Hi,
Context: I’ve received a request from someone to remove any reference to their name from my website. Essentially, this person was mentioned in the context of some offensive statements she had made online several years ago. I had a screen capture of the comments, and provided a translation from the original Spanish. In her request, this person cites the ‘legality’ of maintaining a news story online about someone, several years after the event has passed. My understanding is that she is referring to the EU’s ‘right to be forgotten’.
I am an EU citizen and live in Spain, as does this other person, which is why she is claiming this right. However, my website is hosted in the USA with an American company.
Question: Do you think I am liable to requests made under EU law? Or does the fact that my content is hosted in the USA mean that it is published there, and thus protected by the US Constitution?
Thanks!
Alasdair Taylor's Answer
I don’t think the question here is “where is the website published?”.
Instead, the preliminary questions are whether the Spanish/EU courts would: (a) accept jurisdiction to adjudicate the dispute; and (b) apply Spanish/EU data protection law to this factual situation.
I think the answer to both questions is likely to be “yes”.
If EU data protection law were only applied to personal data processed within the EU, then it could easily be avoided by persons and companies based in the EU processing all their data overseas.
To be clear, if proceedings were initiated in the US, the US would not apply EU data protection law – but as you are situated in Spain I expect the Spanish courts would have no difficulty taking jurisdiction.
The substantive question is whether the right to be forgotten does in fact apply in this case. Unfortunately, neither the Directive nor the CJEU’s 2014 judgment are particularly clear about the scope of the right, and it can be very difficult to determine where it applies and where it does not. For example, it may apply to data held by a search engine but not to the same data stored in a newspaper archive. For a factsheet outlining the EU’s public position on this, see:
http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf
