BRUSSELS — The highest court in the European Union decided on Tuesday that Google must, in some cases, grant users of its search engine a so-called right to be forgotten that includes deletion of links to embarrassing legal records.
The decision by the European Court of Justice in Luxembourg appeared to represent a blow for Google.
It comes as momentum builds in Europe to adopt an even more far-reaching privacy law already under negotiation by lawmakers that includes a tougher right to be forgotten, or “erasure” as it is called in draft legislation, that also would apply to companies like Facebook.
The judgment on Tuesday was based on a data protection law from 1995 that provides limited rights to object to the processing of personal information and to demand its erasure in certain situations.
The court decided that there were cases in which a company like Google should allow online users to be “forgotten” after a certain time by erasing links to web pages “unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public.”
It ruled that companies like Google could be “obliged to remove links to web pages” even when the original “publication in itself on those pages is lawful,” according to a summary of the judgment.
In what appeared to be an endorsement of the aggressive approach to privacy protection in Europe in the digital age, the court said in its summary that “the effect of the interference with the person’s rights is heightened on account of the important role played by the Internet and search engines in modern society.”
Favoring companies like Google in such circumstances could not “be justified by merely the economic interest which the operator of the engine has in the data processing,” the court said.
Al Verney, a spokesman for Google, said in a statement that the decision was “a disappointing ruling for search engines and online publishers in general,” and that the company would “take time” to analyze the implications. Google was “very surprised” that the judgment “differs so dramatically” from a preliminary ruling by the court last year that mostly went in the company’s favor, he said.
Viviane Reding, who is on leave from her post as the European Union’s justice commissioner while she campaigns for election to the European Parliament, said on her Facebook page on Tuesday that the decision to make search engines like Google responsible for their links was a major advance for European regulation and for privacy protection.
“Companies can no longer hide behind their servers being based in California or anywhere else in the world,” wrote Ms. Reding, who two years ago proposed the tougher rules that are under consideration at the European Parliament. The judgment was a “strong tailwind for the data protection reform that the European Commission proposed in January 2012,” she said, referring to that legislation.
Even as the European authorities feted a victory for their strict approach to online privacy protection, legal experts asked whether the drive by Brussels to introduce a tougher law was still necessary after such a sweeping ruling by the court. “Most surprising is that the court has come down firmly in favor of a ‘right to be forgotten,’ ” said Richard Cumbley, a London-based partner at the law firm Linklaters. “Given that the E.U. has spent two years debating this right as part of the reform of E.U. privacy legislation, it is ironic that the E.C.J. has found it already exists in such a striking manner,” he said, referring to the European Court of Justice.
The case began in 2009 when Mario Costeja, a lawyer, objected that entering his name in Google’s search engine led to legal notices dating back to 1998 in an online version of a Spanish newspaper that detailed his accumulated debts and the forced sale of his property.
Mr. Costeja said that the debt issues had been resolved many years earlier and were no longer relevant.
When the newspaper that had published the information, La Vanguardia, refused to remove the notices, and when Google refused to expunge the links, Mr. Costeja complained to the Spanish Data Protection Agency that his rights to the protection of his personal data were being violated.
The Spanish authority ordered Google to remove the links in July 2010, but it did not impose any order on La Vanguardia.
Google challenged the order, and the National High Court of Spain referred the case to the European court for advice on how to rule.
The judgment on Tuesday follows a preliminary victory for Google in June 2013, when an adviser to the court, Niilo Jaaskinen, decided that Google did not need to remove the links.
Mr. Jaaskinen concluded that because Google merely aggregated information on the web and was not a “controller” of information, it was not the legal entity that must comply with the provision of the law in question.
Mr. Jaaskinen also said that the 1995 law guaranteed a right to be forgotten only in cases where information was incomplete or inaccurate, which was not at issue in the Spanish case.
By JAMES KANTER