Further Developments in the Right to be Forgotten: The European Court of Justice’s Judgment in Case C-131/12, Google Spain, SL, Google Inc v Agencia

KEYWORDS right to be forgotten, of expression, data protection, Internet, European Union, Articles 7 and 8 Charter of Fundamental Rights of the European Union, Google Spain SL and Google Inc v Agencia Espan˜ola de Proteccio´n de Datos (AEPD) and Mario Costeja Gonza´lez .


INTRODUCTION
The idea of 'the right to be forgotten' has attracted international interest, particularly within the context of the European Union (EU). 1 In May 2014, a major jurisprudential development occurred. In its judgment in Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González 2 ('Google judgment'), the Court of Justice (CJEU) affirmed the existence in the EU of a right to have personal data deleted from search engines on request-in other words, a right to have that data forgotten.
The judgment has a potentially significant impact on the operation of the Internet and, in particular, of what has become, for many Internet users, one of its most important components: the Google search. 3 The judgment directly impacts the degree of access to data that Internet users have in respect of specific individuals. Further, as regards its business impact, it does not affect Google alone. Its broad construction of the concept of 'control' over personal data means that it is capable of shifting responsibility for breaches of privacy in respect of information available on the Internet towards a broad range of Internet operators, and of imposing on them obligations relating to Articles 7 and 8 of the EU Charter of Fundamental Rights ('Charter'). 4 Thus, the judgment has important implications for the adjudication of fundamental rights in the EU, affecting both the way in which certain aspects of privacy rights are understood, as well as their enforcement.
This article seeks to assess the impact of the judgment on fundamental rights and to highlight, from that perspective, some of its main shortcomings. On the one hand, it is argued that the judgment signals an important step forward in thinking about the way in which the right to privacy can be protected in the Internet era, as well as in recognising the role of private actors in the application of fundamental rights standards. On the other hand though, the judgment appears to dismiss important considerations that can conflict with the right to be forgotten, such as the rights to freedom of expression and access to information, thus raising serious doubts as to whether this development will signal a positive step in the overall protection of fundamental rights. Particular attention is given to the lack of an assessment of the reach of Articles 7 and 8 of the Charter, as well as to the CJEU's failure to recognise the structural role of the European Convention on Human Rights (ECHR) and of the Strasbourg Court's (ECtHR) case law in the development of fundamental rights in the EU.

FACTUAL AND LEGAL BACKGROUND
The case concerned a reference for a preliminary ruling made by the Spanish High Court to the CJEU, which arose out of a dispute between Google Inc and Google Spain on the one hand, and Mr Costeja González and the Spanish Data Protection Agency on the other. The dispute began when Mr Costeja González lodged a complaint with the Spanish Data Protection Agency against a daily newspaper, La Vanguardia, as well as against Google Inc and its Spanish subsidiary, Google Spain, for failure to protect his privacy. The basis for Mr Costeja González's complaint was that, whenever a Google search of his name was carried out, the top results listed linked the Internet user to two property auction notices for the recovery of social security debts that Mr Costeja González had owed 16 years earlier, which still appeared on La Vanguardia's website. The applicant sought to obtain an order to the effect that the newspaper should alter, delete, or protect this information, and that Google should either delete or conceal the links to those pages.
The Data Protection Authority dismissed his complaint against the newspaper, finding that the latter was justified in maintaining this data on its website, as it had been advertised lawfully and for a legitimate purpose. 5 However, it upheld the complaint vis-à-vis Google, finding that search engine operators are responsible for the dissemination of data and that when specific information 'was liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense', which encompassed 'the mere wish of the person concerned that such data not be known to third parties', then search engine operators had a direct obligation to erase the data, irrespective of whether that data remained in place on any other website. 6 Google appealed this finding to the Spanish High Court, which considered the matter a question of EU law and stayed the proceedings, pending a reference to the CJEU for a preliminary ruling. Before discussing the questions referred though, as well as the Court's answers, it is necessary to outline briefly the legal framework applicable to privacy and the protection of personal data in the EU.
