Internet companies can be made to remove irrelevant or excessive personal information from search engine results, Europe's top court ruled on Tuesday in a case pitting privacy campaigners against Google.
The Court of Justice of the European Union upheld the complaint of a Spanish man who objected to the fact that Google searches on his name threw up links to a 1998 newspaper article about the repossession of his home.
The case highlighted the struggle online between free speech advocates and supporters of privacy rights who say people should have the "right to be forgotten" – meaning that they should be able to remove their digital traces from the internet.
It creates technical challenges as well as potential extra costs for companies such as Google, the world's no. 1 search engine, and Facebook, the world's top social network.
Google can be required to remove data that is "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed," said judges at the Luxembourg-based court. The court said the rights of people whose privacy has been infringed outweighed the general public interest.
Google said it was disappointed with the ruling, which contradicted a non-binding opinion from the court adviser last year that said deleting sensitive information from search results would interfere with freedom of expression.
"We are very surprised that it differs so dramatically from the Advocate General's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications," Google spokesman Al Verney said.
The Australian Law Reform Commission also recently recommended to the federal government that individuals be given the "right to be deleted" online.
The European Commission proposed in 2012 that people should have the "right to be forgotten" on the internet. This was watered down by the European Parliament last year in favour of a "right to erasure" of specific information.
The proposal needs the blessing of the 28 European Union governments before it can become law. Google, Facebook and other internet companies have lobbied against such plans, worried about the extra costs.
The issues of privacy and data protection have become all the more sensitive since former US intelligence contractor Edward Snowden leaked details last year of US surveillance programs for monitoring vast quantities of emails and phone records worldwide.
If the government adopted the Australian Law Reform Commission's recommendation for the "right to be deleted", this would give people the power to compel organisations to delete or de-identify information held about them.
But unlike a recent EU proposal separate to Tuesday's court ruling, it would only apply to posts made by a person and not information posted by others.
President of the NSW Council for Civil Liberties Stephen Blanks said he supported the right to be forgotten online.
"I think people view information about themselves as something they want to be able to control," he said at a recent seminar hosted by the NSW Law Society.
"I think people resent the idea that Facebook and other social media organisations claim the right contractually to be able to retain information forever."
He said young people in particular often said things online they thought were fine to say when they were younger but should be able to remove when older.
"What they regard as being publicly appropriate to say at some stage in their life they might later on come to regret," he said. "And they should have the right to control that."
Dr Gordon Hughes, a Sydney partner with law firm Ashurst, said the right to be forgotten was a "huge debate" lying ahead of Australia.
He said questions such as whether it would be effective remained unanswered.
Tuesday's European court ruling will likely benefit ordinary people but not public figures, said Larry Cohen, a partner at law firm Latham & Watkins.
"The ruling will help certain people hide their past, making it difficult to access certain information, but not when it concerns public figures, or people in whom there is a genuine public interest," he said.
"This will result in added costs for internet search providers who will have to add to their take-down policies the means for removing links to an individual's data, and develop criteria for distinguishing public figures from private individuals," he said.
In the United States, California recently passed a state "eraser" law which will require tech companies to remove material posted by a minor, if the user requests it. The new rule is scheduled to take effect in 2015 and will likely face a court challenge, said Thomas Burke, a partner with Davis Wright Tremaine in San Francisco.
"It's a reflection of the same sort of views that users have a right to control what they post," said Burke, adding that he was not aware of any pending US lawsuits against internet companies similar to the European case.
The Spanish data protection agency said the case was one of 220 similar ones in Spain whose complainants want Google to delete their personal information from the web.
"We are very satisfied that there is an end now to the ferocious resistance shown by the search engine to comply with the resolutions of the Spanish data protection agency in this matter," a spokeswoman for the agency said.
European Justice Commissioner Viviane Reding said the court ruling vindicated EU efforts to toughen up privacy rules.
"Companies can no longer hide behind their servers being based in California or anywhere else in the world," she said.
Google suffered a previous privacy setback earlier this year when a German court ordered it to block search results in Germany linked to photos of a sex party involving former Formula One motor racing boss Max Mosley.
Fairfax Media, Reuters