AEPD (Spain) - EXP202205791

AEPD - PD-00157-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 17 GDPR §93 LPDPGDD
Type:	Complaint
Outcome:	Upheld
Started:	27.04.2022
Decided:
Published:	19.09.2022
Fine:	n/a
Parties:	Google LLC
National Case Number/Name:	PD-00157-2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Michelle Ayora

The Spanish DPA reprimanded Google LLC for not responding to a request for erasure of personal data under Article 17 GDPR within the required time limit.

English Summary

Facts

The data subject requested Google LLC (the controller) to delete from its search engine specific Uniform Resource Locators (URLs) which linked to their personal data. The data subject claimed that their personal data was published without consent. However, the controller did not provide any reponse to the erasure request within the required time limit.

As a result, the data subject complained to the Spanish DPA. During the proceedings, the controller blocked the requested URLs, exceeding the one month time limit for responding to an access or erasure request.

Holding

The DPA recalled the controller's obligation to answer requests regarding data subject rights contained in Articles 15 to 22 GDPR in the period of one month or, depending on the complexity of the request, at least provide a justification for the delay.

In this case, the DPA also referred to the case law of the CJEU, specifically judgement C-131/12, and the Spanish Supreme Court about the right to be forgotten. The DPA made the following observations.

Firstly, the right to be forgotten can be found in Article 17 GDPR and Article 93 of the LOPDGDD, the Spanish data protection law. It establishes a right to request, among others, search engines to erase from the list of results links that contain personal data. However, this right is not unlimited. It must be balanced with conflicting interests of the public, including their right of access to information as well as freedom of expression. In order to balance the interests at stake, aspects such as the type of information, the time of the publication, if the information is of public interest or not should be taken into consideration.

Secondly, according to case law, search engines are considered controllers. They process information available on the internet, collect data, register, and organise it according to their indexing programmes, retain it in their servers and make it available to users. Hence, they control the purposes and means of processing.

Thirdly, the right of data subjects to directly request search engines to erase their data is essential due to the importance of Internet nowadays. The DPA held that a request cannot be simply ignored. An answer must be issued by the controller, even when no data of the requesting party was processed. Furthermore, the controller is obliged to require the correction of the deficiencies observed or, where appropriate, deny the request indicating the reasons and considering the above-discussed law.

In the present case, the information available through the URL links was considered personal data not related at all to the data subject's professional life or of public interest. In light of the above, the DPA upheld the complaint, claiming that the requested data should have been deleted. However, the DPA did not fine the controller because they proceeded to comply with the request during the course of the proceedings.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/9










     File No.: EXP202205791



                           RESOLUTION No.: R/00775/2022

Considering the claim made on April 27, 2022 before this Agency by A.A.A. (a
hereinafter the complaining party), against GOOGLE LLC (hereinafter the

claimed), for not having been duly attended to your request to exercise
rights established in Regulation (EU) 2016/679 of the European Parliament and of the
Council of April 27, 2016 regarding the protection of natural persons in relation to
regarding the processing of personal data and the free circulation of these data
(hereinafter GDPR).


Carrying out the procedural actions provided for in Title VIII of the Law
Organic 3/2018, of December 5, on the Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), the following have been verified:



                                       FACTS

FIRST: The complaining party exercised the right of suppression in relation to the
URL that you transcribe in your claim against the one claimed, without your request having
received the legally established response.


The complaining party points out that personal data is published in the search engine without its consent.
consent and request that they not be associated in the search results of the url/s
referenced in the claim, which are known by the parties.


Provides various documentation related to the claim filed with this Agency and
on the exercise of the exercised right.

SECOND: Once the procedure provided for in article 65.4 of the LOPDGDD has been completed,
the claim was admitted for processing and the claimed entity was granted processing of
hearing, so that within a period of fifteen working days it could present the allegations that

deemed convenient.

The entity claimed, on the occasion of the formalized procedures, has accredited before
this Agency have attended to the right exercised and sent to the complaining party the
proper response to your request.



