International Commercial Law Blog

A landmark in a long battle over European Union privacy laws

Advocate General’s Opinion in Case C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González considers that search engine service providers are not responsible, on the basis of the Data Protection Directive, for personal data appearing on web pages they process.

In early 1998, a newspaper widely circulated in Spain published in its printed edition two announcements concerning a real-estate auction connected with attachment proceedings prompted by social security debts. A person was mentioned as the owner. At a later date an electronic version of the newspaper was made available online by its publisher.

In November 2009 this person contacted the publisher of the newspaper asserting that, when his name and surnames were entered in the Google search engine, a reference appeared linking to pages of the newspaper with these announcements. He argued that the proceedings had been concluded and resolved many years earlier and were now of no relevance. The publisher replied that erasure of his data was not appropriate, given that the publication was effected by order of the Spanish Ministry of Labour and Social Affairs.

In February 2010, he contacted Google Spain and requested that the search results show no links to the newspaper when his name and surnames were entered into Google search engine. Google Spain forwarded the request to Google Inc., whose registered office is in California, United States, taking the view that the latter was the undertaking providing the internet search service.

Thereafter he lodged a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) against the publisher and Google. By a decision on 30 July 2010, the Director of the AEPD upheld the complaint against Google Spain and Google Inc., calling on them to withdraw the data from their index and to render future access to them impossible. The complaint against the publisher was rejected, however, because publication of the data in the press was legally justified. Google Inc. and Google Spain have brought two appeals before the Audiencia Nacional (National High Court, Spain), seeking annulment of the AEPD decision. In this context, this Spanish court has referred a series of questions to the Court of Justice.

In today’s Opinion, Advocate General Niilo Jääskinen addresses first the question of the territorial scope of the application of national data protection legislation. The primary factor that gives rise to its application is the processing of personal data carried out in the context of the activities of an establishment of the controller (according to the Data Protection Directive, the “controller” is the person or body which alone or jointly with others determines the purposes and means of the processing of personal data) on the territory of the Member State. However, Google claims that no processing of personal data relating to its search engine takes place in Spain. Google Spain acts merely as commercial representative of Google for its advertising functions. In this capacity it has taken responsibility for the processing of personal data relating to its Spanish advertising customers.

The Advocate General considers that this question should be examined taking into account the business model of internet search engine providers. This normally relies on keyword advertising which is the source of income and the reason for the provision of a free information location tool. The entity in charge of keyword advertising is linked to the internet search engine. This entity needs a presence on national advertising markets and that is why Google has established subsidiaries in many Member States. Hence, in his view, it must be considered that an establishment processes personal data if it is linked to a service involved in selling targeted advertising to inhabitants of a Member State, even if the technical data processing operations are situated in other Member States or third countries. Therefore, Mr Jääskinen proposes that the Court declare that processing of personal data takes place within the context of a controller’s establishment and, therefore, that national data protection legislation is applicable to a search engine provider when it sets up in a Member State, for the promotion and sale of advertising space on the search engine, an office which orientates its activity towards the inhabitants of that State.

Secondly, as for the legal position of Google as an internet search engine provider, Mr Jääskinen recalls that, when the Directive was adopted in 1995, the Internet and search engines were new phenomena and their current development was not foreseen by the Community legislator. He takes the view that Google is not generally to be considered as a “controller” of the personal data appearing on web pages it processes, who, according to the Directive, would be responsible for compliance with data protection rules. In effect, provision of an information location tool does not imply any control over the content included on third party web pages. It does not even enable the internet search engine provider to distinguish between personal data in the sense of the Directive, which relates to an identifiable living natural person, and other data. In his opinion, the internet search engine provider cannot in law or in fact fulfil the obligations of the controller provided in the Directive in relation to personal data on source web pages hosted on third party servers.

Therefore, a national data protection authority cannot require an internet search engine service provider to withdraw information from its index except in cases where this service provider has not complied with the exclusion codes or where a request emanating from a website regarding an update of cache memory has not been complied with. This scenario does not seem pertinent in the present case. A possible “notice and take down procedure” concerning links to source web pages with illegal or inappropriate content is a matter for national civil liability law based on grounds other than data protection.

