There can be no doubt that in recent months, data protection issues have come to the forefront for media organisations and journalists. The recent ruling against Google Spain, and the Information Commissioner’s Office (ICO) decision, which was last week reported on HoldtheFrontPage, are just a few of the most prominent.

The Google ruling has, rightly, ruffled many feathers, and seems to represent a disregard of the much treasured right to freedom of expression, by the Court of Justice of the European Union (CJEU).

Mr Gonzalez, a Spanish National, brought a complaint against La Vanguardia (a Spanish newspaper), as well as Google Spain and Google Inc. His complaint was that upon carrying out a Google search for his name, the results contained links to articles on La Vanguardia that detailed Mr Gonzalez’s bankruptcy proceedings, which took place in 1998.

Mr Gonzalez wanted the matter to be forgotten, and argued that the continued publication of the information was contrary to his rights under the EU Data Protection Directive. Mr Gonzalez failed in his claim against La Vanguardia, because the CJEU held that the newspaper was protected by the journalistic exemption.

However, the CJEU ruled against Google Spain, deciding that they had a responsibility to ensure that the operation of the search engine was in line with individuals’ data protection rights. The CJEU decided that the rights of the individual, whose data is available online (the ‘data subject’), are more important than the rights of internet users who want to know the information, unless for example, the data subject plays a role in public life.

As a result, the CJEU has decided that under EU law, there is a ‘right to be forgotten’, and therefore data subjects have the right to demand that search engines remove links to information that they do not want to appear in search results.

Whilst the ruling signifies the way data protection law is moving, and represents a worrying move away from the rights of internet users, and towards those of the data subjects, at present, it only applies to search engines. As was the case for the Spanish website ‘La Vanguardia’, online newspaper publications are protected by the journalistic exemption contained in the Data Protection Directive.

Therefore, even if the data subject can demand the removal of information from search engine results, those benefitting from the journalistic exemption can continue to publish the information without recourse, as long as the publication is lawful in itself – for example, the information isn’t libellous or a breach of privacy.

The decision has potentially far-reaching consequences for those who publish information online within the EU and do not benefit from the journalistic exemption, but thankfully, regional newspaper websites do have that benefit.

Last week, reports emerged of an ICO decision that was handed down in March of this year, and which stated that a regional newspaper website had complied with data protection laws even though it refused to remove an article detailing a spent conviction from its archives.

The basis for the ruling was that the publication came under the Data Protection Act (DPA) “special purposes of journalism” exemption.

There is some real value in this ICO decision because it recognises a newspaper publisher’s right to preserve its online archives, under the journalism exemption contained in the DPA.

Archives are an important and treasured resource, and the decision adds clout to the argument that publishers are entitled to keep personal information in their online archives indefinitely.

The moral of the story is twofold – the journalistic exemption is going strong, both under European and UK law. But on the flipside, beware of the course that the CJEU seems to be taking, with the casual erosion of freedom of expression and the increasing rights of data subjects.