Articles 7 and 8 of the Charter, which form part of EU primary law, 7 protect privacy and personal data, respectively. Article 7 of the Charter provides that 'everyone has the right to respect for his or her private and family life, home and communications'. Article 8 goes further, providing: 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority. 8 It is therefore clear that there is a broad fundamental rights obligation to protect personal data under the Charter. 9 Some conditions restricting the manner in which personal data are processed can-and indeed must-be imposed by the Member States, and data subjects must be able to access the data and have it corrected. EU secondary law, however, has not entirely caught up with these obligations. While a Regulation addressing these issues has been the subject of negotiations for some time, no agreement has been reached to date 10 and this field is still governed by Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 11 The Directive dates back to 1995, and therefore long predates both the Charter and the Internet as we 6 Google, supra n 2 at paras 17-18. 7 Article 6(1) TEU grants the Charter the 'same legal value as the Treaties'. 8 Ibid. 9 It is noteworthy that Article 1(1) of the UK and Polish protocol does not provide an exemption from the obligations imposed by the Charter's provisions and certainly not from those set out in Articles 7 know it today. It requires Member States to legislate to ensure that personal data are 'processed fairly and lawfully'. 12 The 'controller' of the data must ensure that it is only collected for 'specified, explicit and legitimate purposes'; 13 that no more is collected than what is necessary for these stated purposes; 14 crucially, that the data are accurate and kept up to date, taking 'every reasonable step' to ensure rectification or erasure if it is not; 15 and that the data are only kept for as long as necessary. 16 The Directive defines the 'processing' of personal data as meaning any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. 17 The 'controller' of data, for the purposes of the Directive, is the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. 18 Additionally, the Directive grants data subjects-that is, parties whose personal data have been processed-the right to require the controller to rectify, erase, or block any data the processing of which does not comply with the provisions of the Directive, 19 as well as to object to the processing of data relating to them. 20 The Directive does however allow Member States to make an exception to these basic rules, insofar as this would be necessary, in order to reconcile the right to privacy with the freedom of expression and, particularly, with journalistic, artistic, or literary expression. 21 Against this background, the Spanish court referred three questions to the CJEU, concerning the interpretation of Directive 95/46/EC and fundamental rights more broadly. The first question was whether a search engine operator like Google, primarily established outside of the EU but having subsidiaries within the EU, selling its services, orientating its activities towards the inhabitants of EU Member States, and willingly collaborating with the parent company, fell within the territorial scope of the Directive. The national court's second question concerned the material scope of the Directive. In particular, it asked whether Google's activities of automatically indexing, temporarily storing, and finally making available the relevant information, amounted to 'processing of data' and, if so, whether a search engine operator could be considered the 'controller' of that data, within the meaning of the Directive. The court's third and final question was the most relevant in respect of the existence of a right to be forgotten and indeed the only one that made reference to this right as such. It asked whether the Directive should be read as extending to individuals a right to address search engine operators directly, asking them to erase data about them, on the basis that they do not wish to make that data available to Internet users-or, to use the Spanish court's own terms: that they want it to be 'consigned to oblivion'. 22

THE JUDGMENT
The CJEU answered these questions as follows. First, it found that the activities carried out by a search engine like Google squarely fell within the concept of 'processing of personal data' enshrined in the Directive. 23 The Court then decided that Google could be classified as the 'controller' of the data. Interpreting the Directive in light of its purpose, which was to ensure the 'effective and complete' protection of data subjects, justified a broad construction of the concept of 'controller'. 24 Similarly, the Court held that, as a stable subsidiary with separate legal personality, Google Spain fell within the territorial scope of the Directive. 25 As regards the extent of the controller's responsibility, the CJEU explicitly put fundamental rights on the agenda. It noted that the Directive sought to protect fundamental rights and, particularly, rights relating to privacy. 26 It therefore decided that its provisions ought to be interpreted in the light of the fundamental rights to private life and the protection of personal data enshrined in Articles 7 and 8 of the Charter. 27 The Court then found that the processing of personal data tailored to an individual's name through a search engine such as Google was capable of affecting these rights significantly, because it enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet -information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty -and thereby to establish a more or less detailed profile of him. 28 The CJEU then stated that 'the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public by its inclusion in such a list 22 Google, supra n 2 at para 20. 23  Right To Be Forgotten 765 of results'. 29 It thus affirmed the existence of a right to be forgotten in the EU, as a matter of principle.
