Tirol

14. Google Spain and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario
Costeja González

DOCTRINE: In sum, the Court ruled that “the operator of a search engine is obliged to remove from the
list of results displayed following a search made on the basis of a person’s name links to web pages,
published by third parties and containing information relating to that person, also in a case where that
name or information is not erased beforehand or simultaneously from those web pages, and even, as
the case may be, when its publication in itself on those pages is lawful.”

FACTS: In 1998, La Vanguardia newspaper of Spain published two articles concerning an attachment and
garnishment action against Costeja González. In 2009, he contacted the newspaper, asserting that when
his name was entered in Google.com, there was still a reference to the pages of the newspaper
concerning the legal action. González argued that the information should be removed because the
proceedings were concluded years earlier and that there was no outstanding claim against him. The
newspaper, however, denied his demand, claiming that the legal action was published pursuant to an
order by Spain’s Ministry of Labor and Social Affairs. Then in 2010, he contacted Google Spain, arguing
that the online search results of his name should not make reference to the newspaper’s publication of
his legal proceedings.

In March 2010, and upon Google's failure to comply, González brought a complaint before Spain’s Data
Protection Agency against the newspaper, Google Spain, and Google Inc. The Agency dismissed the
action against the newspaper, reasoning that the publication was made pursuant to a government order.
But it upheld the complaint against Google and its subsidiary, Google Spain. It held that because the
operators of Internet search engines process personal data, they are subject to relevant privacy
legislation and can be under the obligation to remove information that compromise the fundamental
right to privacy.

Subsequently, Google Inc. and Google Spain brought separate appeals against the decision. The National
High Court of Spain stayed the proceedings and presented a number of questions to the European Court
of Justice concerning the applicability of the EU Directive 95/46 (protection of personal data) to the
Internet search engines.ISSUES: Whether or not the evidence subject of the imputed offense had been
obtained in violation of his constitutional rights against unreasonable search and seizure and privacy of
communication.

ISSUE: Whether on the basis of legitimate grounds to protect the right to privacy and other fundamental
rights envisioned by the Directive, operators of Internet search engines are obligated to remove or erase
personal information published by third party websites, even when the initial dissemination of such
information was lawful.

RULING: YES.

Article 1 of Directive 95/46 obligates EU States to protect “the fundamental rights and freedoms of
natural persons, and in particular their right to privacy with respect to the processing of personal data.”
At the same time, it prohibits restrictions on the free flow of personal data between the EU members.
The Directive defines personal data as “any information relating to an identified or identifiable natural
person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in
particular by reference to an identification number or to one or more factors specific to his physical,
physiological, mental, economic, cultural or social identity.” The act of processing such information
includes “any operation or set of operations which is performed upon personal data, whether or not by
automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or
combination, blocking, erasure or destruction.” Under Article 2(d), a “controller” of personal data is any
“natural or legal person, public authority, agency or any other body, which alone or jointly with others
determines the purposes and means of the processing of personal data.”

Regarding whether the Directive as implemented by the national laws of Spain can be applied to Google
as a “controller” of processing personal data, the Court records indicated that Google Spain was
established in 2003 by Google Inc. to primarily act as its commercial agent in Spain “to promote,
facilitate and effect the sale of on-line advertising products and services to third parties and the
marketing of that advertising.” Under Article 4(1)(a), the provisions of the Directive are applicable where:

The processing is carried out in the context of the activities of an establishment of the controller
on the territory of the Member State; when the same controller is established on the territory of
several Member States, he must take the necessary measures to ensure that each of these
establishments complies with the obligations laid down by the national law applicable.

By taking into account the objectives of the Directive and the wording of Article 4(1)(a), the Court held
that Google is subject to the provisions because its subsidiary Google Spain is an establishment in Spain
“intended to promote and sell, in that [country], advertising space offered by the search engine, which
serves to make the service offered by that engine profitable.”

Lastly, the Court addressed the extent of Google’s responsibility as an Internet search engine with
respect to personal information published by third party websites and subsequently sought to be
removed or altered by the data subject. Applicable provisions here are Article 12(b) and 14(a) of the
Directive. Under Article 12(b), every personal data subject has the right to obtain from controller “as
appropriate the rectification, erasure or blocking of data the processing of which does not comply with
the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data.”
Article 14(a) also grants the data subject the right to “object at any time on compelling legitimate
grounds relating to his particular situation to the processing of data relating to him, save where
otherwise provided by national legislation. Where there is a justified objection, the processing instigated
by the controller may no longer involve those data.”

Article 8 of the EU Charter of Fundamental Rights states that “[e]veryone has the right to the protection
of personal data concerning him or her. [And] [s]uch data must be processed fairly for specified purposes
and on the basis of the consent of the person concerned or some other legitimate basis laid down by
law. Everyone has the right of access to data, which has been collected concerning him or her, and the
right to have it rectified.” As implemented under Articles 6, 7, 12, 14, and 28 of the Directive 95/46, the
Court also stressed the importance of balancing the right to privacy against the right to information
access.
In sum, the Court ruled that “the operator of a search engine is obliged to remove from the list of results
displayed following a search made on the basis of a person’s name links to web pages, published by third
parties and containing information relating to that person, also in a case where that name or information
is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when
its publication in itself on those pages is lawful.” The Court also held that individuals whose personal
data are publicly available through Internet search engines may “request that the information in
question no longer be made available to the general public on account of its inclusion in such a list of
results” as their rights to privacy and protection of personal data override “not only the economic
interest of the operator of the search engine but also the interest of the general public in having access
to that information upon a search relating to the data subject’s name.” The Court, however, emphasized
that the right to initiate such request may cease to exist when access to personal information “is justified
by the preponderant interest of the general public in having, on account of its inclusion in the list of
results, access to the information in question.”

DISPOSITIVE: N/A