AEPD (Spain) - TD/00101/2016

From GDPRhub
Revision as of 18:23, 12 December 2022 by Mgrd (talk | contribs) (→‎Comment)
AEPD - TD/00101/2016
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 17 GDPR
Article 4 Directive 95/46/CE
Article 16 Ley Orgánica 15/1999
Article 2 Ley Orgánica 15/1999
Type: Other
Outcome: n/a
Started: 15.12.2015
Decided:
Published: 24.11.2022
Fine: n/a
Parties: GOOGLE INC.
Constitucional Court of Spain
National Case Number/Name: TD/00101/2016
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD (ES) (in ES)
Initial Contributor: Mgrd

A decision against Google by the Spanish DPA for not properly attending to the exercise of the right to be forgotten.

English Summary

Facts

On 06 October 2015, the data subject asked for the Constitutional Court of Spain to substitute its full name for a pseudonym or any other formula to present his identity in one Administrative Order. The data subject also requested for the nullity and to unpublish the Order.

On the same day, the data subject required Google to erase its personal data that appeared in two websites that the search engines indicated as a result. In those links, the data subject's personal data appeared published in a decision in the aforementioned Administrative Order from July 2015 of the Constitutional Court of Spain.

The data subject claimed that the Administrative Order did not establish jurisprudence, had reference to a criminal conviction that could damage his image and, because he had mental disability, he deserved special protection as to his intimacy.

Google contested affirming that one of the URLs was not appearing as a result when searching for the data subject's name. Additionally, for the other URL, Google concluded that the reference to this information in its search results is justified by the public interest. Also, Google claimed that the Spanish DPA (AEPD) had no material competence to determine that a search engine limits access to decisions of the Constitutional Court.

Holding

The Spanish DPA (AEPD) affirms that it has competence to decide any claims concerning data protection of data subjects, according to Article 36 37(d) Organic Law 15/1999. Also, the Spanish law is applicable, according to Article 2 Organic Law 15/1999 and Article 4 Directive 95/46/CE.

AEPD brought extensive reference to the CJEU - C-131/12 decision, stating that it has the competence to require a search engine to not associate the name of a data subject to the links offered in the search results, provided that the information appearing in the links in question lacks relevance and public interest. Likewise, that information will be preserved in the website of origin.

Regarding the Right to Erasure, the DPA reaffirmed that once the data subject has submitted its request for erasure of personal data to the search engine, the search engine has the obligation to examine it and, if necessary, to delete the personal data. In line with CJUE - C-131/12 decision, the list of results obtained from a search based on a name, web page or information related to a person, facilitates the accessibility and diffusion of the information to any Internet user who performs a search on the person concerned, constitutes an interference with the fundamental right to respect for the private life of the data subject.

The Constitutional Court of Spain proceeded with the replacement of the claimant's data by initials in one of the URLs. The second URL was not available anymore by the time of the decision. For that reason, the claim against the Constitucional Court of Spain was terminated, since they have substituted the data for initials on the URL.

Google was convicted to adopt the necessary measures to prevent the data subject's name from being linked in the search results to the URL.

Comment

This case has reference to the Judgment of the Court of Justice of the European Union, dated May 13, 2014 (CJEU - C-131/12), between Google and Mario Costeja Gonzalez regarding the right to be forgotten of Article 17 GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. 

• File No.: TD/00101/2016

RESOLUTION Nº: R/01378/2016

Considering the claim formulated on December 15, 2015 before this Agency by D. B.B.B. against GOOGLE INC. and against the CONSTITUTIONAL COURT for not having duly attended to their right of cancellation.

The procedural actions provided for in article 117 of the Regulations for the development of Organic Law 15/1999, of December 13, on the Protection of Personal Data, approved by Royal Decree 1720/2007, of December 21 (as regards hereinafter, RLOPD), the following have been verified

FACTS

FIRST: On December 15, 2015, a claim from D.B.B.B. (hereinafter, the claimant) against against GOOGLE INC. and against the CONSTITUTIONAL COURT for not having duly attended to the right of cancellation.

SECOND: Once the documentation provided with the claim has been examined, it is observed that it must be corrected, therefore, in accordance with article 71 of Law 30/1992, of November 26, on the Legal Regime of Public Administrations and of the Common Administrative Procedure (hereinafter, LRJPAC), by means of a letter dated January 26, 2016, the claimant was requested:

- Printing of the screens that are accessed through the aforementioned links, highlighting the data of the affected person and the information that affects them.
- Where appropriate, evidence or indications of obsolescence, harmfulness of the facts or other relevant elements to carry out the balancing of conflicting interests that Directive 95/46/EC and the CJEU ruling of May 13, 2014 obliges to carry out. carried out in cases such as the present.
- Updated search index in which the claimed URLs appear based on the name of the claimant.

THIRD: On February 18, 2016, a letter from the claimant providing the requested documentation was entered in this Agency.