                           FOUNDATIONS OF LAW

FIRST: The Director of the Spanish Agency for

Data Protection, in accordance with the provisions of section 2 of article 56 in
relation to section 1 f) of article 57, both of the RGPD; and in article 47 of the
LOPDGDD.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/9








SECOND: In accordance with the provisions of article 55 of the RGPD, the Agency
Spanish Data Protection is competent to perform the functions that
are assigned to it in its article 57, among them, that of enforcing the Regulation and

promote awareness of controllers and processors
about the obligations incumbent on them, as well as dealing with claims
presented by an interested party and investigate the reason for them.

Correlatively, article 31 of the RGPD establishes the obligation of those responsible
and those in charge of the treatment to cooperate with the control authority that requests it in

the performance of their duties. In the event that they have appointed a
data protection delegate, article 39 of the RGPD attributes to it the function of
cooperate with that authority.

Similarly, the domestic legal system, in article 65.4 of the LOPDGDD, has

foreseen a mechanism prior to the admission to processing of the claims that are
formulated before the Spanish Agency for Data Protection, which consists of giving
transfer of the same to the data protection delegates designated by the
responsible or in charge of the treatment, for the purposes provided in article 37 of
the aforementioned norm, or to these when they have not been designated, so that they proceed to the
analysis of said claims and to respond to them within a month.


In accordance with this regulation, prior to the admission for processing of the
claim that gives rise to this procedure, it was transferred to the
responsible entity to proceed with its analysis, respond to this Agency
within a month and prove that they have provided the claimant with the due response,

in the event of exercising the rights regulated in articles 15 to 22 of the
GDPR.

The result of said transfer did not allow to understand satisfied the claims of the
claiming party. Consequently, on July 4, 2022, for the purposes

provided for in article 64.2 of the LOPDGDD, the Director of the Spanish Agency for
Data Protection agreed to admit the submitted claim for processing. Saying
agreement of admission to procedure determines the opening of the present procedure of
lack of attention to a request to exercise the rights established in the
articles 15 to 22 of the RGPD, regulated in article 64.1 of the LOPDGDD, according to the
which:


"1. When the procedure refers exclusively to the lack of attention of a
request to exercise the rights established in articles 15 to 22 of the
Regulation (EU) 2016/679, will start by agreement of admission to process, which will be
shall adopt in accordance with the provisions of the following article.

In this case, the term to resolve the procedure will be six months from
from the date on which the claimant was notified of the admission agreement to
Procedure. Once this period has elapsed, the interested party may consider their
claim".


The purging of administrative responsibilities in the framework of the
of a sanctioning procedure, whose exceptional nature implies that it is chosen,
whenever possible, due to the prevalence of alternative mechanisms that have
protection in current regulations.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/9









It is the exclusive competence of this Agency to assess whether there are responsibilities
administrative that must be purged in a sanctioning procedure and, in

consequently, the decision on its opening, not existing obligation to initiate a
procedure before any request made by a third party. Such a decision must
be based on the existence of elements that justify said start of the activity
sanctioning, circumstances that do not concur in the present case, considering that
With this procedure, the guarantees and guarantees are duly restored.
claimant's rights.


THIRD: The rights of individuals in terms of data protection
personal data are regulated in articles 15 to 22 of the RGPD and 13 to 18 of the
LOPDGDD. The rights of access, rectification, deletion,
opposition, right to limitation of treatment and right to portability.


The formal aspects related to the exercise of these rights are established in the
articles 12 of the RGPD and 12 of the LOPDGDD.

It also takes into account what is expressed in Considerations 59 and following of the
GDPR.


In accordance with the provisions of these rules, the data controller
must arbitrate formulas and mechanisms to facilitate the interested party in the exercise of their
rights, which will be free (without prejudice to the provisions of articles 12.5 and 15.3
of the RGPD), and is obliged to respond to the requests made no later than one

month, unless you can show that you are unable to identify the
interested party, and to express his reasons in case he was not going to attend said
request. The proof of compliance with the duty of
respond to the request to exercise their rights made by the affected party.


The communication addressed to the interested party on the occasion of their request must
be expressed in a concise, transparent, intelligible and easily accessible manner, with a
clear and simple language.

