Content Regulation / Censorship, Privacy, Data Protection and Retention, Defamation / Reputation
Hegglin v. Google
Nominations Are Now Open for the 2024 Columbia Global Freedom of Expression Prizes. Learn more and nominate here.
Closed Mixed Outcome
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
This case is available in additional languages: View in: العربية
Following the 2014 ruling of the European Court of Justice in Google Spain SL v. Spanish Data Protection Agency (AEPD), which recognized the right to be forgotten, the AEPD issued several orders directing Google Spain to remove certain information related to Spanish nationals. Google Spain challenged these orders arguing that as a subsidiary of Google Inc. it lacked control over the content because its function was limited to the promotion of services and acquisitions. On appeal, the Administrative Chamber of the Supreme Court of Spain agreed, determining that Google Inc. was the only controller of data and that it therefore was solely responsible for content removal.
Leading to the present appeal before the Administrative Chamber of the Supreme Court of Spain, the AEPD issued several orders, requesting Google Spain to take down personal information on the basis of the right to be forgotten. Google Spain challenged the orders, arguing that its function is limited to the promotion of services and acquisitions and that it does not interfere with content or search engine management. Google Spain therefore argued that it cannot be regarded as the “controller” of data within the meaning of the EU Directive 95/46/EC, the Spanish Law 15/1999 of Data Protection, as well as the 2014 ruling of the European Court of Justice in Google Spain SL v. Agencia Española de Protección de Datos.
Initially, the National Court of Spain rejected Google Spain’s position, reasoning that Google Inc. and its local subsidiary form a business unit and that the latter was an indispensable part of the search engine’s operation. Google Spain appealed this decision to the Administrative Chamber of the Supreme Court of Spain.
The main issue before the Administrative Chamber of the Supreme Court was whether Google Spain, as a subsidiary of California-based Google Inc., could be considered as a data controller and therefore responsible for the removal of information deemed contrary to an individual’s right to be forgotten.
Based on the 2014 ruling of the European Court of Justice in Google Spain SL v. Agencia Española de Protección de Datos, EU Directive 95/46/EC, Spanish Law 15/1999 of Data Protection, and Data Protection Working Party Opinion 1/2010, the Court found that a data controller is the entity that determines the means and purposes of personal data processing. With regard to Internet search engines, the Administrative Chamber held that the data controller finds and indexes information posted or published by third parties, and temporarily stores it and makes it available for online users.
In this case, the Administrative Chamber found that Google Spain’s function was limited to promoting products and advertising services. It held that while the European Court of Justice had already determined that Google Inc. and its subsidiary were “inextricably linked,” Google Spain lacked the required functions in order to be regarded as a data controller.
The Administrative Chamber ruled that Google Inc. is exclusively in charge of determining purposes, conditions, and means of the treatment of data and therefore, Google Spain is not responsible for the data and cannot therefore be required to comply with the orders of the AEPD.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
While the underlining issue related to this case deals with balancing the right to be forgotten with the public’s right to information, the Court’s decision instead focuses on the nature of the entity that controls the information. The Court found that Google Spain did not find and index information and that it therefore lacked the required functions in order to be regarded as the data controller of data – it was only concerned with corporate marketing and acquisitions. Google Spain could therefore not be required obliged to comply with the orders of the Spanish data protection authority.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Case significance refers to how influential the case is and how its significance changes over time.
The judgment is binding within Spain. Readers should note that only days later, in Don Alfonso v. Google Spain, the Civil Chamber of the Court entered a conflicting judgment holding that that Google Spain could be held liable for content for the purposes of civil claims.
Let us know if you notice errors or if the case analysis needs revision.