Factual Background Edit
In 2010. Mario Costeja González ("Costeja"), a Spanish national, lodged with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, the AEPD) a complaint against La Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain, in particular in Catalonia) and against Google Spain and Google Inc. Costeja contended that, when an internet user entered his name in the search engine of the Google group ("Google Search"), the list of results would display links to two pages of La Vanguardia's newspaper, of January and March 1998. Those pages in particular contained an announcement for a real-estate auction organised following attachment proceedings for the recovery of social security debts owed by Costeja.
With that complaint, Costeja requested, first, that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appeared) or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Costeja stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future. Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD's decision should be annulled. It is in this context that the Spanish court referred a series of questions to the Court of Justice.
Court of Justice Proceedings Edit
The Court of Justice found first that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine "collects" data within the meaning of the 1995 Data Protection Directive (Directive). The Court considered, furthermore, that the operator, within the framework of its indexing programmes, "retrieves," "records" and "organises" the data in question, which it then "stores" on its servers and "discloses" and "makes available" to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the Directive, must be classified as "processing," regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The Court also pointed out that the operations referred to by the Directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the Directive in such a case would have the consequence of largely depriving the Directive of its effect.
The Court further held that the operator of the search engine is the controller" in respect of that processing, within the meaning of the Directive, given that it is the operator which determines the purposes and means of the processing. The Court observes that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the Directive's requirements. This is the only way that the guarantees laid down by the Directive will be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.
As regards the Directive's territorial scope, the Court observes that Google Spain is a subsidiary of Google Inc. in the Spanish territory and, therefore, an "establishment" within the meaning of the Directive. The Court rejected the argument that the processing of personal data by Google Search is not carried out buy the establishment in Spain. The Court held that where such data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member State, has an establishment in a Member State, the processing is carried out ‘in the context of the activities' of that establishment, within the meaning of the Directive, if the establishment is intended to promote and sell, in the Member State in question, advertising space offered by the search engine in order to make the service offered by the search engine profitable.
On the extent of responsibility of the operator of the search engine, the Court held that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of search results for that person's name. The Court made it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
The Court pointed out that processing of personal data carried out by such an operator enables any internet user, when he makes a search on the basis of an individual's name, to obtain, through the search results, a structured overview of the information relating to that individual on the internet. The Court also observed that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty. Internet users may thereby establish a more or less detailed profile of the person searched against. Furthermore, the effect of the interference with the person's rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous. In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the search engine has in the data processing.
However, inasmuch as the removal of links from the search results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, the Court held that a fair balance should be sought in particular between that interest and the data subject's fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court observed that, whilst it is true that the data subject's rights also override, as a general rule, that interest of internet users, this balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject's private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
Finally, in response to the question whether the Directive enables the data subject to request that links to web pages be removed from the search results on the grounds that he wishes the information appearing on those pages relating to him personally to be "forgotten" after a certain time, the Court held that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the Directive, the links and information in the search results must be erased. The Court observed that even initially lawful processing of accurate data may, in the course of time, become incompatible with the Directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.
The Court added that, when appraising such a request made by the data subject in order to oppose the processing carried out by the operator of a search engine, it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from the search results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.
The Court pointed out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.
- Court of Justice of the European Union, Press Release No. 70/14, Luxembourg, May 13, 2014, Judgment in Case C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (full-text).
External resources Edit
- Google's 'Search removal request under European Data Protection law' form.
- Rights Groups Slam 'Right to be Forgotten' Ruling as Censorship.
- List of Links Removed Due to 'Right To Be Forgotten' Enactment.
- Europe and The Right to Be Forgotten: A Memorable Victory for Privacy or Defeat for Free Speech?