The Court of Justice of the European Union creates precedent according

to which Google must erase personal data subsequent to a request by

the person concerned

The case Google Spain SL, Google Inc. v Agencia Española de

Protección de Datos, Mario Costeja González (referred to as Google
Spain v. Costeja Gonzalez) was decided before the Court of Justice of
the European Union. The decision was issued on 25 June 2013. It
constitutes a landmark for human rights in the digital age.

Case History

On 5 March 2010, a Spanish citizen, Mario Costeja Gonzalez, filed a

claim before the Spanish Authority for Personal Data Protection
(AEPD) against a Spanish newspaper, Google Spain SL and Google Inc.
The applicant complained that any Internet user, who typed his name
in the Google search engine, would receive as a result two
publications by some Spanish newspaper regarding a confiscation
order for his house. The applicant requested that the newspaper
erased his name from the publications and that Google removed his
personal data in issue from the results it provides to its users. He
argued that the confiscation procedure against his house had long
been terminated and that any reference to it was totally irrelevant at
present.

The Spanish Data Protection Authority dismissed the claim regarding

the newspaper, but approved it regarding Google. According to the
Authority, the newspaper was not obliged to repeal the publications,
since they were lawfully published during the date on which they had
been issued. On the contrary, it found that search engines are
personal data processors and consequently Google Spain and Google
Inc. had to erase the personal data, subsequently to the application
filed by Mr. Costeja Gonzalez. The Authority based its decision on EU
Directive 1995/46/EU.

Subsequently, Google Spain and Google Inc. appealed, against the

aforementioned decision before the High Court of Spain. The latter
referred a series of questions to the Court of Justice of the European
Union (CJEU) regarding the correct implementation of the Directive.
The questions concerned whether Google is subject to the notion of
the processor of personal data and also whether, as an EU
corporation, is subject to the provisions of the Directive. In case of a
negative response, the High Court requested from the CJEU to
determine Google’s liability as a data processor and assess whether a
citizen has the right to request from Google to erase his personal
data, namely the right to be forgotten.

The CJEU decision

The CJEU found that Google is indeed a processor of personal data,

since it “collects such data which it subsequently ‘retrieves’, ‘records’
and ‘organises’ within the framework of its indexing programmes,
‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes
available’ to its users in the form of lists of search results” and since
it determines the purposes and means of this processing. The Court
also found that Google Spain is an affiliated company of Google Inc.
and therefore, Google Inc. is subject to the EU Directive.

One of the main points of the decision concerns the legal obligations
which search engines, such as Google, have, according to the
Directive. The Court found that search engines have the right to
process personal data, when this is necessary in order for the
legitimate interest of the data holder or third parties to be served.

This right is not absolute. It may be limited when it contests the

interests or the fundamental rights of the data subject –especially its
right to privacy. The Court underlined that the economic interests of
the search engine are not enough to impose limitations on the right
to privacy. The Court also reminded that the right to privacy in
principle prevails over the right of the public to gain access to
personal data of a non-public figure.

The Court decided that the data subject has undoubtedly a legitimate
interest to deny the disclosure of its personal data, even if such
disclosure is not harmful to it. This right is founded on its right to
privacy. Consequently, the data subject –in the present case Mr.
Costeja Gonzalez- can request the erasure of his data, if the
information disclosed are “inadequate, irrelevant or no longer
relevant, or excessive in relation to the purposes of the processing at
issue carried out by the operator of the search engine”. In such an
event, not only the data subject has the pertinent right, but also the
data controller has the obligation to erase the data.
With this decision, the Court found that Mario Costeja Gonzalez had
the right to request the erasure of his personal data from Google,
while the latter had the obligation to erase them. Thus, this decision
acknowledged the right to be forgotten for data subjects and the
pertinent obligation for the data controller.

Commentary on the Decision

This decision is of great significance. It created precedent upon

which subsequent rulings of the Court may be justified. Furthermore,
national courts’ judgements may be based upon its reasoning or the
opinions of the minority. We already see that the General Data
Protection Regulation (GDPR) institutionalizes the right to be
forgotten, in a way which constitutes a logical continuation of the
decision at issue. It is therefore very important for the decision to be
analysed and commented.

It must be underlined that the decision does not seem to distinguish

between the consequences of removing data from a search engine
and removing them from a website. The publication of data in a
single website has significantly fewer consequences for the right to
privacy and personal data protection than the disclosure of the same
data in a search engine. The capability of the search engine to collect
information, to aggregate them, to publish them as a whole and
therefore create a whole profile for the user is something which may
not be done by a single website. Thus, the data published in a search
engine can be accessed by a wider public and can create a whole
digital personality for a person. This reasoning was used by the Court
in its judgement.

According to the same way of thinking, the removal of data from a

search engine has much more important consequences than the
removal of data from a website. The first influences in a much more
substantial way the right to be informed. When someone searches for
information regarding a person, it is much more probable that he
searches for this information by typing the name of the said person
in a search engine rather than searching for it in every single
website, in which he considers that this name is possibly mentioned.
Therefore, if the personal data of a person are removed from a search
engine, the right to privacy of the said person and his personal data
are more adequately protected than if such data are removed from a
website. The right of the public to be informed is correspondingly
affected. The latter is safeguarded under the Charter of Fundamental
Rights of the EU Article 11. Although the Court noted the difference
between the data processing by a search engine and a website, it did
not deal with the right to be informed in the same way, despite the
fact that the latter is influenced in a different fashion in the two
cases.

Furthermore, the Court seems to consider only public interest

reasons as capable of imposing limitations to the right to privacy and
personal data protection. The right to be informed should be
mentioned and used as a reason for delimiting the aforementioned
rights. The protection of personal data is of great importance.
However, it cannot be absolute. There are cases in which other rights
–and not only public interest reasons- prevail and should be taken
into account in the attempt to strike a fair balance. Thus, the Court
should have included the right to be informed as a right, which
should be weighted with the right to be forgotten. The outcome of
this case would not have been different. However, this judgement
may have serious implications in future cases. For this reason, the
Court should have included this thought and should have referred to
the EU Charter 11 in a more detailed fashion. The right to privacy and
personal data protection prevail over the right to be informed. In any
case, the two rights should be weighted by the Court, which should
take into account the circumstances of the specific case.

Another very important point which was not clarified by the decision
is the geographical implementation of the right to be forgotten,
namely whether the right is implemented beyond the EU
boundaries. Very strong arguments exist for both options. The issue
will probably be clarified in the case Google v. France, pending before
the same Court.

Much criticism has also been raised regarding the extended

definition the Court gave to the notion of “personal data
controller”. According to this criticism, not only search engines, but
also their users, might be considered to be personal data controllers.
This criticism has fallen short of substance, since the General Data
Protection Regulation seems to define adequately the notion of
“personal data controller”. Certainly, the implementation of the
Regulation by the Court in cases to come is anticipated with great
interest.