Google Inc. may be ordered to remove personal information from its search engine after the European Union’s top court paved the way for citizens to have a “right to be forgotten.”

“Links and information in the list of results must be erased” where a person’s fundamental rights are harmed by the posting of personal information online and where there is no public interest in publishing it, the EU Court of Justice said in a statement on a ruling today.

A person may ask search-engine owners to remove personal information and can ask a court or a data-protection authority to step in if the company refuses, the Luxembourg-based tribunal ruled. The court said Google both processes and controls personal data and must abide by EU law.

“Today’s court judgment is a clear victory for the protection of personal data of Europeans,” Viviane Reding, the EU’s justice commissioner, said in a post on her Facebook Inc. page. “Companies can no longer hide behind their servers being based in California or anywhere else,” said Reding, who’s on leave while she campaigns for a seat in the European Parliament.

The ruling is “disappointing” for search engines and online publishers, said Al Verney, a spokesman for Google in Brussels. The company now needs to analyze the implications, he said.

House Auctioned

A Spanish court sought advice from the EU’s top court for Google’s challenge to an order by the Spanish data-protection authority for it to remove information on a man whose house was auctioned off for failing to pay taxes, one of 200 instances where Spain has asked Google to pull content.

Newspaper La Vanguardia published the information in the case in 1998 and years later it could still be found through a Google search.

The ruling sets out a so-called right to be forgotten that the European Commission proposed in 2012 as part of an overhaul of data-protection rules that may be finalized later this year. Today’s decision is binding on courts across the 28-nation bloc.

The case should mark “a turning point for Google’s behavior,” said Jose Luis Rodriguez Alvarez, the head of Spain’s Data Protection Agency, in an e-mailed statement. Google has “consistently challenged” the Spanish authority which has had to deal with an increasing number of complaints over the company’s refusal to remove personal information, the agency said.

Privacy Investigations

“It’s satisfying that search engines are not exempt from any responsibility of the content they link to or have in their caches,” Gerard Lommel, head of the Luxembourg data protection authority, said in an interview. “The greatest satisfaction is that national data protection rules apply and that subsidiaries of Google can be held accountable on the territory of the member states.”

Google faces privacy investigations around the world as it adds services and steps up competition with Facebook Inc. for users and advertisers. The company was fined 1 million euros ($1.38 million) in Italy last month over privacy violations by its Street View cars, which photographed people across the country without their knowledge.

That added to a 150,000-euro penalty from France over failing to provide information on how Google uses personal data and a 900,000-euro fine from Spain for illegally collecting and using personal data.

The case is: C-131/12, Google Spain, S.L., Google Inc. v. Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez.