Personal data--protection of individual privacy--right to be forgotten--responsibility of Internet search engine operators--European data protection Directive 95/46/EC
Google Spain SL v. Agencia Espanola de Proteccion de Datos (AEPD). Case C-131/12. At http://curia.europa.eu.
Court of Justice of the European Union (Grand Chamber), May 13, 2014.
In Google Spain v. AEPD, (1) the Grand Chamber of the Court of Justice of the European Union (Court or ECJ) upheld a decision by the Agencia Espanola de Proteccion de Datos (Spanish Data Protection Agency or AEPD) that the Internet search engine operator Google is responsible for the processing it carries out of personal data that appear on web pages published by third parties. The ruling endorses an expansive view of the jurisdiction of the European Union (Union or EU) over those who, like Google, process data anywhere in the world and firmly establishes a "right to be forgotten" under the European data protection Directive 95/46/EC (Directive). (2)
The case stems from the 1998 publication of two announcements in La Vanguardia, a newspaper widely circulated in Spain, concerning a real-estate auction connected with attachment proceedings prompted by then-outstanding social security debts. The data subject, Mario Costeja Gonzalez, was mentioned as the owner of the social security debts. At a later date, an electronic version of the newspaper was made available online by its publisher.
In November 2009, Costeja Gonzalez informed the newspaper that, when his name was entered in the Google search engine, a reference appeared to the pages carrying the announcements on the real-estate auction. He argued that the attachment proceedings related to his social security debts had been concluded and resolved many years earlier and were now of no relevance. The newspaper replied that erasure of his data was not appropriate, since the original publication had been properly ordered by the Ministry of Labor and Social Affairs.
In February 2010, Costeja Gonzalez asked Google Spain to delete any links to the newspaper when his name was entered in the Google search engine. Google Spain forwarded the request to Google Inc., whose registered office is in California. Google Inc. declined to take the links down.
Costeja Gonzalez then filed a formal complaint with the AEPD under the Spanish Organic Law No. 15/1999 on the Protection of Personal Data, which transposes the Directive. (3) He sought an order directing the publisher to remove or alter the pages in La Vanguardia so that his personal data did not appear, or in the alternative to use the tools made available by search engines to shield his personal data. He also sought an order directing Google Spain or Google Inc. to remove or conceal his data so that they ceased to be included in the search results, revealing links to the newspaper.
In July 2010, the AEPD upheld the complaint and directed Google Spain and Google Inc. to take the measures necessary to withdraw the data in question from their index and to prevent future access to that information. At the same time, however, the AEPD rejected the complaint against La Vanguardia on the basis that the data had been lawfully published by it.
Google Spain and Google Inc. then brought actions before the Audiencia Nacional (4) seeking annulment of the AEPD decision. It is in this context that the Audiencia Nacional referred a series of questions to the European Court of Justice.
In June 2013, the advocate general issued a preliminary opinion (5) that Google could not be considered the "controller" of the processing of such personal data within the meaning of Article 2(d) of the Directive, (6) since it does not index or archive personal data contrary to the instructions or requests of the publisher of the web page (in this case, La Vanguardia). The advocate general also concluded that neither the individual right to erasure and blocking of data, provided for in Article 12(b), nor the right to object, provided for in Article 14(a), confers on the data subject a right to address himself directly to Google to prevent the indexing of information relating to him personally that was published legally on third parties' web pages. In the advocate general's view, data subjects who consider that information might be prejudicial to them should direct such requests to the publisher (as the controller of the data, in this case La Vanguardia) rather than to Google (which is merely a "processor").
In its decision, the ECJ ruled against the advice of the advocate general on these points, which is unusual. The Court made four separate findings. First, it ruled that Google is not simply a "processor" of data as that term is defined under EU law but also a controller of personal data on third-party web pages. According to the Court, since a search engine determines the purposes and means of the processing operations, it must be regarded as the controller of that processing. As a controller, Google has greater obligations to protect data under the Directive than a processor, including to respond to requests from data subjects for deletion or rectification.
Second, the ECJ ruled that a search engine's indexing of information that includes personal data...