Google may be ordered to remove personal information from its search engine after the European Union's top court paved the way for citizens to have a "right to be forgotten."
"Links and information in the list of results must be erased" where a person's fundamental rights are harmed by the posting of personal information online and where there is no public interest in publishing it, the EU Court of Justice said in a statement on a ruling today.
A person may ask search-engine owners to remove personal information and can ask a court or a data-protection authority to step in if the company refuses, the Luxembourg-based tribunal ruled. The court said Google both processes and controls personal data and must abide by EU law.
The ruling is the latest data-protection blow to Google, which faces privacy investigations around the world as it adds services and steps up competition with Facebook for users and advertisers. The company was fined 1 million euros in Italy last month over privacy violations by its Street View cars, which photographed people across the country without their knowledge.
It's "a very loud wake-up call" to all businesses that gather and store consumer data, said Mark Brown, director of information security at Ernst & Young in London. Many companies may be "quaking in their boots at the thought of responding to a consumer 'right to be forgotten' request" as they may not know what data they are holding, he said.