The CJEU clarified that this right does not amount to an obligation on data controllers to remove data outright. Rather, the controller is under an obligation to seek 'a fair balance' between the 'interest' of Internet users in having access to the data in question 'and the data subject's fundamental rights under Articles 7 and 8 of the Charter'. 30 At the same time though, the Court laid down an important presumption in favour of the rights to privacy and the protection of personal data. It held that [those] rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject's name. 31 This presumption could only be rebutted if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question. 32 It is noteworthy that the Court's analysis differed greatly from the Advocate General's Opinion, on several grounds. For example, the Advocate General had found that search engines should not be regarded as 'controllers' of information for the purposes of the Directive, because they process 'files containing personal data and other data in a haphazard, indiscriminate and random manner', 33 and thus do not make an intentional distinction between data which is personal and data which is not, in order to offer the protection required by the Directive. 34 Additionally, the Advocate General had found that a right to be forgotten, in the sense of a right to the erasure of personal data that an individual does not wish to make available to the general public, did not follow either from the wording of the Directive 35 or from the Charter. 36 More specifically, the Advocate General had warned against inferring the existence of such a right from the rights to privacy enshrined in the Charter, as this would raise serious questions of compatibility with other fundamental rights, such as freedom of expression and information. 37 It follows not only that the judgment sits in stark contrast with the Opinion, but also that it leaves unsettled many of the important problems highlighted therein. 29

ANALYSIS
The Google judgment raises a host of legal issues, but this commentary will focus on those aspects of the ruling that concern human rights. Two main lines of critique will be advanced. First, despite the importance that the CJEU places on fundamental rights and, more specifically, on Articles 7 and 8 of the EU Charter, the judgment almost entirely refrains from engaging with the content of these rights and the degree of protection they offer. The judgment thus fails properly to define the reach of the right to be forgotten. This can have important implications for the protection of other fundamental rights and, particularly, freedom of expression (comprising access to information and freedom of the press), as well as for the responsibilities of private Internet operators beyond Google. The second criticism of the judgment concerns its consistency with the ECHR, to which the EU is soon to accede. 38 It will be argued that the CJEU's reluctance to refer to the ECHR and to the Strasbourg Court's case law is particularly problematic, both in light of the EU's pending accession and, more broadly, because it risks upsetting the sensitive constitutional balance struck in the European fundamental rights landscape to date, in which the European Convention has played a crucial part.

A. Fundamental Rights and the Right to Be Forgotten:
How Much is Too Much Protection of Privacy? In its judgment, the CJEU is clear about the fundamental rights basis of a claim to have personal data deleted. 39 In itself, the Directive could not, as the Advocate General had noted in his opinion, have meant all of the things that the Court attributes to it in this judgment, taking account of its 1995 drafting context. 40 The exponential increase of the material available on the Internet and the expansion of search engines are relatively new phenomena that could not, at the time of the Directive's enactment, have been foreseen. 41 But this does not necessarily mean that the CJEU was wrong in applying Directive 95/46 to the facts of this case. Rather, it further highlights the significance of the fundamental rights argument in the Court's ruling. As shown above, despite the absence of specific legislation regulating the flow of information in the Internet era, the Court was not faced with an absence of relevant rules altogether. The constitutional status 42 of the provisions enshrined in the Charter places an obligation on the CJEU to take them into account, as indeed it does at paragraphs 65-68 of its judgment, because the higher normative validity of these rights affects the interpretation of all other legislation. 43 However, one of the main problems present in the judgment is that despite the emphasis placed on fundamental rights in justifying the application of rules regarding the erasure of personal data, the CJEU actually engaged in very little fundamental rights reasoning. Thus, the basis for the application of the Directive appears to be a mere appeal to fundamental rights, rather than a real assessment of the rights to privacy and protection of personal data. 44 While the Court convincingly explains that the processing of personal data tailored to an individual's name through a search engine such as Google is likely to affect 'a vast number of aspects' of an individual's private life generally, 45 it fails to explain precisely how the operation of a search engine is also likely to infringe Articles 7 and 8 of the Charter as concrete legal rights. 46 Such an assessment was necessary in the circumstances. First, while Articles 7 and 8 of the Charter suggest the creation of some obligations for EU institutions and Member States, they do not specify what the role of private actors such as Google should be in the enforcement of the relevant standards, or what limitations to these rights are acceptable and how they ought to be balanced against other, equally fundamental, rights.
