Google Spain SL v Agencia Española de Protección de Datos

Mario Costeja González, a Spanish national, made a complaint to the Spanish Data Protection Agency (AEPD) against La Vanguardia newspaper, Google Spain and Google Inc, in relation to pages in the newspaper which appeared in Google search results when his name was searched for. The pages contained an announcement for a real estate auction following proceedings for the recovery of social security debts owed by Mr Costeja González.

The AEPD rejected the claim against La Vanguardia as the information had been lawfully published by it, but upheld the complaint against both Google entities and requested that they take the necessary measures to withdraw the personal data from their indexes. Google Spain and Google Inc brought actions before the High Court seeking to have the AEPD decision annulled. The Spanish High Court referred the matter to the CJEU under the preliminary ruling procedure.

1) Do the activities Google carries out in compiling its search results constitute activities covered by the Data Protection Directive (Directive 95/46)? In particular:

a) Does Google undertake data processing?

b) Is Google a data controller?

2) Is the Data Protection Directive territorially applicable to Google’s activities?

3) Do the rights of the data subject extend to requesting that search engines remove personal data?

1) The activities Google undertakes are covered by the Directive.

a) In compiling its search results Google undertakes activities which are expressly referred to in Art 2(b) of the Directive and are classified as data processing. These include collecting, retrieving, recording, organising, storing, disclosing and making available data. That Google does not alter the data and that it also carries out the same operations on other types on information not distinguishing between personal data and other information does not affect this classification.

b) Google determines the “purposes and means of the processing of personal data” which it carries out in compiling its search results. Thus it falls within the definition of “data controller” under Article 2 (d) of the Directive. The fact that it does not exercise control over the contents of the websites which it indexes does not stop it from being a data controller. The Directive envisages there being joint data controllers, and Google and the operator of the website in question may both be data controllers in relation to certain personal data.

2) The test under Article 4(1)(a) of the Directive is whether the processing is carried out “in the context of the activities of an establishment in the territory of a Member State”. It was not disputed that Google activities in Spain constituted an “establishment”. However, Google argued that the data processing did not take place within the EU. This did not matter, the court ruling that the activities of the search engine and those of its establishment situated in Spain which promotes and sells advertising space, were inextricably linked. The advertising activities rendered the search engine economically viable. Thus the processing took place “in the context of” Google’s establishment in Spain.

3) As it comes within the Directive, Google must comply with the rights laid down in its provisions, which includes the rights of data subjects to request that data which is inaccurate, irrelevant or has become irrelevant be removed by the data controller. This includes the personal data processed by search engines.

In assessing whether to do so, a balancing test must be carried out between the rights of the data subject (privacy, data protection), those of the data controller (economic interests) and the interests of internet users (being able to have access to the information, including the right to receive information under Art 10 ECHR). The processing of data by a search engine enables any internet user to access an array of information about a data subjects private life. The interference with the data subject’s rights may therefore be very serious. The economic interests of the search engine in processing the data will not outweigh the data subject’s rights. As a general rule the data subject’s rights will also outweigh those of the public, however, that balance may depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.

The data subject may make the request for removal in the first instance to the data controller, and if not satisfied, may complain to the national data protection supervisory authority.

The obligation on the search engine data controller subsists independently of any obligation on the operator of the website where the information is displayed. As operators of websites may be based elsewhere in the world and not subject to the Directive, or may be able to avail themselves of an exemption (for example the exemption for journalistic purposes) the effective operation of the Directive could not be achieved if there was a need for the data subject to show a parallel obligation on the website operator.

If the personal data has become irrelevant, even if it was relevant and therefore lawful when it was first published the data subject may request its removal in accordance with the Directive. To this extent the data subject may exercise a right to have that information “forgotten”.

A very important case showing the reach of data protection obligations for those operating in the European Union. Google and other search engines will need to establish a system to deal with requests for removal of data which is no longer relevant or is inaccurate.

The court did not analyse in any detail or give guidance as to how the rights of the public to access the complete record online should be weighed against those of the individual. Concerns have been expressed that it is left to search engines to be the judge of what the public can access (or at any rate, access easily via a search engine).

The court was greatly concerned about the additional impact on a data subject’s private life of aggregation of results by search engines, meaning that private information which is available online is a great deal more accessible, and accessible via one place. Whether a domestic court would take the same view is open to question.

With a new EU Data Protection Regulation currently being negotiated, it remains to be seen how the EU framework will deal with the responsibility of search engines, and the so-called “right to be forgotten” in general. The fact that even if results are removed from the EU search engines, they can still be accessed (and the removal effectively bypassed) by searching via the US (or other non-EU country) version of the search engine, has raised questions about the effectiveness of measures such as these when applied to online operators given that they do not apply universally.

Further comment on this case can be found in the 5RB news report here.

Judgment of the CJEU
Press Release of the CJEU