The operator of an internet search engine bears responsibility for the processing of personal data displayed on third-party websites. Consequently, an individual whose name-based search yields a link to a webpage containing information about them in the results list may directly petition the search engine operator to have the link removed, subject to specific conditions. Should the operator fail to comply with this request, the individual may escalate the matter to the relevant authorities.
A Union directive seeks to safeguard the fundamental rights and freedoms of natural persons, particularly the right to privacy, in the context of personal data processing, while concurrently eliminating impediments to the free flow of such data.
In 2010, Mr. Mario Costeja González, a Spanish national, lodged a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) against La Vanguardia Ediciones SL, the publisher of a widely distributed daily newspaper in Spain, particularly in Catalonia, and also against Google Spain and Google Inc. He contended that when his name was entered into the Google Group's search engine ("Google Search"), users were presented with search results linking to two pages from the La Vanguardia newspaper dating from January and March 1998. These pages, inter alia, announced the auction of a property connected to an attachment for debts Mr. Costeja González owed to social security.
Mr. Costeja González petitioned for La Vanguardia to be directed either to delete or amend the pertinent pages to ensure that personal data pertaining to him would no longer be displayed, or to employ specific technical functionalities offered by search engines for data protection. Furthermore, he requested that Google Spain or Google Inc. be instructed to delete or obscure personal data concerning him, thereby preventing its appearance in search results or in links to La Vanguardia. In this regard, Mr. Costeja González maintained that the attachment he had faced had been entirely settled for years and no longer merited public disclosure.
The AEPD dismissed the complaint against La Vanguardia, reasoning that the publisher had lawfully disseminated the information. Conversely, the complaint against Google Spain and Google Inc. was upheld. The AEPD mandated these two entities to implement requisite measures to expunge the relevant data from their index and preclude future access. Google Spain and Google Inc. subsequently initiated two actions before the Audiencia Nacional (Spain) to annul the AEPD's decision. In this context, the Spanish court referred several questions to the Court of Justice for a preliminary ruling.
In its ruling today, the Court initially establishes that a search engine operator, through the automatic, continuous, and systematic detection of information published on the internet, undertakes a "collection" of data as defined by the Directive. This data is subsequently "extracted," "stored," and "organized" by its indexing programs, "retained" on its servers, and, where applicable, "disseminated" and "presented" to its users in the form of search results. These operations, explicitly enumerated in the Directive without limitation, are deemed "processing" by the Court, irrespective of whether the search engine operator applies them indiscriminately to data beyond personal information. The Court further clarifies that the operations specified in the Directive constitute processing even when they exclusively involve information already published verbatim in other media. Granting a general exemption from the Directive's application in such instances would largely undermine its efficacy.
The Court designates the search engine operator as the "controller" for processing under the Directive, given its determination of the purposes and means of such processing. As a search engine's operations complement those of website publishers and can substantially impact fundamental rights to privacy and personal data protection, the operator is obligated, within its purview of responsibility and capabilities, to ensure its activities adhere to the Directive's stipulations.
This is the sole mechanism through which the Directive's safeguards can achieve their full efficacy, thereby ensuring the genuine realization of effective and comprehensive protection for data subjects, particularly concerning their private lives.
Concerning the Directive's territorial scope, the Court clarifies that Google Spain, as a subsidiary of Google Inc. located in Spain, constitutes an "establishment" under the Directive. It refutes the assertion that personal data processing by Google Search falls outside the activities of this Spanish establishment, reasoning as follows: When a company domiciled in a third country, yet possessing an establishment in a Member State, processes personal data for search engine operations, such processing is deemed to occur "in the context of the activities" of that establishment, provided its mandate includes promoting and selling the search engine's advertising space within that Member State to ensure the profitability of its service.
Addressing the scope of a search engine operator's liability, the Court subsequently determines that, under specific circumstances, the operator is obligated to remove links from search results—generated by a name-based query—that direct to third-party websites containing information about that individual.
This obligation may persist even if the relevant name or information is not concurrently or previously expunged from those websites, and potentially even if its publication thereon is inherently lawful.
In this context, the Court emphasizes that the processing of personal data by a search engine operator allows any internet user, when performing a name-based search for a natural person, to gain a structured overview of available online information. This information often pertains to numerous facets of private life and would be difficult, if not impossible, to interconnect without the search engine. Consequently, internet users can construct a more or less comprehensive profile of the individuals in question. The magnitude of this infringement on data subjects' rights is amplified by the pervasive role of the internet and search engines in contemporary society, which imbue search result information with ubiquity. Given its potential gravity, such an infringement, in the Court's estimation, cannot be solely justified by the search engine operator's commercial interest in data processing.
Nevertheless, the removal of links from search results may, contingent on the specific information, impact the legitimate interest of internet users seeking access to that information. The Court therefore posits that an equitable balance must be established between this interest and the fundamental rights of the data subject, specifically the right to privacy and the right to personal data protection. While the data subject's rights generally supersede the interests of internet users, in exceptional circumstances, this balance may hinge on the nature of the information, its sensitivity to the data subject's private life, and the public's interest in accessing it, which can vary based on factors such as the individual's role in public life.
Addressing whether the data subject can, under the Directive, demand the removal of links to webpages from a search results list, based on a desire for information about them to be "forgotten" after a certain period, the Court rules that information and links in the results list must be deleted if, upon the data subject's request, it is determined that their current inclusion is incompatible with the Directive. Even an initially lawful processing of factually accurate data may, over time, cease to comply with the Directive's provisions if, considering all case-specific circumstances—especially the elapsed time—the data no longer aligns with, is no longer relevant for, or exceeds the purposes for which it was processed. Should the data subject challenge the search engine operator's data processing, it must be assessed, inter alia, whether they possess a right for the pertinent information about them to no longer be associated with their name via a name-based search results list at the present time. If such a right exists, links to webpages containing this information must be expunged from the results list, unless exceptional grounds, such as the individual's role in public life, justify an overriding public interest in accessing this information through such a search.
The Court clarifies that data subjects may submit such requests directly to the search engine operator, who is then obliged to meticulously assess their validity. Should the data controller decline the requests, the data subject may appeal to the supervisory authority or the competent court, enabling these bodies to conduct requisite investigations and issue appropriate directives to the controller for specific actions.
NOTE: Through a preliminary ruling procedure, national courts of Member States, in cases pending before them, may refer questions to the Court of Justice regarding the interpretation of Union law or the validity of a Union act. The Court of Justice does not adjudicate the national dispute itself. It is incumbent upon the national court to resolve the case in conformity with the Court of Justice's decision. This decision of the Court of Justice is equally binding on other national courts confronting similar legal issues.
Judgment in Case C-131/12, Google Spain SL, Google Inc. / Agencia Española de Protección de Datos, Mario Costeja González
Source: Press release of the Court of Justice of the European Union
Goldberg Attorneys at Law 2014
Attorney Michael Ullrich, LL.M (Information Law)
Specialist Attorney for Information Technology Law
Email :info@goldberg.de
