Google judgement causes problems for advertisers, legal expert warns
The Drum sits down with Dr Orla Lynskey, a lecturer in data protection and privacy law at the London School of Economics, to discuss the Google judgment that could mean that users could force the search engine giant to remove information about them from their search listings.
Dr Lynskey teaches privacy law at the London School of Economics
Tuesday’s ruling from the Grand Chamber of the European Court of Justice has been the talk of the town around media, IT and data protection circles. The court ruled that Google was a data processor, subject to EU data protection laws, and therefore could be forced to remove links from its search results that link to irrelevant and outdated personal information.
The case came about after a Spanish lawyer took the search giant to court after it refused to remove links that revealed sensitive financial information which the claimant said appeared outdated and irrelevant to the his personal and current circumstances. The ruling has introduced the confusing concept of the “right to forget” into the mainstream, with critics and academics divided over what the ruling will mean for small businesses and advertising agencies who rely on targeted and behavioural advertising as part of their business models.
Although the court recognised that Google provided substantial benefits for users and could increase free speech and transparency, the court seems keen to remind Google that it did so as long as it gained an economic benefit. Google had originally argued that it had not conducted its search activities in Spain and thus Google Spain was the commercial subsidiary of the parent company endorsing a more “functional” approach to this assessment.
Dr Lynskey wrote in a blog post shortly after the judgement: “The Court is at pains to emphasise that the privacy and data protection implications of processing by a search operator are distinct from and additional to the implications of publishing on a web page. This is because of a search engine’s ability to aggregate information and create a profile and also because it ensures wider dissemination of the data and easier access to it.”
Because the court ruled that Google uses personal data to provide advertising, accordingly any other business that uses personal data to provide advertising, under Section 10 of the Data Protection Act, the right to object to marketing applies. That right is an absolute right.
“Individuals have an automatic right to object to Google regarding direct marketing. While the judgment didn't discuss this right, it is likely that it will get more air time now and be used more frequently in the future.”
Some have questioned whether Google’s business model is sustainable in the current European regulatory environment and Dr Lynskey agrees with this analysis: “The judgment could have a couple of significant implications for business models based on targeted advertising. First, the court has clarified that Google is a data controller in all aspects of its business (ie. when providing search results as well as when providing targeted advertisements) and is therefore subject to the full force of data protection rules.”
“Second, the case hammers home the fact that companies engaged in personal data processing can't escape the reach of EU law simply by placing their servers beyond the borders of the EU.
“This judgment is going to put Google in a difficult position. Under EU data protection rules, individuals can object to the processing of their personal data if it is no longer compatible with the EU data protection rules (for instance, if the information is outdated, no longer necessary or if the individual revokes his consent to the processing).”
“The court has stated that in this situation, as a general rule, data protection and privacy interests should trump the interest of internet users to gain access to this data via Google unless there is some reason why this information is in the public interest.”
“Given this strong steer from the court that data protection should take precedence over access to information, it is possible that Google will operate a default 'notice and take down' system and will be reluctant to consider whether there is a 'public interest' in indexing information which an individual does not want indexed. In the event of dispute, the matter would need to be resolved by a data protection authority in the first instance.
“If there is a territorial link with the EU (as there was in this case through Google's Spanish subsidiary which sold its advertising slots) this will be enough to fall within the scope of the EU data protection rules.”