Case Summary and Outcome

In March 2010, Spanish national Costeja González brought a complaint before the country’s Data Protection Agency against La Vanguardia newspaper, Google Spain, and Google Inc. González wanted the newspaper to remove or alter the record of his 1998 attachment and garnishment proceedings so that the information would no longer be available through Internet search engines. He also requested Google Inc. or its subsidiary, Google Spain, to remove or conceal the data. González argued that the proceedings had been fully resolved for several years and therefore they should no longer appear online. The Agency dismissed the complaint against the newspaper on the ground that the publication was legally justified pursuant to a government order. It, however, upheld the complaint against Google, finding that Internet search engines are also subject to data protection laws and must take necessary steps to protect personal information.

On appeal, the National High Court of Spain stayed the proceedings and presented a number of questions to the European Court of Justice concerning the applicability of the EU Directive 95/46 (protection of personal data) to the Internet search engines. The Court ruled that a search engine is regarded as a “controller” with respect to “processing” of personal data through its act of locating, indexing, storing, and disseminating such information. Additionally, it held that in order to guarantee the rights of privacy and the protection of personal data, operators of search engines can be required to remove personal information published by third party websites. But the data subject’s right to make that request must be balanced against the interest of the general public to access his or her personal information.

---

Facts

In 1998, La Vanguardia newspaper of Spain published two articles concerning an attachment and garnishment action against Costeja González. In 2009, he contacted the newspaper, asserting that when his name was entered in Google.com, there was still a reference to the pages of the newspaper concerning the legal action. González argued that the information should be removed because the proceedings were concluded years earlier and that there was no outstanding claim against him. The newspaper, however, denied his demand, claiming that the legal action was published pursuant to an order by Spain’s Ministry of Labor and Social Affairs. Then in 2010, he contacted Google Spain, arguing that the online search results of his name should not make reference to the newspaper’s publication of his legal proceedings.

Upon Google’s failure to comply, González brought a complaint before Spain’s Data Protection Agency against the newspaper, Google Spain, and Google Inc. The Agency dismissed the action against the newspaper, reasoning that the publication was made pursuant to a government order. But it upheld the complaint against Google and its subsidiary, Google Spain. It held that because the operators of Internet search engines process personal data, they are subject to relevant privacy legislation and can be under the obligation to remove information that compromise the fundamental right to privacy.

Subsequently, Google Inc. and Google Spain brought separate appeals against the decision. The National High Court of Spain decided to stay the proceedings as the assessment of Google’s obligation to protect personal data that are otherwise published on third parties’ websites.

---

Decision Overview

The National High Court of Spain presented the following questions to the European Court of Justice for a preliminary ruling:

(1) Whether the EU Directive 95/46 as implemented through the national legislation of a member State can be applied to a foreign Internet search engine company that has a branch or subsidiary with the intent to promote and sell advertising space geared towards the inhabitants of that member State.

(2) Whether the Internet search engines’ act of locating information published by third parties, and later indexing and making the information available to Internet users can be considered as “processing of personal data” within the meaning of the Directive.

(3) Whether the operator of a search engine must be regarded as a “controller” with respect to the processing of personal data under Article 2(d) of the Directive.

(4) Whether on the basis of legitimate grounds to protect the right to privacy and other fundamental rights envisioned by the Directive, operators of Internet search engines are obligated to remove or erase personal information published by third party websites, even when the initial dissemination of such information was lawful.

Article 1 of Directive 95/46 obligates EU States to protect “the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.” At the same time, it prohibits restrictions on the free flow of personal data between the EU members.

The Directive defines personal data as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.” The act of processing such information includes “any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.” Under Article 2(d), a “controller” of personal data is any “natural or legal person, public authority, agency or any other body, which alone or jointly with others determines the purposes and means of the processing of personal data.”

The European Court of Justice first discussed whether the activity of an Internet search engine can be classified as “processing” personal data within the meaning of Article 2(c) of the Directive. And if the answer is affirmative, whether the operator of a search engine can be regarded as a controller that carries out the processing of personal information. The Court found it indisputable that some or many information indexed and stored by search engines are related to “identifiable natural persons and thus ‘personal data’ within the meaning of Article 2(a) of [the Directive].” And that through its constant and systematic search of online information, an operator of a search engine often collects that personal data, which is subsequently indexed, stored, and made available to Internet users. Accordingly, the Court concluded that Google’s act of collecting, indexing, storing, and disclosing personal data is considered “processing” of such information for the purposes of the Directive.

As to whether Google search engine must be regarded as a “controller” of processing personal data, the Court was of the opinion that the concept of “controller” within the Directive must be interpreted broadly in order to ensure “effective and complete protection of data subjects.” [para. 34] And that it would be contrary to the objectives envisioned in the Directive to exclude the operators of Internet search engines as “they play a decisive role in the overall dissemination of [personal] data.” [para. 36]

Regarding whether the Directive as implemented by the national laws of Spain can be applied to Google as a “controller” of processing personal data, the Court records indicated that Google Spain was established in 2003 by Google Inc. to primarily act as its commercial agent in Spain “to promote, facilitate and effect the sale of on-line advertising products and services to third parties and the marketing of that advertising.” Under Article 4(1)(a), the provisions of the Directive are applicable where:

“the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable.”

By taking into account the objectives of the Directive and the wording of Article 4(1)(a), the Court held that Google is subject to the provisions because its subsidiary Google Spain is an establishment in Spain “intended to promote and sell, in that [country], advertising space offered by the search engine, which serves to make the service offered by that engine profitable.” [para. 55]

Lastly, the Court addressed the extent of Google’s responsibility as an Internet search engine with respect to personal information published by third party websites and subsequently sought to be removed or altered by the data subject. Applicable provisions here are Article 12(b) and 14(a) of the Directive. Under Article 12(b), every personal data subject has the right to obtain from controller “as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data.” Article 14(a) also grants the data subject the right to “object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data.”

Google Spain and Google Inc. argued that based on the principle of proportionally, the removal of personal information must be addressed to the website that published the data and made it publicly available. And that the publisher is in the best position to assess the lawfulness of that information.

In addressing this question, the Court first underscored the fundamental rights to privacy and the protection of personal data. Article 8 of the EU Charter of Fundamental Rights states that “[e]veryone has the right to the protection of personal data concerning him or her. [And] [s]uch data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data, which has been collected concerning him or her, and the right to have it rectified.” As implemented, inter alia, under Articles 6, 7, 12, 14, and 28 of the Directive 95/46, the Court also stressed the importance of balancing the right to privacy against the right to information access.

In light to the above principles, the Court held that Internet search engines are subject to “affect [] the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name.” [para. 80] However, Internet users’ right to access personal information through search engines must also be respected, depending “on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.” [para. 81]

In sum, the Court ruled that “the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.” [para. 88] The Court also held that individuals whose personal data are publicly available through Internet search engines may “request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results” as their rights to privacy and protection of personal data override “not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.” [para. 81] The Court, however, emphasized that the right to initiate such request may cease to exist when access to personal information “is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.” [para. 99]

---