AEPD (Spain) - TD/00071/2020

AEPD - TD/00071/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 17 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	05.09.2020
Fine:	None
Parties:	Google Spain, S.L.
National Case Number/Name:	TD/00071/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

The Spanish Data Protection Agency (AEPD) decided to dismiss the claim of a Spanish citizen against Google Spain, S.L. (the defendant) for not approving his/her right to be forgotten in relation to some URLs.

English Summary

Facts

The decision is the consequence of an investigation procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that he/she had requested his/her right to be forgotten in relation to nine (9) URLs, but this right was not approved by the defendant.

Dispute

The defendant answered to the AEPD investigation requests stating that one (1) of the URLs had been duly erased, and during this procedure, another two (2) URLs were also erased, but it declared that the other six (6) had not been approved as they were referring to the professional life of the Spanish citizen, and not to his/her personal life. The defendant also added that such not-erased-information was related to the activity of the claimant as candidate for different public jobs, so erasing it would not be compliant with the legitimate public interests.

Holding

After obtaining the corresponding evidences, the AEPD understood that, as long as the not-erased-URLs are related to professional and not personal information of the claimant (and that CJEU judgement 13/05/14 clarified that the right to be forgotten can be declined due to the role of the claimant in the public life), they are excluded from the data protection regulation as per Articles 1 and 2 of the GPDR. In this sense, the AEPD decided to dismiss the claim from the Spanish citizen.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

