Google and Co. must delete personal data if necessary

The operator of an Internet search engine is responsible for the processing of personal data that appears on websites published by third parties. Therefore, if a link to an Internet page containing information about a person appears in the list of results of a search carried out on the basis of that person's name, the person may contact the search engine operator directly in order to obtain, under certain conditions, the removal of the link from the list of results or, if the search engine operator does not comply with the person's request, the competent authorities.

A Union Directive aims to protect the fundamental rights and freedoms of natural persons, in particular the right to privacy, with respect to the processing of personal data, while removing obstacles to the free flow of such data.

In 2010, Mr Mario Costeja González, a Spanish citizen, lodged a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) against La Vanguardia Ediciones SL, the publisher of a daily newspaper widely read in Spain, particularly in Catalonia, and against Google Spain and Google Inc. He claimed that when he entered his name in the Google group's search engine ("Google Search"), internet users were shown links in the list of results to two pages of the daily newspaper La Vanguardia from January and March 1998. On these pages, among other things, the auction of a property was announced, which was connected to an attachment for debts that Mr Costeja González had with the social security.

Mr Costeja González requested that La Vanguardia be ordered either to delete or modify the pages in question so that the personal data concerning him would no longer be displayed there, or to make use of certain technical possibilities made available by search engines in order to protect that data. He also requested that Google Spain or Google Inc. be ordered to delete or hide personal data concerning him so that they did not appear in the search results or in the links to La Vanguardia. Mr Costeja González claimed in this context that the attachment which had affected him had been fully settled for years and no longer deserved to be mentioned.

The complaint was rejected by the AEPD in so far as it was directed against La Vanguardia on the grounds that the publisher had lawfully published the information in question. The complaint against Google Spain and Google Inc. was upheld. The AEPD requested these two companies to take the necessary measures to remove the data in question from their index and to prevent access to it in the future. Google Spain and Google Inc. brought two actions before the Audiencia Nacional (Spain) to annul the AEPD's decision. In this context, the Spanish court referred a number of questions to the Court of Justice for a preliminary ruling.

In today's judgment, the Court finds, first, that the operator of a search engine, by automatically, continuously and systematically seeking out information published on the internet, carries out a 'collection' of data within the meaning of the directive, data which it then 'reads out', 'stores' and 'organises' with its indexing programs, 'keeps' on its servers and, where appropriate, 'transmits' and 'makes available' to its users in the form of lists of results. These operations, which are expressly and without limitation referred to in the Directive, must, in the Court's view, be regarded as 'processing operations' irrespective of whether the search engine operator applies them indiscriminately to information other than personal data. The operations referred to in the directive must, as the Court points out, be regarded as processing even if they contain only information which has already been published in exactly the same way in the media. If a general exception were made to the application of the Directive in such cases, it would largely be rendered meaningless.

The Court classifies the search engine operator, since it decides on the purposes and means of such processing, as the 'controller' within the meaning of the Directive. Since the activities of a search engine are additional to those of the publishers of websites, and since they may significantly affect the fundamental rights to respect for private life and the protection of personal data, the search engine operator must ensure, within the limits of its powers and possibilities, that its activities comply with the requirements of the directive.

Only in this way can the safeguards provided for in the Directive be fully effective and effective and comprehensive protection of data subjects, in particular their private life, actually be achieved.

As regards the territorial scope of the directive, the Court states that Google Spain is a subsidiary of Google Inc. in Spain and therefore an 'establishment' within the meaning of the directive. It rejects the argument that the processing of personal data carried out by Google Search is not carried out in the context of the activities of that establishment in Spain, stating that, where personal data are processed for the purposes of operating a search engine by an undertaking which is established in a non-member country but has an establishment in a Member State, the processing is carried out 'in the context of the activities' of that establishment within the meaning of the directive where the establishment has the task, in the Member State concerned, of promoting the sale of the search engine's advertising space in order to make its service profitable and of ensuring that sale itself.

As regards the extent of the search engine operator's liability, the Court then states that, under certain conditions, the search engine operator is obliged to remove from the list of results displayed following a search carried out on the basis of a person's name links to internet pages published by third parties containing information about that person.

Such an obligation may also exist if the name or information in question is not deleted from these Internet pages beforehand or at the same time, where applicable even if their publication there is lawful as such.

The Court points out in that regard that a processing of personal data carried out by such a search engine operator makes it possible for any internet user, when carrying out a search on the basis of the name of a natural person, to obtain from the list of results a structured overview of the information available about him on the internet. Moreover, these potentially concern numerous aspects of private life and could not have been linked, or only with great difficulty, without the search engine. Internet users can thus create a more or less detailed profile of the persons they are looking for. The impact of the interference with the rights of the data subject is further increased by the significant role of the internet and search engines in modern society, which give ubiquity to the information contained in the lists of results. Because of its potential seriousness, such interference cannot, in the Court's view, be justified solely on the basis of the search engine operator's economic interest in processing the data.

However, the removal of links from the list of results may, depending on the information concerned, have an impact on the legitimate interest of internet users potentially interested in accessing the information. The Court therefore considers that a fair balance must be struck between that interest and the fundamental rights of the data subject, in particular the right to respect for private life and the right to protection of personal data. While the rights of the data subject also generally prevail over the interest of internet users, the balance may, in particular cases, depend on the nature of the information concerned, its sensitivity to the private life of the data subject and the interest of the public in having access to the information, which may vary, inter alia, according to the role played by the person in public life.

As regards the question whether, under the Directive, the data subject may request that links to internet pages be deleted from such a list of results because he wishes the information contained therein about him to be 'forgotten' after a certain period of time, the Court states that the information and links contained in the list of results must be deleted if, at the request of the data subject, it is established that, at the present time, the inclusion of the links in the list of results is incompatible with the Directive. Even processing of factually accurate data that was originally lawful may, over time, no longer comply with the provisions of the Directive if, having regard to all the circumstances of the case, in particular the time that has elapsed, the data are not adequate, relevant or excessive in relation to the purposes for which they were processed. If the data subject objects to the data processing carried out by the search engine operator, it is necessary to examine, inter alia, whether he or she has a right to no longer have the relevant information about him or her associated with his or her name at the present time through a list of results displayed following a search carried out on the basis of his or her name. If this is the case, the links to Internet pages containing this information shall be removed from the list of results, unless there are specific reasons, such as the role of the person concerned in public life, which justify an overriding interest of the public at large in having access to this information through such a search.

The Court clarifies that such requests may be addressed by the data subject directly to the search engine operator, who must then carefully examine their merits. If the controller does not comply with the requests, the data subject may turn to the supervisory authority or the competent court to carry out the necessary verifications and order the controller to take certain measures accordingly.

NOTE: By way of a reference for a preliminary ruling, the courts or tribunals of the Member States may, in proceedings pending before them, refer questions to the Court of Justice on the interpretation of Union law or on the validity of a Union act. The Court of Justice shall not rule on the national dispute. It shall be for the national court or tribunal to dispose of the case in accordance with the decision of the Court of Justice. That decision of the Court of Justice shall similarly bind other national courts or tribunals before which a similar issue is raised.

 

Judgment in Case C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González

 

Source: Press release of the Court of Justice of the European Union

 

Goldberg Attorneys at Law 2014

Attorney at Law Michael Ullrich, LL.M (Information Law)

Specialist lawyer for information technology law

E-mail:info@goldberg.de

Seal