FOURTH: The right to be forgotten is contemplated in article 17 of the RGPD, as well as in
Article 93 of the LOPDGDD, on the right to be forgotten in Internet searches, which

determines, in section 1, the following:

"1. Everyone has the right to have Internet search engines remove
of the lists of results that were obtained after a search carried out from
your name the published links that contained information related to that person

when they are inadequate, inaccurate, irrelevant, out of date or excessive or
have become such over time, taking into account the
purposes for which they were collected or processed, the time elapsed and the nature and
information public interest.


You should proceed in the same way when the personal circumstances that in your
If the affected party invokes evidence of the prevalence of their rights over the
maintenance of the links by the Internet search service.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/9








This right will subsist even when the conservation of the information is lawful.
published on the website to which the link was directed and you did not proceed through it
prior or simultaneous deletion”.


As stated in the Judgment of the Supreme Court of January 11, 2019 "This
fundamental right to oblivion is not an unlimited right - upholds the doctrine
constitutional -, because, although the Constitution does not expressly establish limits
specific, based on the principle of unity of the Constitution, are applicable
the limits derived from respect for other fundamental rights, among which

special relevance the freedom of information proclaimed in article 20 of the
Constitution".

As regards the nature of the search engine as data controller,
It should be noted that a search engine is a tool that makes it easier for the Internet user to

access to certain web pages. To do this, the tool accesses a list of
previously indexed links and offers the user a list of web addresses
that refer to pages in which the words selected by the user appear.

The Judgment of the Court of the European Union of May 13, 2014 declares the
Next:


Section 28: (...) “by exploring the Internet in an automated, constant and
systematically in search of the information that is published there, the manager of a search engine
search collects such data that it extracts, registers and organizes later in the
framework of its indexing programs, keeps on its servers and, where appropriate,

communicates and facilitates access to its users in the form of results lists of its
searches. Since these operations are explicitly listed and
unconditional in Article 2(b) of Directive 95/46, must be qualified as
treatment in the sense of said provision, without it being relevant that the manager of the
search engine also perform the same operations with other types of

information and do not distinguish between it and personal data”.

Section 33: “Now, the operator of the search engine is the one who determines the
purposes and means of this activity and, thus, of the processing of personal data that
performs the same within the framework of this and, therefore, must be considered
responsible for said treatment by virtue of the aforementioned article 2, letter d”.


Section 35: “In this regard, it should be noted that the treatment of
personal data carried out in the framework of the activity of a search engine
differs from that carried out by the editors of Internet sites, which consists of making
include that data on a page on the Internet, and it is added to it”.


Consequently, the Court of Justice considers that the operator of the engine of
Search is responsible for data processing when determining the purposes and
means of their activity.


In relation to the possibility of exercising the right of suppression before the search engine of
Internet without going to the person in charge of the website, The Court of Justice of the Union
European Union, in Judgment of May 13, 2014, (case C-131/12), has indicated:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/9








“(…) a data processing (…) carried out by the manager of a search engine,
can significantly affect the fundamental rights to respect for life
privacy and protection of personal data when the search carried out

using that search engine is carried out from the name of a
natural person, since said treatment allows any Internet user to obtain
via the results list a structured view of the information relating to this
person who can be found on the Internet, potentially affecting a multitude of
aspects of his private life, which, without said motor, would not have been interconnected or only
could hardly have been and thus allows him to establish a

more or less detailed profile of the person in question. Furthermore, the effect of
interference in said rights of the interested party is multiplied due to the important role
Internet and search engines play in modern society, which
make the information contained in such a result list ubiquitous (see,
in this sense, the judgment eDate Advertising and others, C-509/09 and C-161/10,

EU:C2011:685, paragraph 45)”.

“The Court of Justice maintains that the removal of links from the list of results
based on the name of the natural person affected by the dissemination of the news could
have an impact on the legitimate interest of Internet users potentially interested
in having access to the information in question, so it is necessary to seek a fair

balance between this interest and the fundamental right of the affected person with
under Articles 7 and 8 of the Charter of Fundamental Rights of the Union
European.”

