The data debates - How the CJEU’s decision fits in to the current online data discussions on search engines

United Kingdom

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

While the press and the public are currently focussing on the interpretation and impact of this latest decision of the CJEU against Google, the overall broad picture should remain in focus. The "right to be forgotten" is only one - and possibly not the most severe - of many data privacy issues triggered by Google's service offerings. Other topics that are currently discussed in Europe in this context include Google's illegal practice of scanning incoming emails to place advertisements, using invalid privacy policies or surveillance possibilities through Google Glasses.

Scanning Incoming emails

Earlier this year, Google finally admitted its practice of scanning Gmail accounts and other Google user content. Google recently changed its Terms of Service and in doing so confirms a long practice that has already been an open secret. The new section under "Your Content in our Services" states:

"Our automated systems analyse your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored."

This practice is widely seen as illegal. In Germany it is expected that since Google's practice is now laid down in its Terms of Services, consumer protection agencies are likely to become active and initiate judicial proceedings against Google in the near future.

Also, this practice of scanning incoming emails may come into the focus of German prosecutors.

Other than in the US, where Google's practice was examined under wiretapping laws, German prosecutors likely will look into the criminal offence of phishing (sec. 202b German Criminal Code). Other EU-countries have similar criminal laws.

Google Glasses

Despite the fact that there has only been a limited sale of Google Glasses in the U.S., several German data protection specialists have already strongly criticized the product. For example, just recently a German television debate featured the topic "Becoming a criminal with high-tech glasses". One of Germany's best known data privacy commissioners, Thilo Weichert, said that Google Glasses are clearly a"weapon to attack people's personal rights" and that "it would be a disaster if Google Glasses would beextensively sold in Germany and Europe".Weichert also said that a business model that affects personal rights to such extent is highly problematic from a legal point of view. People would film and record other people. Nobody could feel unobserved any longer. Weichert has already acted against Google in the past in relation to other data protection issues. It appears likely that he will strike again once

Google Glasses are sold in Germany.

Infringing Privacy Terms

At the end of last year theRegional Court of Berlindeclared 25 clauses of Google's privacy policy invalid as they are too opaque, relate to unjustified data processing and/or contain invalid consent language. One of the main issues is that Google intends to use personal data across services and also for purposes that are not related to the specific service used (e.g. Gmail, Google+, etc.). The decision of the regional court of Berlin is not final yet and the appeal decision is pending. Google has not done much to remediate this situation. If and to the extent the Berlin decision is confirmed by the appeal court, Google will have to make considerably changes both to its privacy policy and to its data processing practices.

The decision in Germany is consistent with decisions in other EU jurisdictions. In France, French privacy regulator the CNIL has protected French consumers by ordering Google to inform its users about its violations on landing page. 

So it can be seen that the Google Spain decision is merely part of much broader shifting sands in respect of the use of personal data online. Until recently, Google may have considered that they could undertake the widespread use of personal data largely with impunity. But in Europe at least, on a number of fronts that position is changing extremely rapidly.