Source: http://www.husovec.eu/2013/07/some-notes-on-ags-opinion-in-google.html
Timestamp: 2017-03-25 15:34:46
Document Index: 202873756

Matched Legal Cases: ['CJEU ', 'de lege lata', 'CJEU ', 'Art. 22', 'CJEU ', 'CJEU ']

Huťko´s Technology Law Blog: Some Notes on AG's Opinion in Google Spain Case
Some Notes on AG's Opinion in Google Spain Case
Being in almost summer off-mode, I finally found some time to read AG's Opinion in Google Spain C-131/12. I was personally quite surprised to find there many references to eCommerce Directive safe harbors and secondary liability in the data protection law. Here are my notes with relevant passages.
But let me start with super short and superficial recap of what the case is about. Advocate General Jääskinen gives an advice to CJEU on three most important issues: a) territorial applicability of data protections laws, b) position of a search engine operator as a data 'controller' and c) right to be forgotten. He concludes that a) a business model matters when assessing establishment acitivities, b) a search engine operator does 'process' personal data, but is generally not a data 'controller' and that c) de lege lata there is no right to be forgotten.
The AG comes up with some surprising and some interesting arguments (see especially one on notice and take downs).
This is in my opinion plainly wrong reading. Excluding all free access services from the definition is a wrong step. First of all, the services have to be only 'normally provided for remuneration', and secondly, search engines are in fact provided for remuneration (isn't Google one of the richest tech companies after all?). The remuneration is only payed by advertisers who subsidize the service for users, because AdWords as a typical multi-sided market charges different sides of market (users & advertisers) according their valuation for each other. Because advertisers have much stronger valuation for users, Google only charges them and thus subsidizes the service for the users with advertisers money. There are plenty of such examples in the on-line environment (e.g. YouTube, eBay etc.). Hopefully CJEU gets it right in Papasavvas C-291/13 (see my comment here).
I did some Google search and area of secondary liability in data protection law seems to be quite unexplored issue. As European law guarantees a private cause of action for data protection breaches (see Art. 22 of Data Protection Directive "Member States shall provide for the right of every person to a judicial
remedy for any breach of the rights guaranteed him by the national law
applicable to the processing in question."), it might be interesting to see how were these cause of actions implemented in different countries in a broader system of aiding and abetting or even tort of negligence for third party wrongdoing.
77. All parties except for Google and the Greek Government propose an affirmative answer to this question, which might easily be defended as a logical conclusion of a literal and perhaps even teleological interpretation of the Directive, given that the basic definitions of the Directive were formulated in a comprehensive manner in order to cover new developments. In my opinion such an approach would, however, represent a method that completely ignores the fact that when the Directive was drated it was not possible to take into account the emergence of the internet and the various related new phenomena. [..]
The concept of processing of personal information as personal data reminds me of use of a sign as a trade mark. Test which intermediaries in trade mark law also fail to meet according to CJEU.
And what if he learns by means of a notice? Is he a controller then? From the following paragraphs, it seems that knowledge would be only important for secondary liability standards in national law, but not for re-qualification into a controller.
Footnote 62 refers to Opinion 1/2008 on data protection issues related to search engines, 4 April 2008, p. 14 of that states:
The principle of proportionality requires that to the extent that a search engine provider acts purely as an intermediary, it should not be considered to be the principal controller with regard to the content related processing of personal data that is taking place. In this case the principal controllers of personal data are the information providers. The formal, legal and practical control the search engine has over the personal data involved is usually limited to the possibility of removing data from its servers. With regard to the removal of personal data from their index and search results, search engines have sufficient control to consider them as controllers (either alone or jointly with others) in those cases, but the extent to which an obligation to remove or block personal data exists, may depend on the general tort law and liability regulations of the particular Member State. So non-harmonized national tort law standards will determine important obligations. One difference to other search engines might be that they operate on a different basis. As above quoted Opinion states in respect to other services:
This is very interesting "use" of safe harbors. AG is basically using them to point out that certain person should not be the principal addressee of the regulation. It brings me to the question if same line of argument did not in fact lead CJEU in Google France to reject trade mark use by Google when providing AdWords. The idea is to synchronize different applicable laws to ISPs (copyright, trade mark law, data protection law) with idea of the framework of eCommerce Directive. At the same time, the Opinion of Working party states what we already know from the IP law:
The question whether an intermediary should be considered to be the controller itself or a controller jointly with others with regard to a certain processing of personal data is separate from the issue of liability for such processing (16).
(16) In some Member States there are special horizontal exceptions (‘safe harbors’) regarding the liability of search engines (‘information location tools’). The Directive on Electronic Commerce (2000/31/EC) does not contain safe harbors for search engines, but in some Member States such rules have been implemented. [..]
This interpretation of a controller thus partially avoids this issue. 88. The Article 29 Working Party has emphasised that, first and foremost, the purpose of the concept of controller is to determine who is to be responsible for compliance with data protection rules and to allocate this responsibility to the locus of the factual influence. (65) According to the Working Party, ‘[t]he principle of proportionality requires that to the extent that a search engine provider acts purely as an intermediary, it should not be considered as the principal controller with regard to the content related processing of personal data that is taking place. In this case the principal controllers of personal data are the information providers.’ (66)
93. However, with regard to the contents of cache, a decision not to comply with the exclusion codes (71) on a web page entails in my opinion control in the sense of the Directive over such personal data. The same applies in situations where the internet search engine service provider does not update a web page in its cache despite a request received from the website. [my emphasis]
So if Google would not respect robots.txt files or similar technical tools, it will qualify as a controller for its cached content [this however seems to apply to index as well, see para 99]. This is just another example of practice when courts adjust existing law to technical standards. Think of BGH's image search decision Vorschaubilder I., where concept of implied consent (similar to common law concept of bare license) was also constructed around robots.txt. The second case is also interesting. If Google would not update it's cache it won't qualify as a controller unless it receives the request from the website, where personal data originate from. I am wondering what kind of notice is meant here. Because if Google sticks to old cache and a source website removed the data in the meantime, it would mean that natural person have to force the source website to tell this to search engine as well. Interestingly enough, Working party Opinion said something slightly different in the context of cache:
The cache functionality is another way in which a search engine provider may go beyond its role as exclusive intermediary. The retention period of content in a cache should be limited to the time period necessary to address the problem of temporary inaccessibility to the website itself.
