A lot of publicity around this case this week, thought it merited a thread given how poorly reported it’s been.
The basics as I understand them are that Google are found to “process” your information when they index and show a page containing your personal information. That means they’re a data controller. And they’re doing it without your permission, so you have the right to have your details removed from their index, even if they’re indexing a true public article (e.g. from the Irish Times).
I think it’s safe to say that lots of legal observers are wondering exactly how much crack the EUCJ was smoking when they handed this down. It departs from current doctrine in several areas which are perplexing people. In particular, this “right to be forgotten” has been essentially manufactured out of whole cloth from no-where, as well as the fact that it apparently trumps the right to free exchange of information.
The other big and surprising issue is that a local DPC was found to have jurisdiction just because Google happened to have a sales office there. This could have big implications for how the online MNCs locate their sales staff – could be good for Ireland since our data protection commissioner’s office is not exactly proactive and is quite pro-MNCs (for now-- we’re getting a new DPC later this year).
As I understand it, this decision will probably be nixed by European Parliament legislation, but in the meantime you can ask Google to remove anything with your name in it, and if they don’t comply you take it to your local DPC.
If anyone is interested in a well-informed (and easy to read) legal analysis, try this.