While most people have focused on the free speech and implementation difficulties of the “right to be forgotten” in Google Spain SL, Google Inc. v. Agencia Espanola de Proteccion de Datos (Mario Costeja González), there are serious jurisdictional implications for the Internet, intermediaries and content publishers that largely have been ignored. In the decision, the European Court of Justice (ECJ) went against Google Inc., and its U.S.-based “Search” service, which it found to be subject to the EU Privacy Directive and subject to the jurisdiction of the Spanish courts and the Spanish Data Protection Authority (DPA), at least for privacy complaints related to search.
Most U.S.-based Internet companies have cooperated voluntarily with EU investigations and court cases while denying that jurisdiction exists, meanwhile using subsidiaries operating in the EU for limited roles, such as selling advertising or operating data centers. The ECJ opinion eviscerates the separate corporate entity doctrine and treats Google as a single operating unit for purposes of the Privacy Directive and, at least, the Search service. The potential far-reaching implications of this case are that the logic of the opinion will apply more broadly to all advertising services offered by U.S.-based Internet services.
More, most commentators seem to think that blocking search results on Google.es will be a sufficient response to the decision, perhaps thinking that anything more will require extraterritorial application of the Spanish law. But nothing in the ECJ opinion suggests any such limitation. To the contrary, it is not extraterritorial to apply local law against a controller deemed to have an establishment within the territory. If a search engine operator is subject to the jurisdiction of the court or DPA, then it can be ordered to block search results based on Mr. González’s name globally. It is censorious in the extreme, giving one local DPA global data control without regard to the law of the land where the search engine is incorporated or operates.
The parent-subsidiary distinction no longer matters for jurisdiction over privacy complaints—it is the corporate group taken as a whole that the courts and DPAs will look to: “the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed.”
So when Mr. González now seeks to be forgotten, what will happen if an advertising-based, non-EU search engine operator fails to remove the links to the bad debt article on all domains? The Spanish DPA or Spanish courts may prosecute the operator in the local courts and issue an order that it comply with the request. The operator, if it fails to appear and defend, have a judgment entered against it that can be enforced in the operator’s home country. Then we will see how a conflict-of-laws analysis plays out, especially if the action is brought in the United States where the First Amendment’s free speech rights will squarely meet state-sponsored censorship.
The ramifications of the decision are not likely to be limited to search engine operators. The same logic the ECJ used to create jurisdiction can be applied to find that blog hosting companies, social media and other intermediaries are controllers with establishments in the EU. Will an EU court or DPA require removal of user-generated content that violates the Privacy Directive? Perhaps not, given that the user’s speech rights will be implicated by such a decision. But it is another thing to say that the hosting company will be permitted to process the data and advertise around it or return search results on its own site or affiliated properties.
Applicable law and notions of jurisdiction are closely tied together in EU jurisprudence, so one might view the ECJ decision as limited to privacy issues. But other agencies with enforcement powers may look at jurisdiction differently now. For example, law enforcement agencies may now view controllers with an establishment in the territory for privacy purposes as enough to seek to require disclosure of personal information of EU users.
Some intermediaries or platforms may be able to distinguish themselves from Google’s operations based on factual differences. For example, if there is no subsidiary in the country, there is not likely to be an establishment in the country. The ECJ also found a few more facts to be important:
- There is a local version of Search adapted to the national language and offered through a website using a national domain; e.g., google.es.
- Google’s search engine is widely used by residents;
- Indexing of websites takes place automatically and is stored temporarily on servers whose location is unknown—proof that no data is stored in the country may be useful.
- Advertising is associated with search terms, and advertising pays the freight for the free search service; and
- The in-country subsidiary acts “as a commercial agent” for the out-of-country parent by promoting, facilitating and effecting the sale of advertising.
How far the DPA will reach in applying the local law remains to be seen. The right to be forgotten is only one aspect of data privacy law in the EU, but it is one of the most controversial. Much more attention is likely to be paid to the clash between the First Amendment in the United States and the censoring impact of the ECJ decision in the EU, but the enduring nature of the jurisdictional decision may have a much more far-reaching impact.