The Limits of the Freedom of Expression
In its ruling of May 13, 2014, the Court of Justice of the European Union (CJEU) holds that:
1. A search engine processes personal data because it collects, retrieves, records, organizes and stores on its servers personal data, and then discloses and makes available the same personal data in the form of lists of results;
2. The search engine is a controller because it determines the purposes and means of the processing;
3. If the processing is carried out within the context of the activities of an establishment located in the EU, the directive applies; in other words, the factual linkage between the activities carried out in the EU, and the processing of the data, is the relevant criterion, regardless of the location of certain or all parts of the processing; and
4. The right to be forgotten can be exercised via the right of erasure of personal data (art. 12(b) of the directive 95/46) when the data does not answer the principles relating to data quality (e.g., the principle that they have to be adequate, relevant and not excessive), and via the right to object (art. 14(a) of the directive 95/46) to the processing of personal data at any time based on compelling, legitimate interest.
Concerning this last point, the court also links these rights to the right to “privacy” and insists that, in certain occurrences, the right of erasure or the right to object would be ineffective when the balance of interest between freedom of expression and privacy favors freedom of expression. In other words, the CJEU invoked the existing case law of the European Court of Human Rights, which in a number of cases already has balanced the tensions that may exist between freedom of expression and privacy.
See also: No “Right to Be Forgotten” Says Advocate General of CJEU