On Tuesday 13 May 2014, the Court of Justice of the European Union (CJEU) released its long-awaited judgment in the Google Spain (C-131/12) case.

In short, Mr Mario Costeia Gonzalez, a Spanish citizen, wanted Google to remove search links to a notice published in a Spanish newspaper in 1998 concerning his bankruptcy.

The Court has ruled against Google, holding that individuals do have a right to request search engines to remove their personal data if the data appears to be "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed".

Moreover, the Court recognised the responsibility of Google, as a data "controller", "to remove links to webpages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person's name". The Court clearly distinguished here between Google's activities from those of the original publishers (the newspaper).

This judgment is interesting and groundbreaking as it is the first time that the CJEU has ruled on the issue of the "right to be forgotten" on the Internet, i.e. the possibility for the people to remove their personal data from the Internet.

EU Justice Commissioner Viviane Reding welcomed the CJEU judgment saying that it was "a clear victory for the protection of personal data of Europeans" and that it "confirms the need to bring today's data protection rules from the digital stone age into today's modern computing world".

Indeed, the legal basis of the judgment is the existing legal framework (i.e. rights to object (article 14) and to erasure (article 12b) of the 1995 Data Protection Directive).The European Commission's 2012 Data Protection Regulation, aiming to modernise Directive 95/46/EC and including the right to be forgotten (the most controversial provision) is still being discussed in the European Parliament and the Council.

While at first sight the judgment may raise concerns for the right to freedom of expression and information, its wording is actually more nuanced.

Indeed, the Court held that a fair balance should be sought in particular between the Internet users' interest of having access to the information in question related to the data subject, and the latter's right to privacy and right to protection of personal data. In this specific case, the CJEU said that the rights of people whose privacy has been infringed outweighed the economic interest of the operator of the search engine but also the general public interest. However, it mentioned that this balance may depend on the nature of the information in question and its sensitivity for the data subject's private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.

The Court also provided an expansive approach on the 1995 Directive's territorial scope, giving a clear signal to American companies. It held that, to the extent that "the operator of a search engine (i.e. Google Inc.) sets up a branch or subsidiary in a Member State (i.e. Google Spain) which is intended for the promotion and selling of advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State", the processing falls within the territorial scope of the Directive.

As mentioned by Commissioner Reding in charge of the Data Protection Reform, it is important to make sure that those who do business in Europe respect European laws.

It is too early to predict the practical implications of this judgment and how far it could potentially influence the current discussions on the Data Protection Regulation. Moreover, one should not conclude too rapidly that any individual can now request search engines to delete or remove links to webpages when their name is used as a search term. Such a request will still have to comply with a number of legal requirements.

Nevertheless, the media is already reporting a proliferation of requests to Google from members of the public to remove personal data from its site. The Court states that if the search engine does not grant the request, the data subject can bring the matter before the supervisory or judicial authority so that it carries out the necessary checks and balances. The judgment appears to envisage a two tier approach - for private individuals on the one hand, and for public figures and matters of public interest on the other. Private individuals not in the public eye may have a strong claim to protect their personal data (although the supervisory authorities will be aware of the risk of opening the floodgates to unmanageable numbers of claims in the future). With respect to public figures and matters of public interest, the Court advocates a much stricter approach to the "right to be forgotten", which is clearly necessary to protect the fundamental principle of freedom of the media.

Overall, the evolution of diverse and even conflicting regulatory approaches in different EU countries would be detrimental both to media freedom and the good functioning of the Internet, and the impetus is now on the European Parliament and Council to propose a balanced and proportionate regime for the EU.