Case Summary and Outcome

Following the 2014 ruling of the European Court of Justice in Google Spain SL v. Spanish Data Protection Agency (AEPD), which recognized the right to be forgotten, the AEPD issued several orders directing Google Spain to remove certain information related to Spanish nationals. Google Spain challenged these orders arguing that as a subsidiary of Google Inc. it lacked control over the content because its function was limited to the promotion of services and acquisitions. On appeal, the Administrative Chamber of the Supreme Court of Spain agreed, determining that Google Inc. was the only controller of data and that it therefore was solely responsible for content removal.

Facts

Leading to the present appeal before the Administrative Chamber of the Supreme Court of Spain, the AEPD issued several orders, requesting Google Spain to take down personal information on the basis of the right to be forgotten. Google Spain challenged the orders, arguing that its function is limited to the promotion of services and acquisitions and that it does not interfere with content or search engine management. Google Spain therefore argued that it cannot be regarded as the “controller” of data within the meaning of the EU Directive 95/46/EC, the Spanish Law 15/1999 of Data Protection, as well as the 2014 ruling of the European Court of Justice in Google Spain SL v. Agencia Española de Protección de Datos.

Initially, the National Court of Spain rejected Google Spain’s position, reasoning that Google Inc. and its local subsidiary form a business unit and that the latter was an indispensable part of the search engine’s operation. Google Spain appealed this decision to the Administrative Chamber of the Supreme Court of Spain.

Decision Overview

The main issue before the Administrative Chamber of the Supreme Court was whether Google Spain, as a subsidiary of California-based Google Inc., could be considered as a data controller and therefore responsible for the removal of information deemed contrary to an individual’s right to be forgotten.

Based on the 2014 ruling of the European Court of Justice in Google Spain SL v. Agencia Española de Protección de Datos, EU Directive 95/46/EC, Spanish Law 15/1999 of Data Protection, and Data Protection Working Party Opinion 1/2010, the Court found that a data controller is the entity that determines the means and purposes of personal data processing. With regard to Internet search engines, the Administrative Chamber held that the data controller finds and indexes information posted or published by third parties, and temporarily stores it and makes it available for online users.

In this case, the Administrative Chamber found that Google Spain’s function was limited to promoting products and advertising services. It held that while the European Court of Justice had already determined that Google Inc. and its subsidiary were “inextricably linked,” Google Spain lacked the required functions in order to be regarded as a data controller.

The Administrative Chamber ruled that Google Inc. is exclusively in charge of determining purposes, conditions, and means of the treatment of data and therefore, Google Spain is not responsible for the data and cannot therefore be required to comply with the orders of the AEPD.