The Court of Justice of the European Union (ECJ), in what can be considered as a landmark victory for privacy advocates and individuals alike, made the ruling that an internet search engine operator (in this case Google) is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.
Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results, the ECJ stated in its press release.
I will only highlight certain aspects here which I believe will influence individuals’ privacy rights here in South Africa once the Protection of Personal Act or POPI is in full swing.
Processing
“The Court found, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the directive, must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect.” it further reads.
From a POPI perspective, which is largely based upon the EC Directive on Data Protection, this interpretation might sound warning signals to search engines operating in South Africa, as POPI’s definition of “processing” and can be interpreted is amongst similar lines.
Territory
“As regards the directive’s territorial scope, the Court observes that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an ‘establishment’ within the meaning of the directive. The Court rejects the argument that the processing of personal data by Google Search is not carried out in the context of the activities of that establishment in Spain. The Court holds, in this regard, that where such data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member State, has an establishment in a Member State, the processing is carried out ‘in the context of the activities’ of that establishment, within the meaning of the directive, if the establishment is intended to promote and sell, in the Member State in question, advertising space offered by the search engine in order to make the service offered by the engine profitable.”
From inference drawn, this might then render that Google Search will also be subject to POPI. This interpretation might have follow-on consequences as there has also long been an argument that Google avoids paying local taxes in South Africa, due its territorial setup. This point is however debatable and it is not contended here as fact. Read more here: http://www.fin24.com/Companies/ICT/Google-avoids-SA-taxes-20140211
Balancing of rights
“... inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, the Court holds that a fair balance should be sought in particular between that interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court observes in this regard that, whilst it is true that the data subject’s rights also override, as a general rule, that interest of internet users, this balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life."
POPI has a similar approach and section 2 thereof clearly states that the purpose of the Act is to give effect to the constitutional right to privacy, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations that are aimed at--
(i) balancing the right to privacy against other rights, particularly the right of access to information; and
(ii) protecting important interests, including the free flow of information within the Republic and across international borders
Right to be forgotten
“Finally, in response to the question whether the directive enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time, the Court holds that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. The Court observes in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed. The Court adds that, when appraising such a request made by the data subject in order to oppose the processing carried out by the operator of a search engine, it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.”
POPI can be interpreted to give effect to a similar right to be forgotten under its section 24 which inter alia reads that:
(1) A data subject may, in the prescribed manner, request a responsible party to--
(a) correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or
(b) destroy or delete a record of personal information about the data subject that the responsible party is no longer authorised to retain in terms of section 14.
(2) On receipt of a request in terms of subsection (1) a responsible party must, as soon as reasonably practicable--
(a) correct the information;
(b) destroy or delete the information.
We have some exciting privacy decisions coming our way and the right to have your personal information protected and processed in a responsible and justifiable manner will soon get the attention it deserves. One can only further hope that POPI and the rights associated therewith will also be vigorously enforced.