On May 13, the highest court in the European Union (ECJ) ruled that in some cases Google must grant its users the right to delete information about themselves, including links to public legal records. The case began in 2009, when Spanish lawyer Mario Costeja objected that, when he entered his name in Google’s search engine, the results showed a dated legal notice from a Spanish newspaper that detailed his debts and the forced sale of his property. In fact, the debt issues had long been resolved, but the continued posting of the newspaper notice clearly suggested that Costeja had financial problems. Costeja asked both the newspaper and Google to expunge the link. Both refused.

After passing through the lower courts, the EU Court of Justice ruled Costeja had a right to have Google delete the link about him in this particular case – even though the link navigated to a public record.

By ruling that U.S.-based Google must evaluate individual deletion requests based on the EU data privacy standard, the court ruled that Google must comply with EU data privacy laws when dealing in the EU. The court said the automatic indexing of information that contains personal data “must be classified as ‘processing of personal data” and that “the operator of the search engine must be regarded as the ‘controller’ in respect to that processing …” Additionally, “the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person,” even “when its publication in itself on those pages is lawful.”

At least in Europe, Google would be forced to investigate search results when requested to do so by individual national data protection officials. The decision is based on a 1995 data privacy law that gives individuals the right to demand deletion of information in certain situations. According to the judgment, companies like Google could be obligated to remove links to web pages even when the original publication was lawful. So, for example, in Costeja’s case, even though the original legal notice was correct, the subsequent remedial actions were required to correct the impression given by the notice that Costeja had fallen on hard times.

The impact of the decision will be far reaching. At a minimum, the decision seems to endorse the “right to be forgotten” in the EU and obviates the need for specific legislation.

Issues will develop regarding the specific content that can be removed and whether someone using the Internet should have the ability to create and control his own image online, no matter what the person has done. Does the ruling cover only content that is searchable in the EU? Does it also cover content generated by the United States? Does it cover content posted about or by U.S. citizens residing in the EU? How might the shift from being an information aggregator to being a responsible information controller impact Google and other Internet companies? What are the economic ramifications of that responsibility? What type of precedent does this create in the United States?