ENDitorial: Google Spain vs AEPD – the cup is half full

Judgements from the Court of Justice of the European Union (CJEU) are typically meant to settle debates about European law, not to stir them up. Last week’s judgement on Google versus Spain falls short of this goal. It is definitely groundbreaking and parts of its analysis have a beautiful logic. That Google is a data controller only makes sense, due to the manner which it collects, reuses and (automatically) ranks the data in question.

One can only welcome the Court’s reaffirmation of the almost twenty year old principle that a controller has a responsibility to make sure personal data is correct. From that perspective Google can only blame itself: it would not have ended up with this judgement if it had been more diligent about ensuring that its search results are sufficiently relevant and up to date. This is what its search service is all about, after all.

The judgement is equally logical in its analysis of Google’s claim that it was outside Spanish jurisdiction. The precedent it created may be novel, but was entirely predictable: if it walks like a duck, quacks like a duck, it probably is a duck. Any tech company from outside the EU that has massive EU operations, including operating companies and which clearly targeting services to the EU market should not be surprised when finding itself within the competence of EU Data Protection Authorities.

Matters get quite a bit complicated at the point where the Court ascribes a level of gatekeeper activity to Google Search without even the merest mention of the need to balance privacy with freedom of expression (although an unclear reference to the public interest is made). We can only hope that national courts that asked these prejudicial questions will consider such points. It should be noted, however, that the Court has left the initial decision on complaints entirely in Google’s hands. If national courts do not insist on such a balance, then Google should appeal to the European Court of Human Rights in Strasbourg. Not because we feel that the end result on the material substance of this case is as disastrous for freedom of expression as some commentators have claimed, but that the CJEU’s omission of this essential balance sets a worrisome precedent and makes this judgement a very incomplete one.

The silver lining on this cloud is that Google now has an opportunity to put its money where its mouth is. Unlike take down notices in cases of alleged copyright infringement, where the consequences for intermediaries for taking a common sense approach are so harshly punished by draconian copyright enforcement rules, the data protection environment is benign enough that it should allow Google to take on this challenge without causing chilling effects for the freedom of expression. Google has always claimed to be a champion of freedom of expression. Now is its time to shine and to come up with take-down procedures that are less, for lack of a more polite term, braindead than those it feels forced to employ for copyright claims. Procedures that are transparent, accountable, objective and fair.

Judgement of the court (13.05.2014)
http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=257144

(Contribution by Walter van Holst – EDRi member Vrijschrift – Netherlands)