A ‘right to be forgotten’ by computer databases is already a legal reality in the EU, the Court of Justice of the European Union ruled today.

In a judgment that sent shockwaves across the web industry, it ruled that search-engine giant Google is liable for information about an individual that appears on a third party’s website. 

The case concerned a complaint by a Spanish national Mario Costeja González to his country’s data protection agency about the results thrown up when his name was entered in Google’s search engine. In particular, it would display links to 1998 articles in La Vanguardia newspaper concerning proceedings for the recovery of social security debts.

Costeja González said that the proceedings had been resolved years previously and asked the newspaper, Google Spain and Google Inc to remove or conceal the information.

The data protection agency rejected his complaint against the newspaper, saying that the information had been lawfully published.

However it said the two Google companies should take measures to render access to the data impossible. The companies responded with an action at the Spanish National High Court, which referred a series of questions to the CJEU.

In today’s judgment, the Court of Justice finds that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the 1995 EU data protection directive. 

The court further held that the operator of the search engine is the ‘controller’ in respect of that processing. 

The court said that while a data subject’s rights override, as a general rule, the interest of internet users, this balance may depend on the nature of the information in question and its sensitivity and on the interest of the public in having that information. 

It concluded that even initially lawful processing of accurate data may, in the course of time, become incompatible with the [1995] directive where the data appear to be ‘inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed’.

Jennie Sumpster, senior associate at London firm Schillings, said: 'The ruling has the potential to drastically alter the privacy landscape. It will allow individuals to require search engines, such as Google, to erase or block access to search results about them which are no longer relevant, but may continue to have a significant and detrimental impact on their lives.

‘It is further evidence that as individuals look to alternative ways to protect their privacy and their reputations in an online world, data protection is now leading the way.'

She added that the decision moves towards one of the changes in the proposed new EU Data Protection Regulation, the right of erasure (formerly known as the right to be forgotten). 'It is a surprising departure from the earlier opinion of the Advocate General, but it may be the Grand Chamber has one eye on the new legislation.'

Luca Schiovani of technology analyst Ovum said that the ruling ‘would be difficult to enforce on a large scale, and may be very disruptive for the functioning of search engines’. He warned that placing the duty of erasure on search engines 'is likely to entail a burdensome cost, especially if the amount of requests of erasure should escalate in the future.’