Indeed, in the context of a constantly evolving medium such as the Internet, the shared meaning of concepts such as privacy and data protection is limited. 47 In the ever-expanding realm of the information available online, it is difficult to understand what is meant by obligations flowing from a need to respect private life generally, without first clarifying what the 'institutionally-defined rights to privacy' enshrined in Articles 7 and 8 of the Charter actually guarantee and assessing which specific aspects of them a particular set of actions affects. 48 In other words, in order to ascribe the existence of a right to be forgotten to the fundamental rights mentioned in the judgment in any meaningful way, the Court needed first to interpret the content and reach of these rights and to define them in light of the changed circumstances to which they apply. 49 This exercise is strikingly absent from the judgment.
The CJEU then went on to set out a presumption in favour of the right to privacy, under its assessment of what a 'fair balance' between the rights to privacy and the general interests of the economic operator and the public should be. 50 This part of the judgment is problematic. First of all, it is important to avoid over-using the term 'balancing', when it comes to rights on the one hand and general policies or interests on the other. 51 Suggesting that a balance must be reached in such circumstances 43  leaves the Court open to accepting any arguments, interests, or policies, as potential justifications for infringing a fundamental right. 52 This would be incompatible with the very nature of balancing, which necessarily involves the equal promotion of two entitlements of equal constitutional value. As Scanlon explains, the primary concern should be the 'development and full exercise' of the two valid rights. 53 It follows that, to the extent that the Court seeks to weigh up what it considers a fundamental right with economic interests or, even, with a legitimate interest of the public in having access to information, then its quest for a 'fair balance' is misplaced. Nevertheless, it is also important to delve a little deeper and to question the Court's use of the interests/rights terminology. What the CJEU labels an 'interest', namely the public's interest in accessing information, is also substantively guaranteed by a fundamental right, the right to freedom of expression and information. This is enshrined in Article 11 of the Charter and thus constitutes a norm equivalent to those that justify the right to be forgotten in the judgment (Articles 7 and 8 of the Charter). Indeed, it is clear that the operation of search engines has not only made each one of us more exposed and more vulnerable to the judgment of others, but has also brought undeniable and concrete benefits. As the Court itself notes, search engines provide a structured overview of the information regarding a particular subject, linking it together in novel ways that were not available in the past. 54 Thus, in addition to potentially interfering with the right to privacy, search engines arguably make a distinct and substantial contribution to the existing knowledge base, which positively adds to the public's right to access information under Article 11 and can be considered as creating a novel subset of protected expression. 55 The Court's approach is therefore problematic, not only because seeking to balance rights against interests is questionable as a matter of principle, but also because the use of these terms has important practical implications in this case. The judgment mislabels a widely protected fundamental right as an 'interest', subjects it to a presumption of non-applicability and hence fails to take account of its equal weight in the 'fair balance' discussion.
It follows that the CJEU's strong stance vis-à-vis the rights to privacy and protection of personal data can entail lowered protection vis-à-vis the right to freedom of expression and information, especially when it is unaccompanied by an analysis of both rights, underpinned by the principle of proportionality. 56 In the absence of a clear assessment of what the individual fundamental right that needs to be protected actually provides and how it ought to be balanced against an equally valid obligation to safeguard other rights, it will often be difficult to reach an overall outcome that serves both rights. 57 Lack of clarity regarding the balancing of these rights, especially when addressed to private undertakings primarily intended to generate profit, risks being met not with more careful balancing of competing rights but, rather, with the option 52  Right To Be Forgotten 769 that best serves the primary goals of these undertakings, that is, the method which is most cost-effective. 58 In this case, the lack of clear guidelines regarding the steps that need to be followed to ensure that both the right to privacy and the right to freedom of expression and information are safeguarded, risks incentivising undertakings to simply remove the information that a particular individual wants to have deleted. 59 While the forms created by Google and, more recently, Bing, in order to comply with the ruling, make clear that these companies will seek to balance individual rights to privacy with the rights to freedom of expression and access to information, in reality it will be impossible to monitor whether this is the case in each of the thousands of requests that have already been filed, 60 or indeed that the same balance will be reached by all companies now offering this right. 61 Rather, in light of the numerous claims that have followed the ruling, the necessary implication appears to be that, in the absence of further legislation or case law, the companies on which an obligation to delete data has been imposed will in fact dictate the standard of when a right to be forgotten exists. In other words, as the Advocate General had persuasively explained in his Opinion, affected Internet operators will be deciding what constitutes a fair balance between the competing rights on a case-by-case basis. It is highly debatable whether the conditions exist within the EU fundamental rights landscape for such a development to take place, without at the same time risking lowering the protection for fundamental rights. 62 Thus, in practice, the judgment's general presumptions in favour of privacy 63 and unconvincing discussion of the factors that need to be taken into account in assessing claims to have data removed, 64 are likely to result in no real balancing at all. Rather, the judgment creates significant risks for the protection of the right that is at the other end of the said presumption.