It should be noted that in accordance with article 42.5 of the LRJPAC, the course of the maximum legal term to resolve the rights protection procedure and notify the resolution (six months) will be suspended for the time between the notification of the requirement and its effective fulfillment by the addressee. In the present case, the final compliance with the rectification was made on February 18, 2016, so from that date the calculation of the term for the resolution of the aforementioned procedure will begin again.

On October 6, 2015, he requested the Constitutional Court "(...) to replace my full name in Order XXX/2015 of xx of 2015, by a pseudonym, by some initials or by using any other formula tending to preserve my identity, as well like any other data that directly or indirectly allows me to be identified; secondarily, that it agrees to the annulment of said Order and the subsequent unpublishment of the same.”

The Constitutional Court informed him that it agreed to join his petition to its procedure.

On October 6, 2015, the claimant requested Google Inc. to cancel his personal data that appears in the web addresses:

1. A.A.A.

2. C.C.C.

In these links appear the data of the claimant published in a Constitutional Court ruling of July 2015, in which the appeal filed by the interested party against a ruling that agreed to reject the opening of a jurisdictional incident on the request for operation is dismissed. abnormal of the Constitutional Court.

“This URL refers to an appeal against an Order of the Spanish Constitutional Court that declares the existence of abnormal functioning in it. It is an administrative procedure (art. 139 law 15/1999 of administrative procedure), but it refers to a criminal conviction, which damages the estimate that society may have of me. It is an Order that also has no relevance, since it does not establish jurisprudence. On the other hand, I have a mental disability, which makes me understand that I deserve special privacy and protection. The second URL provides the same information as the other, and for this reason I want it removed." (sic)

Google Inc. replied that "(...) In light of the current government decision to make this content available to the public, we have concluded that the reference to this information in Google search results is justified by the public interest."

FOURTH: On February 24, 2016, the aforementioned claim was forwarded to Google so that it could allege whatever it deemed appropriate to its right, having received a letter dated March 3, 2016 in this Agency in which, in summary , states that:

“Google Inc. has re-examined the request of the interested party, and in view of its content wishes to make the following considerations:

First of all, regarding the URL C.C.C. Google Inc. has verified that Mr.'s personal data is not published on this web page (...). It should also be noted that, as a consequence of the foregoing, that specific URL does not even appear among the results of the Google search engine when performing a search based on the name of the interested party.


(...) Secondly, with respect to the URL A.A.A., Google considers that it refers to information of particular relevance and public interest, the URL in question links to an Order of the Constitutional Court, of July 2015, by which dismissed an appeal filed by Mr. (…), and published on the institutional website of the Constitutional Court itself.”

They consider that "the AEPD lacks material competence to order a search engine measures that limit access to resolutions of the Constitutional Court."

FIFTH: Having examined the allegations made by Google, they are forwarded to the interested party, who reiterates his initial requests, expanding the claim with two other new specific web addresses and "Any link that may appear by entering "B.B.B." or “B.B.B. Auto” in the search engine Google”.

SIXTH: After the new term of allegations granted to Google, this entity indicated that it reiterates its allegations, and regarding the expansion with the new web addresses, it states that the claimant has not exercised the right with respect to them.

FUNDAMENTALS OF LAW
FIRST: The competence to resolve this claim corresponds to the Director of the Spanish Data Protection Agency, in accordance with article 37.d), in relation to article 36, both of the Organic Law 15/1999, of 13 December, of protection of personal data (hereinafter, LOPD).

SECOND: Article 18.1 of the LOPD states that "Acts contrary to the provisions of this Law may be subject to a claim by those affected before the Spanish Agency for Data Protection, in the manner determined by regulation."

THIRD: Article 16 of the LOPD provides that:
"1. The person in charge of the treatment will have the obligation to make effective the right of rectification or cancellation of the interested party within a period of ten days.

2. Personal data whose processing does not comply with the provisions of this Law and, in particular, when such data is inaccurate or incomplete, will be rectified or canceled, where appropriate.

3. The cancellation will lead to the blocking of the data, keeping it only at the disposal of the Public Administrations, Judges and Courts, for the attention of the possible responsibilities arising from the treatment, during the limitation period of these. Once the aforementioned period has elapsed, it must be deleted.

4. If the rectified or canceled data had been previously communicated, the person in charge of the treatment must notify the rectification or cancellation made to whoever has been communicated, in the event that the treatment is maintained by the latter, who must also proceed with the cancellation. .

5. Personal data must be kept for the periods provided in the applicable provisions or, where appropriate, in the contractual relations between the person or entity responsible for the treatment and the interested party."

FOURTH: With regard to the nature of the search engine as data controller, it should be noted that a search engine is a tool that provides Internet users with access to certain web pages. To do this, the tool accesses a list of previously indexed links and offers the user a list of web addresses that refer to pages that contain the words selected by the user.

