One of the more interesting things that has not been discussed in light of the CJEU’s judgment is the actual applicability to other circumstances. In Common Law jurisdictions (i.e. the US) decisions of judges on substantially similar fact patterns are actually binding on later cases. This is a principle called stare decisis (to stand by that which is settled). The Civil Law jurisdictions do not follow this principle. As a consequence, the judgment in this case is merely “persuasive authority”. It doesn’t govern subsequent cases, and it can be ignored if this Court choses to find the reasoning unpersuasive.
Consequently, the application of this judgment, and any “new” law it purports to develop, should only be applied to Google, and only to the question presented. In other words, the “Right to be Forgotten” (if there is such a right – which I will contest later) applies to Google, and its search service – not necessarily the internet as a whole.
This doesn’t mean that the decision should be ignored. It merely means that the controlling nature of the judgment is not as strong as it would have been had the judgment been handed down by a US (or other Common Law) Court. This is important as it informs how one should look at the scope of the substantive elements of the judgment.
Application of EU Law
For those of us in the US, the application of EU law toward Google isn’t an unreasonable development. In the US, both state and federal Courts may assert “subject matter jurisdiction” over a company that has “minimum contacts” with the forum state, and such assertion of jurisdiction doesn’t offend “traditional notions of fair play and substantial justice”.
Consequently, Americans are used to seeing US law applied to businesses who don’t have their operational function based within the US. The analysis of the CJEU around Google’s activities in Spain (i.e. advertising) support the search business (which it does), and thus providing a jurisdictional nexus in Spain looks a lot like all the US cases which address subject matter jurisdiction US lawyers study in law school.
This shouldn’t be a surprise to we who counsel clients who might be subject to an action in US Courts. And while it is seemingly a stretch under EU law, remember that this is a single case. Similar facts in the future may render a different result. Regardless, it should hardly be seen as a situation which is unmanageable. Common Law attorneys have been managing this for some time.
Right to be Forgotten
Several commentators have intimated that this judgment now enshrines the “right to be forgotten” in EU law. I would caution against this interpretation. First, because the scope of the judgment (as discussed above); and second, because of the actual analysis in the judgment. On this topic it is actually instructive to read the Advocate General’s opinion in conjunction with the judgment. In the Advocate General’s opinion, the idea of an intrinsic right to be forgotten is expressly rejected.
In the usual progression of a case, we would see the Advocate General’s opinion followed by the Court. However, in this instance, the Court did not follow the opinion. Still, what it did do was follow the line of analysis of the Advocate General (at least insofar as what was being opined upon). Both the Advocate General and the Court discussed the individual rights in light of the Article 7(f) balancing test. I have written on this test recently, and it is instructive to see this at work. Much like I said in my earlier post on Article 7(f), this is an individual analysis which allows the Data Controller to balance the interests of the individual against the interests of the Data Controller.
The useful instruction which comes out of this judgment is the baseline that the Court employs. It isn’t that there is a foundational right to be forgotten; it is that “as a general rule” the economic rights of the business are outweighed by the privacy right of the individual. This is a reasonable Article 7(f) analysis – not a new fundamental right. It should be noted that the reason for this “general rule” is based on the facts at issue in the instant case – which leads us to the most interesting position of the Court in this judgment, and the topic of my next post.