The CJEU endorses the "right to be forgotten" in the EU

Paul David
(via Flickr)

On 13 May 2014, the Court of Justice of the European Union (CJEU) handed down its judgment in case no. C-131/12 between Google and the Spanish Data Protection Agency (AEPD).

On 5 March 2010, Mr. Costeja González filed a complaint with the AEPD against the publisher Vanguardia Ediciones S.L., Google Spain, S.L. and Google Inc. In the complaint he requested that La Vanguardia be required to remove or alter pages so that his personal data no longer appeared, or to use certain tools made available by search engines in order to protect the data. Mr. Costeja González also requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia. All these requests were based on the fact that the embargo proceedings to which Mr. Costeja González had been subjected at the time had been fully resolved for a number of years and were now entirely irrelevant.

On 30 July 2010 the AEPD dismissed the complaint against the publisher and upheld the complaint against Google Spain, S.L. and Google Inc., requiring them to withdraw the data from their index and prevent future access thereto. Google Spain, S.L. and Google Inc. proceeded to lodge appeals against the Audiencia Nacional (Spain’s High Court) requesting that the AEPD’s judgment be vacated.

Under these circumstances, the Audiencia Nacional suspended the proceedings and referred a series of preliminary questions to the CJEU:

• The territorial application of EC Directive 95/46;
• The definition of the scope of responsibility of search engines as providers of content in relation to EC Directive 95/46;
• And the scope of the right of erasure and the right to object in relation to the right to be forgotten.

First of all, the CJEU classified the activity of a search engine which consists of “finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference” as “processing of personal data”, thus converting the operator of the search engine into the controller of that processing of personal data, and the guarantor that the requirements of EC Directive 95/46, as well as the full and effective protection of the rights of the individuals in question, be fulfilled.

Turning to the territorial application, the CJEU rejected Google’s argument that Google Search did not carry out the processing of personal data as part of its activities in Spain. The CJEU ruled that Google Spain, S.L. must be regarded as an establishment within the meaning of Directive, since it is the subsidiary of Google Inc. in Spain. When a company with a seat in a third state has an establishment in a Member State and carries out the processing of personal data for the purposes of the service of a search engine in the Member State establishment, the Directive considers that this processing is carried out ‘in the context of the activities’ of the establishment if the intention is to promote and sell its goods and services in that Member State.

With regard to the extent of the responsibility of search engines as content providers in relation to the Directive, the CJEU stated that the controller of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages published by third parties and containing information relating to that person.  The CJEU added that this obligation also exists in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even when the publication is lawful. According to the CJEU, a structured overview of the information relating to the individual in question may potentially affect his private life.

The CJEU in turn identified the need to consider the user’s right to access information on the one hand, and the affected individual’s right to protect his personal data on the other. This balance depends on the nature of the information in question and the role played by the affected individual in public life.

Finally, the CJEU introduced the possibility that after a certain time the affected individual may exercise his right to be forgotten and request that the list of results obtained be removed. If it is found that the list of results is at this point in time incompatible with the Directive, the information and the links displayed therein must be removed. These results are to be deemed incompatible when they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.

This judgment affects more than 220 appeals lodged by Google against decisions issued by the AEPD that are currently pending before the Spanish Audiencia Nacional.

Authors: Cristina Espín, Alejandra Reyes

Visit our website: http://www.elzaburu.es/