Can a Search Engine be "Private by Default"?

While the consequences of the Google Spain judgement of the Court of Justice of the European Union (CJEU, decision of 13.5.2014 - C-131/12, Google v. AEPD) are still being discussed, there can be no doubt that the judgement shows how interwoven the issues of data protection and freedom of expression are. When communication becomes more and more digital, any question of privacy online immediately raises the question of the limits to the freedom of communication and information.

Privacy as Regulatory Flipside of Communication

Any regulation of privacy is, by necessity, a regulation of communication. In the on-going process towards new rules for data protection the question how far the free flow of communication can and should be limited has, unfortunately, been neglected. The CJEU judgement will hopefully be a wake-up call for Europe reminding us how we will unwillingly draw boundaries to information and communication when we overreach ourselves in our efforts to protect online privacy.

Approach by CJEU

According to the CJEU, a search engine needs to be "private by default". Privacy rights "override, as a general rule," the freedom of information:

In the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life. [CJEU, decision of 13.5.2014 - C-131/12 (Google v. AEPD), para 81 (emphasis not in the original)]

The judgement is based on existing European data protection law!

Repercussions on EU Data Protection Reform

In the on-going reform process, it is now up to the European legislator to decide whether "privacy by default" should remain the guiding principle for search engines:

"Privacy by default" will encourage politicians, celebrities and other public figures to put their lawyers on track when they find inconvenient information online. And as the use of a search engine like Google is essential for finding information, the elimination from the results of search engines will provide a convenient and essential tool to surpress information.

It remains to be hoped that the European legislator will amend the reform drafts in an effort to:

• strike a better balance between privacy and the freedom of information and
• protect online communication more efficiently.