Thirdly, the Directive does not establish a general “right to be forgotten”. Such a right cannot therefore be invoked against search engine service providers on the basis of the Directive, even when it is interpreted in accordance with the Charter of Fundamental Rights of the European Union (in particular, the rights of respect for private and family life under Article 7 and protection of personal data under Article 8 versus freedom of expression and information under Article 11 and freedom to conduct a business under Article 16).

The rights to rectification, erasure and blocking of data provided in the Directive concern data whose processing does not comply with the provisions of the Directive, in particular because of the incomplete or inaccurate nature of the data. This does not seem to be the case in the current proceedings.

The Directive also grants any person the right to object at any time, on compelling legitimate grounds relating to his particular situation, to the processing of data relating to him, save as otherwise provided by national legislation. However, the Advocate General considers that a subjective preference alone does not amount to a compelling legitimate ground and thus the Directive does not entitle a person to restrict or terminate dissemination of personal data that he considers to be harmful or contrary to his interests.

It is possible that the secondary liability of the search engine service providers under national law may lead to duties amounting to blocking access to third party websites with illegal content such as web pages infringing intellectual property rights or displaying libellous or criminal information. In contrast, requesting search engine service providers to suppress legitimate and legal information that has entered the public domain would entail an interference with the freedom of expression of the publisher of the web page. In his view, it would amount to censorship of his published content by a private party.

ICC releases revised International Code of Direct Selling

Since 1937, when the first Code of Advertising Practice was issued, ICC has produced, and successively revised, global sets of ethical rules, covering all main marketing disciplines. The ICC Code of Direct Selling forms part of that comprehensive ICC normative system.

In 2006 many of the marketing codes were consolidated into one document, the Consolidated ICC Code of Advertising and Marketing Communication Practice, revised in 2011. As direct selling is primarily a method of distribution, the Direct Selling Code remains a stand-alone document; however, by reference it is clearly linked to the Consolidated Code, which is the recognized global reference point for responsible marketing communications.

The ICC Code of Direct Selling was first published in 1978 and followed the already then well-established ICC policy of promoting high standards of ethics in marketing via self-regulatory codes, intended to complement the existing frameworks of national and international law.

Like its predecessor (2007), this edition has been developed in close co-operation with the World Federation of Direct Selling Associations (WFDSA). That has ensured the Code is based on the best available expertise, and kept apace with changes in practice and direct selling techniques. The WFDSA has also adopted a world code of conduct applicable exclusively to members of direct selling associations. There is conformity in substance between the ICC Code and the industry code. The ICC Code is to be followed by all involved in direct selling.

Direct selling, as defined by the ICC Code, “refers to the selling of products directly to consumers, generally in their homes or the homes of others, at their workplace and other places away from permanent retail locations, where the direct seller may explain or demonstrate products.

The Direct Selling Code is an instrument for self-discipline, but may also be used by the courts as a reference document within the framework of applicable legislation. The ICC Code is also able to fill in the gap in countries which have not created direct selling laws.

The Direct Selling Code spells out responsible conduct towards consumers, such as the credo not to exploit a consumer’s age, that product demonstrations should be complete with regard to price and also covers recruitment practices in the direct selling industry.

Recent changes include a section on referral selling stipulating that consumers should not be induced to make a purchase based on the assumption of a reduced price for customer referrals. The ICC Code also requires that direct selling companies communicate the contents of the Code with their direct sellers and that compliance with the standards of the Code should be a condition for membership in the company’s distribution system. In keeping with the principle of truthfulness, the ICC Code specifies that “descriptions, claims, illustrations or other elements relating to verifiable facts should be capable of substantiation.

See the ICC International Code of Direct Selling

See the Consolidated ICC Code of Advertising and Marketing Communications Practice

PUBLISHER

MDM Studio Legale
Avvocati - Attorneys - Rechstanwälte
Via Santa Radegonda, 11
I-20121 Milan | Italy

T +39 02 36512684
F +39 02 36512731
E Enquiries
W www.mdmlex.com