EU residents have the “right to be forgotten” online and can ask search engines to delete details about them, Europe’s top court has ruled.

The case originates with Spaniard Mario Costeja González. In 2010 he complained to Spain’s data protection agency, the AEPD, that a Google search of his name turned up notices of a foreclosure auction. The AEPD ordered Google Spain and Google Inc. “to withdraw the data from their index”, according to court documents.

Google appealed to Spain’s national high court, the Audiencia Nacional, arguing the decision amounted to censorship and that Spanish law did not apply to its searches. That tribunal then asked the European Court of Justice in Kirchberg if the data removal order was consistent with the EU’s fundamental right to privacy.

Search engines responsible

On Tuesday, the ECJ said it was, ruling that internet search engine operators are responsible for processing personal data even if the details were originally published on third party websites.

“Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results”, the court said in a statement.

The decision is a stark contrast to the preliminary opinion issued by Niilo Jääskinen, one of the ECJ’s advocate generals, last June. He advised, in a non-binding report, that search engines not be considered “controllers” of third party data and that individuals could not request search engines remove indexed information.

“Increasing number of complaints”

Following this week’s decision, the AEPD stated that “in recent years” it “has had to deal with an increasing number of complaints of citizens who apply for relief against Google following its refusal to accept their demands to stop the dissemination” of contested data.

“We are confident that this ruling marks a turning point in Google’s conduct and that from now on it complies with European data protection legislation and respects the rights of citizens,” the agency’s director, José Luis Rodríguez Álvarez, said in a press statement.

“Today’s court judgement is a clear victory for the protection of personal data of Europeans!” Viviane Reding, European justice commissioner, wrote on her Facebook page. “Companies can no longer hide behind their servers being based in California or anywhere else in the world.”

“This is a disappointing ruling for search engines and online publishers in general,” a Google spokesman told Delano on Wednesday. “We are very surprised that it differs so dramatically from the advocate general’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications.”

“Private censorship”

“This ruling opens the door to large scale private censorship in Europe,” James Waterworth, head of industry group Computer & Communications Industry Association’s Brussels office, said on the organisation’s website.

“It may open the floodgates for tens of thousands of requests to have legal, publicly available information about Europeans taken out of a search index or links removed from websites. A decision about what is and is not in the public interest should be taken by qualified judges, not private censorship departments, which this ruling requires.”

NGOs Index on Censorship and Open Rights Group also spoke out online against the ECJ decision.

The case was number C-131/12 (Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González). The matter now returns to Madrid for final adjudication.