Google and Spain wrestle over EU privacy law

Google did battle with Spain's data protection authority in Europe's highest court on Tuesday, in a case with global implications that poses one of the toughest questions of the Internet age: When is information really private?

The issue before the European Court of Justice boils down to this: If a person fails to make social security payments and their house is auctioned as a result, do they have the right to force Google to delete such damaging information from search results?

Behind that question lie complex arguments over freedom of information, the right to protect data, what it means to be a publisher and who ultimately polices the web.

Google argues it should not have to erase lawful content which it did not create from its massive search index.

Spanish officials argue that Google should delete information from its results where an individual's privacy is breached.

Following Tuesday's hearing at the court in Luxembourg, an ECJ advocate-general will publish an opinion on the matter on June 25. The judges are expected to rule by the end of the year.

The case is based on a complaint by a Spanish man who made a Google search of his name and found a newspaper announcement from several years earlier saying a property he owned was up for auction because of non-payment of social security contributions.

One of Spain's top courts, the Audiencia Nacional, upheld his complaint and ruled Google should delete the information from its results. The case was referred to the European Court of Justice in March last year after Google challenged the decision.

Controller or host?
Google said in a blog post on Tuesday that there were "clear societal reasons why this kind of information should be publicly available".

The announcement of property auctioned as part of a legal proceeding was "required under Spanish law and includes factually correct information that is still publicly available on the newspaper's website", said William Echikson, Google's head of free expression for Europe, the Middle East and Africa.

Supporters of Google's stance say if the search giant was made to delete such information it would be a step onto a slippery slope, with demands for all sorts of data to be deleted for reasons - essentially making Google the responsible party.

The European court will try to determine if Google can be considered the "controller", or just a host of information. It will also assess whether a search engine run by a company based in California, such as Google, can be subject to EU privacy law.

Spain's data regulator has said EU judges must consider if European citizens have to go to U.S. courts to exercise their privacy rights and whether Google "is responsible for the damage the diffusion of personal information can cause for citizens".

The case could determine the scope of a draft EU law intended to strengthen citizens' privacy. Rules proposed by the European Commission in 2012 and being debated by the European Parliament would give people "the right to be forgotten" - to have personal data deleted - in particular from the web.

Companies operating on the Internet say such a right should not allow information to be manipulated at the expense of freedom of speech.

Spain, which has had more than 180 similar cases, referred the matter to the EU's highest court to clarify how the EU draft law should be applied, particularly in relation to Google.

It said the outcome of the hearing would be relevant not only in Spain, but in all EU countries.

© Thomson Reuters 2013