The second main problem that the Court's lack of fundamental rights reasoning poses relates to the reach of the obligations imposed on the controller of the data, as set out in the Directive and interpreted in the CJEU's judgment. This problem can be summarised with one short question: 'What makes you Google'? More specifically, should operators other than Google assume that they will be held to the same 58 65 One of the most positive aspects of the Court's ruling is that it signals an important step forward in relation to the fundamental rights obligations of private corporations in the EU, by holding a powerful undertaking responsible for the fundamental rights implications of its actions. It is indeed important to acknowledge that, in a climate of increasing privatisation, the 'private authority relationship' can also give rise to violations of fundamental rights. 66 Some private actors, such as large multinational corporations, are accumulating vast amounts of power, thus challenging the monopoly of states in violating fundamental rights. 67 In the information society in particular, the collection and storage of information by an entity with an important Internet presence such as Google gives rise precisely to these concerns. 68 Nonetheless, while recognising that an obligation to remove personal data on request may be imposed on an undertaking like Google, vested with the power and resources to make a difference in respect of privacy in the context of the Internet, 69 the fact that the judgment rests on a broad construction of the concept of 'controller' in the Directive means that it can also apply to a much broader set of entities. The Court emphasised the goal of 'effective and complete protection of data subjects' and mentioned that the liability of search engines is 'additional' to that of publishers of websites. 70 The judgment therefore suggests that, as a matter of principle, all webpage owners that exercise some degree of control over the data that appears on their pages may be liable to suit for failing to remove unwanted information, unless they benefit from the Directive's specific exception regarding journalistic expression. 71 But is it necessary that all potentially affected entities are in a position to violate fundamental rights, and should they have to balance rights based on the same considerations as Google? Should the Directive apply, for instance, to search engines of a smaller scale; websites unrelated to the news business; amateur blogs; or an unfortunate post on Facebook from several years ago? 72 It can hardly be argued that all these scenarios generate the same degree of control and therefore should give rise to the same kind of fundamental rights obligations as those imposed on Google. While a shift in the concept of responsibility for breaches of privacy rights may be justifiable-and perhaps desirable 73 -if it is accepted that the changed circumstances of the Internet era and added risks for privacy posed by the Internet ought to be effectively addressed, it is essential both for data subjects and for website owners to be able to understand where the limits of that responsibility are placed. The judgment's failure to define the goals and content of the rights enshrined in Articles 7 and 8 of the Charter, and of the right to be forgotten that is inferred therefrom, leaves the question of limits open and raises concerns about legal certainty in the meantime.
B. The EU Right to be Forgotten and the ECHR In addition to the deficiencies evident in the Court's analysis of privacy and data protection in the EU context, discussed above, the judgment raises important concerns regarding the role of the ECHR in the EU's fundamental rights commitments. The ECHR was the dog that did not bark in the judgment which did not make any mention of the Convention system, any of its specific provisions, or of the Strasbourg court's case law. This is problematic.
