Google may be ordered to remove personal information from its search engine after the European Union's top court paved the way for citizens to have a "right to be forgotten."
"Links and information in the list of results must be erased" where a person's fundamental rights are harmed by the posting of personal information online and where there is no public interest in publishing it, the EU Court of Justice said in a statement on a ruling today.
A person may ask search-engine owners to remove personal information and can ask a court or a data-protection authority to step in if the company refuses, the Luxembourg-based tribunal ruled. The court said Google both processes and controls personal data and must abide by EU law.
The ruling is the latest data-protection blow to Google, which faces privacy investigations around the world as it adds services and steps up competition with Facebook for users and advertisers.
The company was fined 1 million euros in Italy last month over privacy violations by its Street View cars, which photographed people across the country without their knowledge.
It's "a very loud wake-up call" to all businesses that gather and store consumer data, said Mark Brown, director of information security at Ernst & Young in London. Many companies may be "quaking in their boots at the thought of responding to a consumer 'right to be forgotten' request" as they may not know what data they are holding, he said.
Google said the decision was "disappointing" for search engines and online publishers, said Al Verney, a spokesman for the company in Brussels. The operator of the world's largest search engine now needs to analyse the implications, he said.
The court's ruling violates the right to freedom of expression because it "opens the door to anyone who wants to whitewash their personal history" even if the information is true and factual and the original source material remains unaltered, said the Index on Censorship, a London-based group that promotes freedom of expression worldwide.
A Spanish court sought advice from the EU's top court for Google's challenge to an order by the Spanish data-protection authority for it to remove information on a man whose house was auctioned off for failing to pay taxes, one of 200 instances where Spain has asked Google to pull content.
Newspaper La Vanguardia published the information in the case in 1998 and years later it could still be found through a Google search.
The ruling sets out a so-called "right to be forgotten" that the European Commission proposed in 2012 as part of an overhaul of data-protection rules that may be finalised later this year. Today's decision is binding on courts across the 28-nation bloc.
The case should mark "a turning point for Google's behaviour," said Jose Luis Rodriguez Alvarez, the head of Spain's Data Protection Agency, in an emailed statement. Google has "consistently challenged" the Spanish authority which has had to deal with an increasing number of complaints over the company's refusal to remove personal information, the agency said.
Mina Andreeva, a spokeswoman for the commission, said regulators welcomed the court's finding that EU data-protection law applies to Google and other search engines operating in Europe.