AEPD (Spain) - TD/00185/2019

AEPD (Spain) - TD/00185/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 17 GDPR Article 21 GDPR Article 4(1)(a) of Directive 95/46/EC Article 12(b) of Directive 95/46/EC Article 14(a) of Directive 95/46/EC
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	23.10.2019
Published:	04.11.2019
Fine:	None
Parties:	Google LLC anonymous
National Case Number/Name:	TD/00185/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DAP ordered Google to delist an article based on the "right to be forgotten".

English Summary

Facts

The AEPD issued a decision related to the right to be forgotten under Directive 95/46/EC. Google LLC (Google Spain, S.L) did not respond to a deletion request.

Holding

The AEPD ordered Google LLC to comply with a request to delete personal data. It mainly based its decision on the CJEU judgement in C-131/12 and request the delisting of links containing personal data (a name) without the authorisation of the publishers.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Spanish original for more details.

1035-150719File No.: TD/00185/2019RESOLUTION No.: R/00498/2019 
In view of the complaint made to this Agency by Mr. A.A.A., against GOOGLE LLC (GOOGLE SPAIN, S.L.), for not having been duly attended to its right of suppression, the procedural actions provided for in Title VIII of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), have been carried out, and the following have been established

FACTS
FIRST: On June 18, 2018, Mr. A.A.A.  (hereinafter, the complainant) exercised a right of withdrawal in relation to a URL against GOOGLELLC(GOOGLE SPAIN, S.L.hereinafter, the complainant), specifically requesting the withdrawal of a review published in Google MyBusiness accessible in the URL: ***URL.

SECOND: Dated May 20, 2019, in accordance with Article 65.4 of the Organic Law 3/2018 of December 5, Protection of Personal Data and Guarantee of Digital Rights and for the purposes provided for in Article 64.2, the Director of the Spanish Data Protection Agency agreed to admit the claim presented by the claimant against the respondent and agreed to postpone the claim, so that within fifteen working days he could present the allegations that he considered appropriate and the parties were informed that the maximum period for resolving the procedure would be six months, for which reason the following allegations were made, in summary:
GOOGLE states in its submissions in the course of these proceedings that the request for withdrawal of a review published in Google My Business was refused, with reasons.In the course of these proceedings, Google Ireland Ltd. has again examined the application and has decided to withdraw the review in question on the ground of infringement of the content policies of Google My Business. The complainant was informed of this on 17 June 2019. 
On June 27, 2019, this Agency, through the support of the Electronic Notification Service and Authorized Management (platform C/Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es Notific@), made available to the claimant the allegations presented by the respondent, so that within fifteen days the allegations they consider appropriate are sent to this Agency. On 5 July 2019, the Notifica@ system automatically rejected the notification on the grounds that 10 calendar days had passed since the notification had been made available without its content being accessed.

LEGAL GROUNDS

FIRST: The Director of the Spanish Data Protection Agency is competent to decide, in accordance with the provisions of Article 56(2) in relation to Article 57(1)(f), both of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, RGPD); anddin Article 47 of the Organic Law 3/2018 of December 5,,onnPersonal Data Protection anddGuarantee of Digital Rights (hereinafter referred too as LOPDGDD).

SECOND: Article 64.1 of the LOPDGDD, provides that: "1. When the procedure refers exclusively to the lack of attention to a request to exercise the rights established in articles 15 to 22 of Regulation (EU) 2016/679, it will be initiated by an agreement of admission to procedure, which will be adopted in accordance with the provisions of the following article.   Once this period has expired, the interested party may consider his or her claim to be accepted.

THIRD: Article 17 of the RGPD provides the following: "1.  The interested party shall have the right to obtain without undue delay from the person responsible for the processing the deletion of the personal data concerning him, who shall be obliged to delete the personal data without undue delay when any of the following circumstances occura) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) the data subject withdraws the consent on the basis of which the processing was carried out in accordance with Article 6(1)(a) or Article 9(2)(a) and the processing is not based on another legal basis; C/ Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es (c) the data subject opposes the processing according to Article 21(1) and no other legitimate grounds prevail or the data subject opposes the processing according to Article 21(2); (d) the personal data have been processed unlawfully; (e) the personal data must be deleted for the fulfilment of a legal obligation under Union law or national law applicable to the controller; (f) the personal data have been collected in connection with the supply of information society services mentioned in Article 8(1). 2. Where he has made personal data public and is required, pursuant to paragraph 1, to delete such data, the controller shall, taking into account the technology available and the cost of implementation, take reasonable steps, including technical measures, to inform the controllers who are processing the personal data of the request of the data subject to delete any link to such personal data or any copy or replica thereof. 3. Paragraphs 1 and 2 shall not apply where processing is necessary: (b) in order to comply with a legal obligation requiring the processing of data imposed by Union law or by law of the Member States on the controller or in order to carry out a task carried out in the public interest or in the exercise of public authority vested in the controller; (c) for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and (3); (d) for archiving purposes in the public interest, for the purposes of scientific or historical research or for statistical purposes, in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to make impossible or seriously impede the achievement of the objectives of such processing; or (e) for the purpose of lodging, exercising or defending complaints.

