Publications
Partners
Cape Town - The case against Google in the EU holds wide implications for the way online publishers are meant to handle personal data, legal experts have said.
The Court of Justice of the European Union (ECJ) upheld the complaint of a Spanish man who objected to the fact that Google searches on his name threw up links to a 1998 newspaper article about the repossession of his home.
He had argued that he had the right to have the results linking to his case be "forgotten" by Google's search tools.
Google said that the decision made search engines liable for policing human rights.
"This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the Advocate General's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications," said Google.
Specific conditions
In SA, the Protection of Personal Information Act (Popi), No 4 of 2013, gives voice to the concerns of how companies should deal with personal information.
"The EU decision potentially has various implications for the way in which Popi will be interpreted and applied," Dario Milo and Avani Singh, specialists on data protection at Webber Wentzel told News24.
In particular, they added that there were specific conditions in terms of how the law would look on the collection of personal data by search engines like Google with respect to the EU decision.
"This includes, for instance, the court's finding that in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine processes the personal information that may be contained there - regardless of the fact that the operator of a search engine also carries out the same operations in respect of other types of information and does not distinguish between whether this is personal information or not, or the fact that the personal information is not altered by the search engine."
In SA, Popi specifically insists that the collection of information must be done directly from the "data subject" (people) though it does allow the collection of publically available information, such as content placed on social networks.
Also, companies may collect personal data as long as "collection of the information from another source would not prejudice a legitimate interest of the data subject", says the legislation.
Responsibility
Milo and Singh argued that in SA, information placed online is the responsibility of the person posting the information or the organisation on whose behalf the information is being posted.
"If the individual were to place the information online at the request of a third party, for instance an employer who undertakes to secure the safety of the information, then it will be for the employer in that example to protect the personal information.
"Importantly, this will be more carefully regulated once the Protection of Personal Information Act, 2014 ('Popi') is fully in force. To the extent that personal information is placed online as part of the processing of that information, Popi stipulates that it is the responsible party (that being the person or body that determines the purpose of and means for processing personal information) who bears the primary responsibility for protecting the personal information."
One critical challenge in SA is that the regulator envisioned in the act has not been appointed, meaning that penalties for non-compliance has not yet been determined.
- Follow Duncan on Twitter
The Court of Justice of the European Union (ECJ) upheld the complaint of a Spanish man who objected to the fact that Google searches on his name threw up links to a 1998 newspaper article about the repossession of his home.
He had argued that he had the right to have the results linking to his case be "forgotten" by Google's search tools.
Google said that the decision made search engines liable for policing human rights.
"This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the Advocate General's opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications," said Google.
Specific conditions
In SA, the Protection of Personal Information Act (Popi), No 4 of 2013, gives voice to the concerns of how companies should deal with personal information.
"The EU decision potentially has various implications for the way in which Popi will be interpreted and applied," Dario Milo and Avani Singh, specialists on data protection at Webber Wentzel told News24.
In particular, they added that there were specific conditions in terms of how the law would look on the collection of personal data by search engines like Google with respect to the EU decision.
"This includes, for instance, the court's finding that in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine processes the personal information that may be contained there - regardless of the fact that the operator of a search engine also carries out the same operations in respect of other types of information and does not distinguish between whether this is personal information or not, or the fact that the personal information is not altered by the search engine."
In SA, Popi specifically insists that the collection of information must be done directly from the "data subject" (people) though it does allow the collection of publically available information, such as content placed on social networks.
Also, companies may collect personal data as long as "collection of the information from another source would not prejudice a legitimate interest of the data subject", says the legislation.
Responsibility
Milo and Singh argued that in SA, information placed online is the responsibility of the person posting the information or the organisation on whose behalf the information is being posted.
"If the individual were to place the information online at the request of a third party, for instance an employer who undertakes to secure the safety of the information, then it will be for the employer in that example to protect the personal information.
"Importantly, this will be more carefully regulated once the Protection of Personal Information Act, 2014 ('Popi') is fully in force. To the extent that personal information is placed online as part of the processing of that information, Popi stipulates that it is the responsible party (that being the person or body that determines the purpose of and means for processing personal information) who bears the primary responsibility for protecting the personal information."
One critical challenge in SA is that the regulator envisioned in the act has not been appointed, meaning that penalties for non-compliance has not yet been determined.
- Follow Duncan on Twitter
