The long awaited decision in the so called “Google Spain” (CJEU case C-131/12) is in, with a smash.

The court, contrary to AG JÄÄSKINEN, considers search engines to be data controllers that process personal data in view of the Data Protection Directive 95/46/EC. As such, they are obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, even when its publication in itself on those pages is lawful, IF the interests of the data subject to have the result removed outweighs public interests of retaining the results. As a rule, the interests of the data subject not only override the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.

This decision provides individuals legal means to have their data removed from search engines. It does not create a blanket order and takedown right (or obligation for search engines to take dawn data) because the search engine will have still have to balance the interests. The interests of Google and the general public, however, have lost weight in this balance.

This is an important win for individuals. All is not lost for privacy.

The Observer’s John Naughton on the sobering story of Janet Vertesi‘s attempts to conceal her pregnancy from the forces of online marketers.

Even more sobering, though, are the implications of Professor Vertesi’s decision to use Tor as a way of ensuring the anonymity of her web-browsing activities. She had a perfectly reasonable reason for doing this – to ensure that, as a mother-to-be, she was not tracked and targeted by online marketers.

But we know from the Snowden disclosures and other sources that Tor users are automatically regarded with suspicion by the NSA et al on the grounds that people who do not wish to leave a digital trail are obviously up to no good. The same goes for people who encrypt their emails.

This is why the industry response to protests about tracking is so inadequate. The market will fix the problem, the companies say, because if people don’t like being tracked then they can opt not to be. But the Vertesi experiment shows that if you take measures to avoid being tracked, then you increase the probability that you will be. Which is truly Kafkaesque.

On 8 April 2014, the Court of Justice of the European Union has declared the Data Retention Directive (2006/24/EC) invalid.

The Court, in a very comprehensive judgment, has ruled that the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality by adopting the Data Retention Directive.
The retention of traffic data may be appropriate for attaining the objectives of fighting serious crime and terrorism, “but the wide-ranging and particularly serious interference of the directive with the fundamental rights at issue are not sufficiently circumscribed to ensure that that interference is actually limited to what is strictly necessary”.

1. The directive covers all individuals, all means of electronic communication, and all traffic data without any differentiation, limitation or exception.

2. The directive fails to lay down any objective criterion that the data can only be accessed for the intended purposes by by the competent authorities.

3. The blanket retention period (to be decided on a member state basis between 6 months and 24 months) is incompatible with the notion of data minimization (only retain what is strictly necessary).

4. There are insufficient safeguards against abuse and unlawful access to the data.

5. The directive fails to require the data to be retained within the EU, and hence effective oversight by an independent EU authority is not guaranteed.

Source Press Release no 54/14, Luxembourg, 8 April 2014