FOURTH: With regard to the nature of the search engine as the party responsible for the processing, it should be pointed out that a search engine is a tool that facilitates access to certain web pages for Internet users. To do this, the tool accesses a list of links previously indexed and offers the user a list of web addresses that refer to pages that contain the words selected by the user. The European Union Court of Justice ruling of 13 May 2014, in paragraph 28, states that "when exploring the Internet in an automated, constant and constant manner, the user must take into account the following factors The manager of a search engine systematically searches for the information published there and collects this data, which he then extracts, records and organises within the framework of his indexing programmes, keeps on his servers and, where appropriate, communicates and provides access to his users in the form of lists of search results.   Since those operations are explicitly and unconditionally laid down in Article 2(b) of Directive 95/46, they must be classified within the meaning of that provision, without it being relevant that the search engine manager also carries out the same operations with other types of information and does not distinguish between those and the personal data (...Paragraph 33: However, it is the search engine manager who determines the purposes and means of this activity and thus of the processing of personal data by the search engine in the framework of this activity and therefore he should be considered responsible for such processing under the above-mentioned Article 2(d).Paragraph 35: In this connection, it should be noted that the processing of personal data in the context of a search engine activity is distinct from and additional to that carried out by website publishers, which consists in placing those data on a web page.Paragraph 41: (...) the activity of a search engine, which consists in finding information published or made available on the Internet by third parties, automatically indexing it, temporarily storing it and finally making it available to Internet users according to a given order of preference, must be regarded as processing of personal data within the meaning of the said Article 2(b) where that information contains personal data and, secondly, the manager of a search engine must be regarded as being responsible for that processing within the meaning of the said Article 2(d)."'Consequently, the Court considers that the manager of the search engine is the controller of the data in determining the purposes and means of its activity.

FIFTH: As regards the applicable legislation, the following should be noted: The judgment of the Grand Chamber of the Court of Justice of the European Union of 13 May 2014, in accordance with Article 4(1)(a) of Directive 95/46/EC, considers, in paragraphs 55, 56, 57 and 60, that: "the processing of personal data carried out in the alphabetical order of a search engine such as Google Search, managed by aC/Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es an undertaking which has its registered office in a non-member country but is established in a Member State, is carried out in the context of the activities of that establishment if it is intended to promote and sell in that State the advertising space of the search engine, which serves to make the service offered by the search engine profitable.In those circumstances, the activities of the manager of the search engine and those of his establishment situated in the Member State concerned are inextricably linked, since the activities relating to the advertising space constitute the means of making the search engine in question economically profitable and since that engine is, at the same time, the means by which those activities can be carried out (...) the very submission of personal data on a result page of a search result page constitutes a processing of those data. Since that presentation of results is accompanied, on the same page, by the presentation of advertising linked to the search terms, it is necessary to declare that the processing of personal data in question takes place in the context of the advertising and commercial activity of the establishment of the controller in the territory of a Member State, in this case Spain (...).) must be interpreted as meaning that personal data are processed in the context of the activities of an establishment of the controller dedicated to processing in the territory of a Member State, within the meaning of that provision, where the manager of a search engine establishes in the Member State a branch or a subsidiary intended to ensure the promotion and sale of advertising space offered by that engine and whose activity is directed at the inhabitants of that Member State.

SIXTH: With regard to the possibility of exercising the right of cancellation before the search engine without going to the person in charge of the website, the above-mentioned judgment of the Court of Justice of the European Union, in paragraphs 80 and 88, states that "a processing of data (...) is a form of processing which is not subject to the requirements of the directive.) carried out by the manager of a search engine may significantly infringe the fundamental rights to respect for private life and to protection of personal data where the search carried out by means of that search engine is conducted on the basis of the name of a natural person, This is because such processing enables any internet user to obtain, by means of the list, a structured view of the information concerning that person that can be found on the internet, potentially affecting a multitude of aspects of his life, which, without that engine, would not have been interconnected or could only have been very difficult, and which thus enables him to establish a more or less detailed profile of the person concerned. Moreover, the effect of the interference with the rights of the person concerned is multiplied by the important role played by the Internet and search engines in modern society, which makes the information contained in such a list of results ubiquitous (see, to that effect, the judgment in eDate Advertisin and Others, C-509/09 and C-161/10, EU:C2011:685, paragraph 45).C/ Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es .) in order to respect the rights established by these provisions, provided that they actually comply with the requirements established in them, the manager of a search engine is obliged to remove from the list of results obtained after a search has been carried out on the basis of a person's name, links to web pages published by third parties and which contain information relating to this person, also in the event that this name or this information is not previously or simultaneously deleted from this web page, and, where appropriate, even if the publication on these pages is in itself lawful."Consequently, the processing of personal data by the manager of a search engine allows a list of results to be obtained from a "name" that provides information about a person that may affect his or her privacy. Once the person concerned has submitted his request for deletion of his personal data to the search engine, he must examine it and, if necessary, delete the specific links from the list of results, without first contacting the person responsible for the website.

SEVENTH: In the present case, after examining the documentation submitted by the parties, it is noted that the complainant exercised its right before GOOGLE, but specifically requests the removal of a review published in "Google My Business" accessible at the URL already referenced and Google within the time limit answers that, having decided not to carry out any action in relation to that URL.Therefore, in the case analyzed here, it is accredited that the party exercised its right to delete a review accessible through the URL in dispute with Google and its request did not receive the legally required response.However, during the course of these proceedings, Google has decided to withdraw the review in question due to a breach of the content policies, and this allegation has been transferred to the complainant, without the latter having presented any allegation against it.Consequently, with the resolution of this claim, the right of the claimant has been restored. In view of the aforementioned precepts and others of general application, the Director of the Spanish Data Protection Agency

RESOLVED:
FIRST: TO ESTIMATE, for formal reasons, the claim formulated by Mr. A.A.A. against the entity GOOGLE LLC (GOOGLE SPAIN, S.L.). However, the issuance of a new certification by said entity is not appropriate, since it has carried out the requested suppression, without requiring the performance of additional actions on the part of the claimant.

SECOND: NOTICE this resolution to A.A.A.and GOOGLE LLC (GOOGLESPAIN, S.L.).C/ Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es