Despite the fact that the ECHR only protects data under the right to respect for private and family life, the home and correspondence, enshrined in Article 8 thereof, and does not contain the specific provisions regarding the protection of personal data addressed in Article 8 of the Charter, the ECtHR's case law has previously discussed the protection of personal data in the context of the Internet. 74 In particular, in its own 'right to be forgotten' ruling in Węgrzynowski and Smolczewski v Poland 75 -which did not however establish such a right at the ECHR level-the Strasbourg Court reached a different balance in its account of the Article 10 right to freedom of expression, comprising access to information. It noted that 'particularly strong reasons must be provided for any measure limiting access to information which the public has the right to receive'. 76 Further, while the ECtHR generally recognises that the rights of others, including the right to reputation, 77 places limits on the right to access information, in this case it was particularly sceptical about attributing to judicial authorities the role of 'rewriting history'. 78 This aspect of the right to be forgotten, crucial in the ECtHR's assessment of the compatibility of such a right with the freedoms of expression and information, is starkly missing from the CJEU's judgment in Google. Furthermore, despite the differences that can be identified between the protections of privacy enshrined in the EU and ECHR systems, such divergences are not likely to be wide-ranging and referring to the ECHR standard could have been useful at the EU level. The Charter's Explanations clarify that Article 7 of the Charter ought to be read as corresponding to, and having the same limitations as, Article 8 of the ECHR. 79 Additionally, while there is no provision at the ECHR level that is designed specifically to protect against the processing of personal data, like Article 8 of the Charter, the Explanations state that the Charter provision is also premised, among other things, on Article 8 of the ECHR. 80 Moreover, Article 52(3) of the Charter stipulates that, where possible, the same meaning is to be given to its provisions as to the provisions of the ECHR. In line with both that provision and the Charter's Explanations, the only divergence from the Convention standard allowed under the Charter relates to situations where a higher level of protection has specifically been provided for. 81 Finally, EU fundamental rights law has traditionally placed 'special significance' on the ECHR, even prior to the entry into force of the Charter. 82 As Advocate General Tizzano has noted, writing extrajudicially, 'the Court came to de facto integrate the Convention, as well as the jurisprudence of its Strasbourg counterpart, in the Community legal order through its general principles'. 83 Thus, despite the fact that the EU's accession to the Convention is still pending, there is a clear and direct need to engage with the ECHR and with the Strasbourg Court's case law now: 84 not only is there an obligation to accede to the ECHR, 85 but the Convention is also already structurally embedded in both the Charter and the EU's fundamental rights tradition more broadly. 86 That being said, the CJEU has also made clear in its judgments in Kamberaj and Fransson that it is the Charter and not the ECHR that governs the minimum level of protection of fundamental rights in the EU. 87 However, even in those cases, the CJEU expressly referred to the Convention threshold and only opted for additional protections where it considered these protections compatible with ECHR rules. 88 Therefore, while these cases can be criticised for insisting on a somewhat illusory sense of exclusivity in the interpretation of fundamental rights, the lack of any reference to the ECHR in Google is particularly striking. While the Google judgment is not necessarily incompatible with the ECHR, 89 the Strasbourg Court's judgment in Węgrzynowski and Smolczewski suggests that such incompatibility cannot be ruled out either. In particular, as Google offers no discussion of how it meets the Convention's relatively high standard in respect of freedom of expression, 90 even despite the fact that EU legislation on Internet regulation is currently the subject of an Article 10 case pending before the Strasbourg Court's Grand Chamber, 91 the case marks a potential break from the ECtHR's previous reasoning. This is troubling. The CJEU's failure to refer to the ECHR in Google suggests that its judgment is premised on a fundamental assumption that recognising a right to be forgotten necessarily affords a higher level of protection for human rights altogether than the ECHR minimum threshold requires. However, as noted above, the Court's failure both to define the reach of the obligations enshrined in Articles 7 and 8 of the Charter and, where need be, to balance them with the need to protect Article 11 of the Charter, means that that assumption remains, for the time being, unsubstantiated. Indeed, the Court can be criticised for a manifest disregard of the important fundamental rights issues regarding the right to be forgotten noted above, which have not only been previously discussed in the ECHR context, but were also clearly presented to the CJEU in the Advocate General's Opinion. 92 These issues were relevant, for the reasons set out above, in the discussion of the fundamental rights enshrined in EU law and, hence, for the interpretation of Directive 95/46/EC.