Any caching period of personal data contained in indexed websites beyond this necessity of technical availability, should be considered an independent republication. The Working Party holds the provider of such caching functionalities responsible for compliance with data protection laws, in their role as controllers of the personal data contained in the cached publications. In situations where the original publication is altered, for example to remove incorrect personal data, the controller of the cache should immediately comply with any requests to update the cached copy or temporarily block the cached copy until the website has been revisited by the search engine.
Article 7 - Member States shall provide that personal data may be processed only if:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1). 96. As controller, an internet search engine service provider must respect the requirements laid down in Article 6 of the Directive. In particular, the personal data must be adequate, relevant, and not excessive in relation to the purposes for which they are collected, and up to date, but not out dated for the purposes for which they were collected. Moreover, the interests of the ‘controller’, or third parties in whose interest the processing in exercised, and those of the data subject, must be weighed.
So this applies only if Google is a controller, which is if it a) does not respect no-crawling exclusions or b) does not update it's cache upon request from the source website (see para 93). 97. In the main proceedings, the data subject’s claim seeks to remove from Google’s index the indexing of his name and surnames with the URL addresses of the newspaper pages displaying the personal data he is seeking to suppress. Indeed, names of persons are used as search terms, and they are recorded as keywords in search engines’ indexes. Yet, usually a name does not as such suffice for direct identification of a natural person on the internet because globally there are several, even thousands or millions of persons with the same name or combination of a given name(s) and surname. (72) Nevertheless, I assume that in most cases combining a given name and surname as a search term enables the indirect identification of a natural person in the sense of Article 2(a) of the Directive as the search result in a search engine’s index reveals a limited set of links permitting the internet user to distinguish between persons with the same name.
In this paragraph the previous distinction between index and cache (see para 91-93) is removed for compliance with exclusion codes. 100. For these reasons I propose that the Court answers the second group of questions in the sense that under the circumstances specified in the preliminary reference an internet search engine service provider ‘processes’ personal data in the sense of Article 2(b) of the Directive. However, the service provider cannot be considered as ‘controller’ of the processing of such personal data in the sense of Article 2(d) of the Directive with the exception explained above. [..] 133. The particularly complex and difficult constellation of fundamental rights that this case presents prevents justification for reinforcing the data subjects’ legal position under the Directive, and imbuing it with a right to be forgotten. This would entail sacrificing pivotal rights such as freedom of expression and information. I would also discourage the Court from concluding that these conflicting interests could satisfactorily be balanced in individual cases on a case‑by‑case basis, with the judgment to be left to the internet search engine service provider. Such ‘notice and take down procedures’, if required by the Court, are likely either to lead to the automatic withdrawal of links to any objected contents or to an unmanageable number of requests handled by the most popular and important internet search engine service providers. (95) In this context it is necessary to recall that ‘notice and take down procedures’ that appear in the ecommerce Directive 2000/31 relate to unlawful content, but in the context of the case at hand we are faced with a request for suppressing legitimate and legal information that has entered the public sphere.
Do such requests really relate only to unlawful content? I am not sure. Same argument can be made about copyright or defamation notices. 134. In particular, internet search engine service providers should not be saddled with such an obligation. This would entail an interference with the freedom of expression of the publisher of the web page, who would not enjoy adequate legal protection in such a situation, any unregulated ‘notice and take down procedure’ being a private matter between the data subject and the search engine service provider. (96) It would amount to the censuring of his published content by a private party. (97) It is a completely different thing that the States have positive obligations to provide an effective remedy against the publisher infringing the right to private life, which in the context of internet would concern the publisher of the web page.
Again. I am wondering how is this different from the case when search engine is asked to take down links to a website that allegedly infringes upon copyright. Website operator does not have any say about his position in this case as well. No to mention all website blocking orders that I criticized for not properly respecting a right to a fair trial of targeted website operator (things seems to moved however, in the last website block FAPL v BSkyB and others where:
The operator(s) of the Target Website (as defined in the Schedule to this order) and the operators of any other website who claim to be affected by this Order, are to have permission to apply to vary or discharge this Order insofar as it affects such an applicant, any such application to be on notice to all the parties and to be supported by materials setting out and justifying the grounds of the application. Any such application shall clearly indicate the status of the applicant and indicate clearly (supported by evidence) that it is the operator of the website which is the subject of the application.)
To sum up. Google's is not a controller when it comes to it's search results or cache under regular circumstances, but might turn to controller if it a) does not respect no-crawling exclusions of third party websites or if it b) does not update it's cache upon request from the source website. Obligations of an intermediary to remove personal data in situations where it is not a controller depend on fragmented non-harmonized national secondary liability standards. On overall, AG's suggestions seems to be more favorable to Google than Opinion 1/2008 upon which he otherwise extensively relies. Let's see if CJEU follows this suggestions.