The top European court has backed the "right to be forgotten" and said Google must delete "inadequate, irrelevant or no longer relevant" data from its results when a member of the public requests it.
The test case privacy ruling by the European Union's court of justice against Google Spain was brought by a Spanish man, Mario Costeja González, after he failed to secure the deletion of an auction notice of his repossessed home dating from 1998 on the website of a mass circulation newspaper in Catalonia.
Costeja González argued that the matter, in which his house had been auctioned to recover his social security debts, had been resolved and should no longer be linked to him whenever his name was searched on Google.
He told the Guardian: "Like anyone would be when you tell them they're right, I'm happy. I was fighting for the elimination of data that adversely affects people's honour, dignity and exposes their private lives. Everything that undermines human beings, that's not freedom of expression."
The European court judges ruled that under existing EU data protection laws Google has to erase links to two pages on La Vanguardia's website from the results that are produced when Costeja González's name is put into the search engine.
The European judges made clear that in their view the EU data protection directive already established a "right to be forgotten". This appears to pre-empt lengthy negotiations within the EU over a new data protection directive which could establish a limited "right to be forgotten".
The judges said they had found that the inclusion of links in the Google results related to an individual who wanted them removed "on the grounds that he wishes the information appearing on those pages relating to him personally to be 'forgotten' after a certain time" was incompatible with the existing data protection law.
They said the data that had to be erased could "appear to be inadequate, irrelevant or no longer relevant or excessive … in the light of the time that had elapsed". They added that even accurate data that had been lawfully published initially could "in the course of time become incompatible with the directive".
In technical terms the ruling establishes that a search engine such as Google must be regarded as a "data controller" under the data protection laws in those EU countries where it establishes a branch to promote and sell advertising.
They also made clear that there is a balancing public interest defence against deletion, especially if the individual is involved in public life. But the judges say that it is the role of a search engine in being able to create a "ubiquitous" list of results that can easily provide a 'more or less detailed' profile of the private life an individual that "heightens" the interference with privacy rights.
The case is the first of more than 200 cases in the pipeline against Google in which Spanish citizens want the search engine to delete personal information about them from their search results.
The ruling makes clear that a search engine such as Google has to take responsibility as a "data controller" for the content that it links to and may be required to purge its results even if the material was previously published legally. Data protection lawyers said the ruling meant that Google could no longer be regarded legally as a "neutral intermediary"
The EU judges pointed out that they were requiring Google to remove its links to two pages on La Vanguardia's website even though the Spanish data protection agency had rejected Costeja González's complaint against the newspaper and said it had published the information about him lawfully.
Legal experts said the ruling could give the go-ahead to deletion requests of material including photographs of embarrassing teenage episodes and even insults on social media websites and could lead to a rethink in the way they handle links to content on the web.
The EU justice commissioner, Viviane Reding, welcomed the court's decision, saying it was a clear victory for the protection of the personal data of Europeans. "The ruling confirms the need to bring today's data protection rules from the 'digital stone age' into today's modern computing world," she said in a post on Facebook.
Google said: "This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the advocate general's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications."
The British justice secretary, Chris Grayling, has been a leading opponent of Reding's proposals for an explicit EU "right to be forgotten".The Ministry of Justice has estimated that the European commission's proposals could cost British businesses, which include many leading data and tech firms, £360m a year. The information commissioner has called the "right to be forgotten" proposals "a regime that no one will pay for".
