Yesterday the European Court of Justice, based in Luxembourg, passed a landmark ruling that has caused a lot of jubilation among data privacy advocates: the Google US and Spain versus the Spanish Agency for Data Protection and a brave Spaniard who sued Google for listing information on his repossessed home in its search results.
It has been hailed as the precedent that will secure individuals the "right to be forgotten" from the internet, if they so wish. Drunken pics of you and your mates on Facebook? Looking for a job? Ask for those photos to be taken down before the HR guy discovers them 30mins before your interview! Sorted! Or is it?
Sifting through the legalese, let's concentrate just on the actual ruling, i.e. Points 1-4 at the very end of the document / webpage. If you don't get distracted by the article numbers and opening and closing paragraphs, the ECJ has actually ruled the following:
1. Article 2(b) and (d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, first, the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d).