“(…) to respect the rights established by these provisions, provided that

actually meet the requirements set out in them, the manager of a search engine
search is required to remove from the list of results obtained after a
search carried out from the name of a person links to web pages,
published by third parties and that contain information relating to this person, also
in the event that this name or this information is not previously or

simultaneously of these web pages, and, where appropriate, although the publication in said
pages is in itself lawful.”

Consequently, the processing of personal data carried out by the manager
of a search engine allows a "name" to obtain a list of
results that offer information about a person that may affect their scope

private. Once the interested party has submitted his request for deletion of his
personal data before the search engine, you must examine it and proceed, in your
case, to the deletion of the specific links from the list of results, without prior or
simultaneously you have to go to the person in charge of the website.


Likewise, from the foregoing it is also deduced that they must be weighed, in each
specific case, the rights and interests in conflict in order to determine what
law prevails.

In order to carry out the weighting task, the Judgment of the

Supreme Court, number 545/2015, of October 15, 2015, which states that "the
called "digital right to be forgotten", which is a concretion in this field of
rights derived from the quality requirements of the processing of personal data,
does not support everyone building a past to their measure, forcing publishers

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/9








of web pages or the managers of search engines to eliminate the treatment
of your personal data when associated with facts that are not considered positive.


Nor does it justify that those who expose themselves publicly can
demand that a curriculum be built to their liking, controlling the discourse about themselves
themselves, eliminating negative information from the Internet, "positioning" their
I crave the results of Internet searches, so that the most favorable
occupy the top positions. If this thesis were admitted, they would be seriously disturbed
information mechanisms necessary for citizens to adopt their

decisions in the democratic life of a country”.

Equally relevant is the doctrine contained in the judgment of the High Court
National, of June 21, 2019, which specifies, in its fifth right foundation, what
following, in relation to information related to the professional life of the

interested:

“(…) General doctrine that is also developed in sections 81, 93 and 97 of the
repeated Judgment of the CJEU - of May 13, 2014- when indicating that, despite
that prevalence, a fair balance must be sought between the legitimate interest of
Internet users in having access to information in a search to be seen on the

name of a person and the fundamental rights of the same and can be
that, for specific reasons such as the role played by the aforementioned
interested in public life, the interference with his fundamental rights is
justified by the preponderant interest of said public in having, as a result of this
inclusion, access to the information in question.


In the present case, entering into the weighting of the rights and interests in
game, it should be noted first, that it refers to the professional life of the
claimant, businessman, and not to personal life, since this is very relevant for
modulate the intensity that the protection of the law regulated in art.

18.4 of the Constitution, as this Chamber has pointed out in the Judgments of May 11
2017 -appeal No. 30/2016-, and June 6, 2017 -appeal No. 1,797/2015-“.

In this regard, reference should be made to the guidelines of the Working Group of the
29 on the right to be forgotten (Guidelines on the implementation of the Court of
Justice of the European Union Judgment on “Google Spain and inc v. AEPD and Mario

Costeja” C-131/12), according to which: “There is a basic difference between the private life of
the person and public or professional life. The availability of information in
search results become more acceptable the less information you reveal
about a person's private life (...) the information is more likely to have
relevance if it is related to the professional life of the interested party, but it will depend

of the nature of the work of the interested party and the legitimate interest of the public in having
access to that information through a search by name- (...)”.

When the information refers to private persons, the Constitutional Court has
declared that "even when the news for the matter to which it refers concerns the

public interest, is not protected by freedom of information - in this case
freedom of expression - all its content, but it can be considered disproportionate the
transmission of those facts that, within the news, affect the honor or the
privacy of the person concerned and that are revealed as "manifestly

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/9








unnecessary and irrelevant to the public interest of the information» (SSTC 105/1990,
of June 6, FJ 8, and 121/2002, of May 20, FJ 5).