On this occasion, the CJEU's puzzling stance towards the international standard may be driven by a need to respond to an even more complicated internal conflict: some Member States already recognise a right to be forgotten through an increased protection of rights to the development of personality and to dignity, while others do not. 93 Interpreting the Charter by strictly following the minimum standards set out in Strasbourg case law could have created an equally-if not more-problematic situation, whereby the level of protection of privacy in some Member States would need to be lowered. This is due to the fact that, as the Melloni ruling made clear, the Charter's level of protection is not a minimum standard of fundamental rights protection but, rather, a binding standard that requires observance across the Union. 94 Nevertheless, one does not necessarily need to criticise the judgment's outcome in order to take issue with the CJEU's failure to relate to the existence of Convention standards on the right to be forgotten. It is important to acknowledge that EU fundamental rights cannot be interpreted in a conceptual vacuum and that a sensitive balance must be struck between EU and non-EU standards. 95 In the past, both international and Member State based analyses of these rights have meaningfully contributed to the development of EU fundamental rights, in a two-fold way: first, a degree of accommodation for national and international legal regimes has been necessary both for the legitimacy and for the smooth operation of the EU's supranational order; and, at the same time, responses to clashes amongst these orders have been instrumental in the development of EU fundamental rights standards themselves. 96 As Besselink puts it: It would therefore be a mistake to see the European area of fundamental rights only as an EU area of fundamental rights. Also in the field of fundamental rights, Europe is composed of mutually dependent and interacting orders, together forming one encompassing constitutional order. 97 It follows that the CJEU's disregard for the case law of the ECtHR in the Google judgment is regrettable. First of all, there are important lessons to be learnt from the Strasbourg Court's case law in this field, which has tackled balancing issues between freedom of expression and the right to private life for a long time. Secondly, Convention considerations are not questions that can be left to be regulated in the distant future, or indeed, upon the EU's accession to the ECHR: they are already requirements under EU law, and their disregard risks upsetting a sensitive and delicate equilibrium not only internationally, but also internally, within the EU.

CONCLUDING REMARKS
The creation of a 'right to be forgotten'-albeit a limited one-in the Google case suggests that the erasure of irrelevant or unwanted data is a necessary part of forgetting. What is more, it is a necessary part of achieving privacy, as expressed in the fundamental rights to the protection of private life and of personal data enshrined, respectively, in Articles 7 and 8 of the EU Charter. It is true that, in the information society in which we currently live, a simple search will likely lead an

Right To Be Forgotten 775
Internet user to a lengthy set of links containing data about any particular individual, which may be untrue, fanfare, or simply outdated. Indeed, in Mr Costeja González's case against Google, the publication of the auction of his property 16 years earlier meant that anyone searching his name online was immediately directed towards one incident in his life-in this case a very unpleasant one-which came to define his Internet presence, more than any of his personal characteristics, achievements, or life choices. This has understandably caused him distress, and has potentially had an adverse impact on his personal and professional relationships. He has reasonably sought to rectify this undesirable situation. Yet, the CJEU's affirmation of his right to do so is more wide-ranging than the facts of this case; it indicates a renewed and vehement commitment to the protection of privacy more broadly.
Nevertheless, it is worth pondering a little more upon the implications of granting individuals a right to have their personal data deleted/forgotten/consigned to oblivion. The immense technological changes that have marked the last two decades have fundamentally altered the concept of privacy. 98 It is becoming increasingly clear that our lives today are not public versus private, and that it is difficult to distinguish between the things that belong to the public realm and the things that belong to the private realm. 99 On the one hand, as this article has already argued, acknowledging private responsibility for breaches of fundamental rights is one way of addressing these changed circumstances. On the other hand though, it is important to respond to these changes also by reassessing the affected rights and by retelling their story in light of a shifting social context: what goals are they intended to serve today and where should their limits be set?
The Google judgment fails to carry out this necessary process of reassessment. Appeals to rights and to a fair balance between competing interests lack grounding in a 'why' and a 'how' in the judgment, while relevant discussions in the ECHR forum are also, puzzlingly, left outside of the CJEU's analysis. It could be argued that omitting to discuss these issues is yet another instance of the Court moving forward 'half a case at a time', and that the Court is hoping to clarify and establish the new right gradually. 100 However, this is unsatisfactory. Deciding that a right to be forgotten follows from the obligations enshrined in Articles 7 and 8 of the Charter that Directive 95/46 seeks to protect has vast and immediate implications for many private Internet operators, as well as for Internet users seeking to access information. Moreover, a right to make others forget us has existential implications: should we/can we regulate what is remembered or forgotten? 101 If so, to what extent should/can a right to have certain data deleted really impact our abilities to remember and to forget, collectively or individually? Thus, both at a conceptual and at a practical level, important issues regarding the regulation of the Internet and the operation of a right to be forgotten in the EU remain to be addressed, even in the aftermath of the Google judgment.
Right To Be Forgotten 777