35-150719 File No.: TD / 00071/2020RESOLUTION NO: R / 00249/2020Considering the claim made on December 16, 2019, this Agency by Mr.AAA , against GOOGLE SPAIN, SL , for not having answered your request forexercise of the rights established in the RGPD.The procedural actions provided for in Title VIII of the Law have been carried out.Organic 3/2018, of December 5, Protection of Personal Data and guarantee ofdigital rights (hereinafter LOPDGDD), the following have been verifiedACTSFIRST: On October 24, 2019, Dº AAA (hereinafter, the partclaimant) exercised the right of deletion in relation to nine URLs againstGOOGLE SPAIN, SL (hereinafter, the claimed one).The complaining party indicates that personal data is published without theirconsent and request that your personal data not be associated with the results ofsearch to the following url:1. *** URL.12. *** URL.23. *** URL.34. *** URL.45. *** URL.56. *** URL.67. *** URL.78. *** URL.89. *** URL.9The complaining party provides various documentation related to the claimraised before this Agency and on the exercise of the right exercised.SECOND: Once the procedure provided for in article 65.4 of the LOPDGDD has been completed,The claim was admitted for processing and the claimed entity was grantedhearing, so that within fifteen business days the allegations thatdeemed convenient.In the pleadings, once the procedure provided for in theArticle 65.4 of the LOPDGDD, have formulated, in summary, the considerationsfollowing:C / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/7The defendant manifests in the allegations made during theprocessing of this procedure that, proceeded to block url 9 andthey denied the rest with reason. During the processing of thisprocedure have proceeded to block urls 2 and 6.The rest of the disputed information clearly refers to itsprofessional activity as *** POST.1 and candidate for different competitions andProfessional oppositions, determining circumstance to deny,considering that it is information that transcends the scopepersonal.That, in addition to referring to professional information, present relevance andpublic interest as they are published on institutional web pages 5 of the urls,which would seriously interfere with the legitimate interest of the publicpotentially interested in accessing that information. In the opinion of this part,the processing of personal data is necessary for the exercise ofright to freedom of expression and information.FOUNDATIONS OF LAWFIRST: The Director of the Spanish Agency forData Protection, in accordance with the provisions of section 2 of article 56 inin relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of April 27, 2016 on the protection ofindividuals with regard to the processing of personal data and the freecirculation of these data (hereinafter, RGPD); and in article 47 of the LOPDGDD.SECOND : In accordance with the provisions of article 55 of the RGPD, the AgencySpanish Data Protection is competent to perform the functions thatare assigned to it in its article 57, among them, that of enforcing the Regulation andpromote the awareness of those responsible and those in charge of the treatmentabout their obligations, as well as dealing with claimssubmitted by an interested party and investigate the reason for these.Correlatively, article 31 of the RGPD establishes the obligation of theresponsible and in charge of the treatment to cooperate with the control authoritythat he requests it in the performance of his functions. In the event that these havedesignated a data protection officer, article 39 of the RGPD attributes toThis one the function of cooperating with said authority.Similarly, the domestic legal system, in article 65.4 theLOPDGDD, has provided a mechanism prior to the admission for processing of theclaims that are made before the Spanish Agency for Data Protection, whichconsists of transferring them to the data protection delegatesdesignated by those responsible or in charge of the treatment, for the intended purposesin article 37 of the aforementioned norm, or to these when they have not been designated, toto proceed to the analysis of said claims and to respond to them within the period ofone month.C / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/7In accordance with these regulations, prior to admission for processingof the claim gives rise to this procedure, it was transferred to theresponsible entity to proceed with its analysis, provide a response to this Agencywithin a month and certify having provided the claimant with the proper response,in the event of exercise of the rights regulated in articles 15 to 22 of theRGPD.The result of said transfer did not allow the satisfaction of theclaims of the complaining party. Consequently, for the purposes provided in itsArticle 64.2 of the LOPDGDD, the Director of the Spanish Agency for the Protection ofData agreed to admit the submitted claim for processing. Said admission agreementThe procedure determines the opening of the present procedure of lack of attention of arequest to exercise the rights established in articles 15 to 22 of the RGPD,regulated in article 64.1 of the LOPDGDD, according to which:"one. When the procedure refers exclusively to the lack of attention of arequest to exercise the rights established in articles 15 to 22 of theRegulation (EU) 2016/679, will start by agreement of admission for processing, which isadopt in accordance with the provisions of the following article.In this case, the period to resolve the procedure will be six months fromfrom the date that the claimant was notified of the admission agreement toProcedure. After this period, the interested party may consider hisclaim."The purging of administrative responsibilities is not considered appropriate inthe framework of a sanctioning procedure, the exceptional nature of which implies thatopt, whenever possible, for the prevalence of alternative mechanisms thathave protection in current regulations.It is the exclusive competence of this Agency to assess whether there are responsibilitiesadministrative procedures that must be purged in a sanctioning procedure and, inConsequently, the decision on its opening, there being no obligation to initiate aprocedure before any request made by a third party. Such a decision mustbe based on the existence of elements that justify said start of the activitysanctioning, circumstances that do not concur in the present case, considering thatWith this procedure, the guarantees andClaimant's rights.THIRD : Article 17 of the RGPD provides the following:"one. The interested party shall have the right to obtain without undue delay from the person responsible for thetreatment the deletion of personal data that concerns you, which will beobliged to delete without undue delay the personal data when there is anyof the following circumstances:a) the personal data is no longer necessary in relation to the purposes for whichwere collected or otherwise treated;b) the interested party withdraws the consent on which the treatment in accordance is basedC / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/7with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and this is notbased on another legal basis;c) the interested party opposes the treatment in accordance with article 21, paragraph 1, and does notother legitimate reasons for the treatment prevail, or the interested party opposes thetreatment in accordance with article 21, paragraph 2;d) the personal data has been unlawfully processed;e) personal data must be deleted in order to comply with a legal obligationestablished in the law of the Union or of the Member States that applies to theresponsible for the treatment;f) the personal data have been obtained in relation to the offer of services of theinformation society mentioned in article 8, paragraph 1.2. When you have made the personal data public and are obliged, by virtue of theprovided in section 1, to delete said data, the data controller,taking into account the available technology and the cost of its application, it will adoptreasonable measures, including technical measures, with a view to informingresponsible for processing the personal data of the interested party's request fordeletion