Likewise, in order to assess the public relevance of the matter, it must be analyzed whether the
published information continues to be of general interest due to the time that has elapsed.
On this issue, the National High Court has declared, in its judgment dated 8
of November 2017, the following: “in addition, unlike the first link, it has not
Excessive time has elapsed between the date on which the request for
cancellation before the search engine and the date of publication of the news. Indeed,

from the date the news was published (August 2011) and the date you exercised
the right of cancellation (July 2015) not even four years have passed, without
that the fact that it is an archive, given the terms that concur in the
case and as previously stated, affect said conclusion”.


In this regard, the aforementioned Judgment of the Court of Justice of the European Union
declares in its section 93 the following: "even an initially lawful treatment of
accurate data may, over time, become incompatible with that Directive when
these data are no longer necessary in relation to the purposes for which they were collected
or treated. This is the case, in particular, when they are inappropriate, not relevant or already
irrelevant or excessive in relation to these purposes and the time elapsed.”


FIFTH: Once the documentation in the file has been examined, it is observed
that after performing a search based on the name of the complaining party, access is
a list of results in which the questioned URL(s) appear, being published
information and data of a personal nature that have nothing to do with activity

professional or public interest, therefore, the right to protection of
data of the complaining party on the right to freedom of expression and information.

Keeping the information spread can bring disrepute on personal life
of the complaining party that occurs in the rights to honor, privacy and protection

of personal data, therefore, it is understood that the processing of data is not
necessary, so there is an interference in the fundamental right in this regard
of the private life of the complaining party, for all these reasons, it is necessary to proceed to the
deindexation of personal data from controversial URLs and that are not
accessible through an internet search to be seen on the name of the
complaining party, in order to avoid the dissemination of information that may be harmful

to the rights invoked, prevailing the autonomous right to data protection
against freedom of expression and information as it does not have relevance and public interest.

In the present case, the complaining party exercised the right of suppression before the
claimed, in relation to the URL(s) referenced in the claim.


Once the term established in accordance with the aforementioned regulations has elapsed, your request
did not obtain the legally required response.

The aforementioned regulations do not allow the request to be ignored as if it were not

would have raised, leaving it without the answer that must necessarily be issued by the
responsible, even in the event that there is no data of the interested party in the
files of the entity or even in those cases in which it does not meet the
foreseen requirements, in which case the addressee of said request is also

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/9








obliged to require the correction of the deficiencies observed or, where appropriate,
deny the request with reasons indicating the reasons why it is not appropriate
consider the law in question.


Therefore, the request that is formulated obliges the person in charge to give an express response, in
In any case, using any means that justifies receipt of the
reply.

In this case, however, it is clear that during the processing of the claim that gives

place to the present procedure, formulated precisely because of this lack of response
appropriate to the request for the exercise of rights, the respondent has provided
documentation accrediting the communication sent to the interested party according to the
right, proceeding to block the URL(s) in question, or informing about the
decision made on the application. This response, therefore, occurs

once the established term has passed.

Based on the foregoing, considering that this procedure has as
object that the guarantees and rights of those affected are duly
restored, combining the information in the file with the regulations
referred to in the preceding sections, it is appropriate to estimate for formal reasons the

this claim, as the response was issued extemporaneously, without
requires the performance of additional actions by the person in charge of the
treatment in order to issue a new certification on the care of the right.



Considering the aforementioned precepts and others of general application,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: ESTIMATE for formal reasons the claim made by A.A.A., with
NIF ***NIF.1, against the entity GOOGLE LLC. However, the issuance of

new certification by said entity, having issued the response
extemporaneously, without requiring the performance of additional actions by
part of the person responsible for the file.

SECOND: NOTIFY this resolution to A.A.A. and GOOGLE LLC.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure (article 18.4 of the LOPD),
and in accordance with the provisions of article 123 of Law 39/2015, of 1

October, of the Common Administrative Procedure of the Public Administrations,
may optionally file an appeal for reconsideration before the Director of the
Spanish Agency for Data Protection, within a period of one month from the
day following notification of this resolution, or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,

in accordance with the provisions of article 25 and section 5 of Provision
Additional Fourth of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative, within two months from the day after


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/9











to the notification of this act, as provided in article 46.1 of the aforementioned text
legal.



                                                                                                1159-090920
Sea Spain Marti

Director of the Spanish Data Protection Agency































































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es