A condensed version of this article was originally posted to the IAPP’s Privacy Tracker.

While most people have focused on the free speech and implementation difficulties of the “right to be forgotten” announced by the European Court of Justice (ECJ) in Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos [google.com] (Mario Costeja González), there are serious jurisdictional implications for the Internet, intermediaries and content publishers that largely have been ignored. The decision went against Google Inc., and its U.S.-based “Search” service, which the ECJ found to be subject to EU Directive 95/46 (Privacy Directive) as transposed into Spanish law.  In other words, Google Inc., as a search engine operator based in the United States, is subject to the jurisdiction of the Spanish courts and the Spanish Data Protection Authority (DPA) at least for privacy complaints related to search.*

Most U.S.-based Internet companies have cooperated voluntarily with EU investigations and court cases while denying that jurisdiction exists for most of their activities. U.S. subsidiaries operating in the EU have limited, defined roles, such as selling advertising or operating data centers. The ECJ opinion eviscerates the separate corporate entity doctrine and treats Google as a single operating unit or group for purposes of the Privacy Directive and, at least, the Search service, but there is no reason the logic of the opinion will not apply more broadly to all advertising services offered by U.S.-based Internet services.

More, most commentators seem to think that blocking search results on “Google.es” will be a sufficient response to the decision, perhaps thinking that anything more will require extraterritorial application of the Spanish law. But nothing in the ECJ opinion suggests any such limitation. To the contrary, it is not an “extraterritorial” act at all to apply local law against a controller deemed to have an establishment within the territory. If a search engine operator is subject to the jurisdiction of the court or DPA, then presumably it can be ordered to block search results based on Mr. González’s name globally. Thus, the decision is censorious in the extreme, giving one local DPA global data control without regard to the law of the land where the search engine is incorporated or operates.

So how did the ECJ achieve this jurisdictional coup d’état?  The ECJ first had to find that Google Inc., the U.S. parent of Google Spain, acted locally when processing Mr. González’s data. In the parlance of the Privacy Directive, the ECJ had to find that Google Inc. was a controller of the personal information of Mr. González and that it carried out processing of that data “in the context of the activities of an establishment” on Spanish territory. 

Google argued that it was an intermediary with no control over the content of the information it indexed from third-party websites. But, the ECJ found, Google’s search engine organizes and structures information so it can be found more easily by Internet users—that is, purposeful control. What really drives the determination, however, is that some Internet users might not find the offending information at all on publisher websites but for the search engine aggregation. This “structured” set of results, the ECJ claims, based on a search of an individual’s name can enable someone to “establish a more or less detailed profile of the data subject.” That is a bad thing, according to the ECJ, and therefore, to ensure “effective and complete protection of data subjects, in particular of their right of privacy,” the search engine operator must be deemed to be a controller of the data. In other words, the desired outcome determines the rule.

Having established that Google Inc. is a controller, the ECJ next had to determine whether the processing of personal data occurred through an establishment in the territory. Google argued here that Google Inc. was exclusively responsible for the search activities without any intervention from Google Spain, whose activities were solely limited to advertising sales. The ECJ rejected that argument, finding that Article 4 of the Privacy Directive does not require that “the processing . . . be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities’ of the establishment.” ECJ ¶ 52. 

So the result is that the parent-subsidiary distinction no longer matters for jurisdiction over privacy complaints – it is the corporate group taken as a whole that the courts and DPAs will look to: “the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed.” ECJ ¶ 56.

So when Mr. González now seeks to be forgotten, what will happen if an advertising-based, non-EU search engine operator fails to remove the links to the bad debt article on all domains? The Spanish DPA or Spanish courts may prosecute the operator in the local courts and issue an order that the search engine operator comply with the request. The operator, if it fails to appear and defend, may incur penalties and have a judgment entered against it that can be enforced in the operator’s home country. Then we will see how a conflict-of-laws analysis plays out, especially if the action is brought in the United States where the First Amendment’s free speech rights will squarely meet state-sponsored censorship. 

The ramifications of the decision are not likely to be limited to search engine operators. The same logic the ECJ used to create jurisdiction can be applied to find that blog hosting companies, social media and other intermediaries are controllers with establishments in the EU. Will an EU court or DPA require removal of user-generated content that violates the Privacy Directive? Perhaps not, given that the user’s speech rights will be implicated by such a decision. But it is another thing to say that the hosting company will be permitted to process the data and advertise around it or return search results on its own site or affiliated properties.

Applicable law and notions of jurisdiction are closely tied together in EU jurisprudence, so one might view the ECJ decision as limited to privacy issues. But other agencies with enforcement powers may look at jurisdiction differently now. For example, law enforcement agencies may now view controllers with an establishment in the territory for privacy purposes as enough to seek to require disclosure of personal information of EU users.

Some intermediaries or platforms may be able to distinguish themselves from Google’s operations based on factual differences. For example, if there is no subsidiary in the country, there is not likely to be an establishment in the country. The ECJ also found a few more facts to be important:

• • there is a local version of Search adapted to the national language and offered through a website using a national domain (e.g., google.es);
  • Google’s search engine is widely used by residents;
  • indexing of websites takes place automatically and is stored temporarily on servers whose location is unknown—proof that no data is stored in the country may be useful;
  • advertising is associated with search terms, and advertising pays the freight for the free search service; and
  • the in-country subsidiary acts “as a commercial agent” for the out-of-country parent by promoting, facilitating and effecting the sale of advertising. 

How far the DPA will reach in applying the local law remains to be seen. The right to be forgotten is only one aspect of data privacy law in the EU, but it is one of the most controversial. Much more attention is likely to be paid to the clash between the First Amendment in the United States and the censoring impact of the ECJ decision in the EU, but the enduring nature of the jurisdictional decision may have a much more far-reaching impact.  

© 2014 Perkins Coie LLP

*Disclaimer: While Perkins Coie represents Google in various legal issues, the views expressed throughout this client update are the sole opinion of the author.