The ECJ’s recent judgment in the case of Google Spain SL and Google Inc v AEPD and Mario Costeja González raises serious concerns over the potentially censorial effect of the “right to be forgotten” on search engines.
The applicant, Mr. Gonzaléz, lodged a complaint against Google Spain and Google Inc. in relation to the appearance of an auction notice for his repossessed home among search results based on his name. The case eventually made its way to the ECJ, and in May 2014, the court delivered its ruling.
The ECJ held that, firstly, even if the physical server of a company processing data is located outside Europe, EU rules apply to search engine operators who set up a branch or subsidiary in a Member State, if they promote and sell advertising space, and their activities target people, within a Member State. Secondly, the ECJ held that search engines could constitute “controllers” of personal data within the meaning of the Data Protection Directive (the “Directive”) and, further, that the finding, publishing, indexing, automatic storing and making available to internet users of information placed on the internet by third parties would constitute the “processing” of personal data within the meaning of the Directive. Finally, the ECJ held that, if the conditions in either Article 12(b) or Article 14(a) of the Directive were met, then, upon receipt of a request from a data subject, a search engine must remove from search results based on the data subject’s name links to third party webpages which contain the offending information.
Article 12(b) of the Directive provides that data subjects may obtain from a controller the rectification, erasure or blocking of data the processing of which does not comply with the provisions of the Directive, particularly where data is incomplete or inaccurate. Article 14(a) provides that data subjects may object, on compelling legitimate grounds, to the processing of data relating to a data subject. The ECJ said that these Articles required a balance to be struck between, on the one hand, an applicant’s rights and interests (most importantly, its right to privacy) and, on the other hand, the interests of internet users in having access to the relevant information. As a general rule, the former would override the latter, although the balance could be swayed by factors such as the nature and sensitivity of the information, and whether or not the applicant had a role in public life. Interestingly, the ECJ suggested that these principles may also apply to information which is true, or which was lawfully published, if that information becomes irrelevant, inadequate or excessive over time.
The importance placed by the ECJ on a data subject’s right to privacy in this context is somewhat alarming and, arguably, could have a chilling effect on search engines. As of 18 July 2014, Google received more than 91,000 removal requests involving more than 328,000 URL (including 12,000 requests made under English law). Google confirmed that it removed around 53% of URLs in respect of which removal requests were made. Only 32% of requests were rejected (further information was required in respect of 15% of requests). This is a significant number of removals in a short space of time. Google has indicated that it has put in place procedures for assessing requests; however, smaller search engines may not have such resources at their disposal, and could instead decide to err on the side of caution by immediately removing material without engaging in a proper analysis of the interests that are at stake. If this is the case, then there is a certain truth to the House of Lords’ recent pronouncement that the decision “does not reflect the current state of communications service provision, where global access to detailed personal information has become part of the way of life“.
The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (“Regulations”) came into force on 13 June 2014 and replace the Distance Selling Regulations and the Doorstep Selling Regulations for consumer contracts made on or after that date. The Regulations implement the Consumer Rights Directive aimed at harmonising consumer protection rules across the EU increasing the information that consumers should receive from traders and the rights that consumers have as part of a consumer transaction. The Regulations also introduce the concept of digital content in consumer law.
Subject to certain exceptions the Regulations cover three types of contract:
- “off-premises” contracts where the consumer and trader are, or have been, present together at a location other than the trader’s business premises (for example, the consumer’s home);
- “distance” contracts where the consumer and trader are not present together at a location and the contract is made by distance communication methods such as telephones, email or a website (for example, purchasing goods through a website); and
- “on-premises” contracts where the consumer and trader contract at the trader’s premises.
Whilst the information that is required to be given by the trader varies between the three types of contract, there are some requirements that apply to all contracts within the scope of the Regulations:
- consumers must give express prior consent before additional payments are taken – pre-ticked boxes are no longer allowed;
- where a delivery date is not specifically agreed, goods must be delivered within 30 days;
- a ban on the use of premium rate telephone lines for contacting the trader about an existing contract; and
- a ban on excessive payment surcharges (i.e. charging the consumer excessively for the cost the trader incurs for processing the consumer’s payment).
For on-premises contracts, the Regulations introduce a list of required pre-contract information which includes prices, complaint handling procedures and, for digital content, any applicable technical or hardware requirements. The provision of this information is not required for every day transactions, which are performed immediately or where the information is readily apparent from the context of the contract, for example the price is clearly displayed on the product.
Traders entering into distance and off-premises contracts must provide the information set out in schedule 2 of the Regulations, which is much the same as the information required for on-premises contracts and the information which was required under the Distance Selling Regulations. However, there are some additions such as the requirement to provide any relevant codes of conduct and, more importantly, information about the consumer’s right to cancel the contract.
The right to cancel
A cancellation period of 14 days now applies to both distance and off-premises contracts and runs from the day on which the trader provides to the consumer a valid notice of its right to cancel, regardless of how long this is after the conclusion of the contract. Failure to do so will see the cancellation period extended by up to a further 12 months from the beginning of the initial 14 day cancellation period and, in the case of an off-premises contract, may expose the trader to criminal liability. If a consumer cancels a contract, then typically the goods must be returned within 14 days and traders are now permitted to withhold a refund until this happens. Traders may also deduct an amount from any refund in respect of any diminished value.
The Regulations establish the concept of digital content in English consumer law for the first time and may be the forerunner of legislation distinguishing between contracts for physical and digital goods and services. Where a consumer purchases digital content not on a tangible medium the Regulations stipulate that the supply (the download) must not begin before the end of the 14 day cancellation period unless the consumer gives express consent and acknowledges that they will lose the right to cancellation. Given the inherent attraction of the instantaneous delivery of a digital product it seems unlikely that any consumer would ever withhold such consent.
The Regulations increase the responsibility of traders to fully inform their consumer customers, especially when entering into distance or off-premises contracts. Now could be a prudent time for all traders to assess their existing terms and conditions and practices used when dealing with consumers.