of any link to such personal data, or any copy or replica ofthe same.3. Sections 1 and 2 will not apply when the treatment is necessary:a) to exercise the right to freedom of expression and information;b) to comply with a legal obligation that requires data processingimposed by the law of the Union or of the Member States that applies to theresponsible for the treatment, or for the fulfillment of a mission carried out in the interestpublic or in the exercise of public powers conferred on the person responsible;c) for reasons of public interest in the field of public health in accordance withArticle 9, paragraph 2, letters h) and i), and paragraph 3;d) for archival purposes in the public interest, scientific or historical research purposes orstatistical purposes, in accordance with Article 89 (1), insofar asthe right indicated in paragraph 1 could make it impossible or seriously impede-the achievement of the objectives of such treatment, ore) for the formulation, exercise or defense of claims. "FOURTH : In relation to the possibility of exercising the right of deletion before theInternet search engine without going to the person responsible for the website, the Sentencia de la GranChamber of the Court of Justice of the European Union of May 13, 2014, in itsparagraphs 80 and 88, states the following:“(…) A data processing (…) carried out by the manager of a search engine,can significantly affect the fundamental rights of respect for lifeprivacy and protection of personal data when the search carried outC / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/7using this search engine it is carried out from the name of anatural person, since said treatment allows any Internet user to obtainthrough the list of results a structured view of the information related to thisperson that can be found on the Internet, potentially affecting a multitude ofaspects of his private life, which, without said engine, would not have been interconnected or onlycould have been very difficult and thus enables him to establish amore or less detailed profile of the person in question. Furthermore, the effect ofinterference in said rights of the interested party is multiplied due to the important roleplayed by the Internet and search engines in modern society, whichmake the information contained in such a hit list ubiquitous (see,in this sense, the judgment eDate Advertisin et al., C-509/09 and C-161/10,EU: C2011: 685, paragraph 45).(…) To respect the rights established by these provisions, provided thatactually meet the requirements established in them, the manager of asearch is obliged to remove from the list of results obtained after asearch made from a person's name links to web pages,published by third parties and that contain information related to this person, alsoin the event that this name or this information is not deleted prior orsimultaneously of this web pages, and, where appropriate, although the publication in saidpages is in itself lawful. "Consequently, the processing of personal data carried out by theThe manager of a search engine allows a list of search engines to be obtained from a "name".results that provide information about a person that may affect their scopeprivate. Once the interested party has submitted their request to delete theirpersonal data before the search engine, you must examine it and proceed, in yourcase, to the deletion of specific links from the list of results, without prior orsimultaneously you have to go to the person in charge of the website.QINTO: In the present case, the complaining party exercised the right before the complainedin relation to the URLs already referenced.The origin or not of attending, in the present case, therequest that, after a search carried out, your name is not linked tocertain results.On the part of this Agency it has been verified that, when conducting a searchby the name of the complaining party in the Google search engine, URLs 1, 2, 3, 5 and 9 do notresults were obtained and the name of the person concerned does not appear in URL 4.In relation to URLs 6, 7 and 8, it has been verified that personal datapublished, are related to your professional activity. At URL 6, post adocument on some selective tests of the year 2017. URL 7, deals with apublication in the BORME of 2014, on "Registered acts" of entrepreneurs. URL 8,It is about a publication of a City Council in 2017, of an employment exchange.Therefore, these three URLs pour information related to the activityprofessional of this and in accordance with art. 1.1 and 2 of the RGPD, would be excluded from theright to data protection.C / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/7Furthermore, entering into the weighting of the interests at stake,The information provided in said URLs refers to the professional life of the partyclaimant, and not personal life, as this is very relevant to assess theprotection of the right regulated in art. 18 of our Magna CartaThere is a distinction between private life and public or professional life of aperson, therefore, the availability of information in a search resultRegarding the professional or public activity of a person, thede-indexing of the content if it is related to the working life of the interested party,taking into account the nature of the work and the legitimate interest of the public in havingaccess to information through a search by name.The judgment of the CJEU of May 13, 2014 on the right to be forgotten,explains that in general the rights of the interested party prevail to have theinformation about you is no longer linked to your name by a list ofresults obtained after a search from its name, but also explainsthat, this general rule yields for specific reasons with the role that the interested partyperform in public life, and the interference in their rights is fundamentallyjustified by the preponderant interest of the public in having access to informationin question.In this case, it should be noted that the information refers to the partclaimant in his professional activity and is considered of interest to citizens andWith regard to data protection regulations, we are not facing alegitimized treatment, consequently, the exclusion of the data does not proceedpersonal data of the complaining party of the claimed link through a search ininternet to be seen on the name of that person, prevailing the right tofreedom of expression and information against data protection considering thatIt is information that transcends the personal sphere when situated in aprofessional context that continues to be of general interest because it is not obsolete.Based on the foregoing, considering that the present procedure hasas an object that the guarantees and rights of those affected are dulyrestored, combining the information in the file with the regulationsreferred to in the preceding paragraphs, the present claim must be rejected.Considering the cited precepts and others of general application,the Director of the Spanish Agency for Data Protection RESOLVES :FIRST: DISMISS the claim made by D. AAA against GOOGLESPAIN, SL.SECOND : NOTIFY this resolution to D. AAA and GOOGLE SPAIN, SL.In accordance with the provisions of article 50 of the LOPDGDD, theThis Resolution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to administrative proceedings (article 18.4 of theLOPD), and in accordance with the provisions of article 123 of Law 39/2015, of 1C / Jorge Juan 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/7October, of the Common Administrative Procedure of Public Administrations,An appeal for reconsideration may be filed, optionally, before the Director of theSpanish Agency for Data Protection, within a month from theday after notification of this resolution, or directly contentious appealadministrative before the Contentious-Administrative Chamber of the National Court,in accordance with the provisions of article 25 and section 5 of the ProvisionAdditional Fourth of Law 29/1998, of July 13, regulating the JurisdictionContentious-Administrative, within two months from the next dayupon notification of this act, as provided in article 46.1 of the aforementioned textlegal.
Mar España Martí
Director of the Spanish Agency for Data Protection