The Judgment of the Court of the European Union of May 13, 2014, in its section 28, declares that "by exploring the Internet in an automated, constant and systematic way in search of the information that is published there, the manager of a search engine collects such data that it extracts, records and subsequently organizes within the framework of its indexing programs, keeps on its servers and, where appropriate, communicates and facilitates access to its users in the form of lists of search results. Since these operations are explicitly and unconditionally included in Article 2, letter b) of Directive 95/46, they must be classified as processing within the meaning of said provision, without it being relevant that the search engine manager also carry out the same operations with other types of information and do not distinguish between these and personal data.

(…)

Section 33: However, the search engine manager is the one who determines the purposes and means of this activity and, thus, the processing of personal data that it carries out within the framework of this and, therefore, must be considered responsible for said treatment under the aforementioned article 2, letter d.

(…)

Paragraph 35: In this regard, it should be noted that the processing of personal data carried out within the framework of the activity of a search engine is different from that carried out by the publishers of Internet sites, which consists in including such data on a page on the Internet, and added to it.

Paragraph 41:

(...) the activity of a search engine, which consists of finding information published or posted on the Internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to Internet users according to a certain order of preference, must qualify as processing of personal data, within the meaning of said article 2, letter b), when that information contains personal data and, on the other hand, the operator of a search engine must be considered responsible for said processing, within the meaning of said article 2, letter d).”

Consequently, the Court of Justice considers that the operator of the search engine is the data controller when determining the purposes and means of its activity.

FIFTH: Regarding the applicable regulations, the following should be noted:

Article 2 of the LOPD, in its section 1, indicates its territorial scope of application in the following terms:

“All processing of personal data will be governed by this Organic Law:

a) When the treatment is carried out in Spanish territory within the framework of the activities of an establishment of the person responsible for the treatment.

b) When the controller not established in Spanish territory is subject to Spanish legislation in application of public International Law standards.

c) When the data controller is not established in European Union territory and uses media located in Spanish territory for data processing, unless such media are used solely for transit purposes."

This article transposes article 4 of Directive 95/46/EC, which literally states:

“Applicable national law

1. Member States shall apply the national provisions which they have adopted for the application of this Directive to all processing of personal data where:

a) the processing is carried out within the framework of the activities of an establishment of the controller in the territory of the Member State. When the same data controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations provided for by the applicable national law;

b) the controller is not established on the territory of the Member State, but in a place where its national law applies under public international law;

c) the data controller is not established in the territory of the Community and uses, for the processing of personal data, means, automated or not, located in the territory of said Member State, except in the case where such means are used only for the purpose of transit through the territory of the European Community.

2. In the case mentioned in letter c) of paragraph 1, the data controller must designate a representative established in the territory of said Member State, without prejudice to the actions that could be taken against the data controller himself.”

The Judgment of the Grand Chamber of the Court of Justice of the European Union, dated May 13, 2014, considers in accordance with article 4.1.a) of Directive 95/46, in its sections 55, 56, 57 and 60, the next:

"It must be considered that the processing of personal data carried out in order to operate a search engine such as Google Search, managed by a company that has its registered office in a third State but has an establishment in a Member State, is carried out in the framework of the activities of said establishment if it is intended for the promotion and sale in said Member State of the advertising spaces of the search engine, which serve to make the service offered by the engine profitable.

Indeed, in such circumstances, the activities of the search engine operator and those of its establishment located in the Member State concerned are inextricably linked, since the activities relating to advertising space constitute the means for the search engine to search in question is economically profitable and given that this engine is, at the same time, the medium that allows the aforementioned activities to be carried out.

(...) the very presentation of personal data on a results page of a search results page constitutes a processing of such data. Well, since said presentation of results is accompanied, on the same page, by the presentation of advertising linked to the search terms, it is obligatory to declare that the controversial personal data processing is carried out within the framework of the activity advertising and commercial establishment of the controller in the territory of a Member State, in the present case the Spanish territory.

(…) must be interpreted as meaning that personal data processing is carried out within the framework of the activities of an establishment of the data controller in the territory of a Member State, within the meaning of that provision, when the manager of a search engine creates in the Member State a branch or a subsidiary intended to ensure the promotion and sale of advertising space proposed by said engine and whose activity is directed at the inhabitants of this Member State."

SIXTH: In relation to the possibility of exercising the right of cancellation before the Internet search engine without going to the person in charge of the website, the aforementioned Judgment of the Court of Justice of the European Union, in its sections 80 and 88, indicates that "a treatment of data (...) carried out by the manager of a search engine, can significantly affect the fundamental rights of respect for private life and protection of personal data when the search carried out using that search engine is carried out from of the name of a natural person, since said treatment allows any Internet user to obtain, through the list of results, a structured view of the information related to this person that can be found on the Internet, which potentially affects a multitude of aspects of their private life. , which, without such an engine, would not have been interconnected or could only have been very difficult and thus allows you to establish a profile m more or less detailed information about the person in question. In addition, the effect of the interference in said rights of the data subject is multiplied due to the important role played by the Internet and search engines in modern society, which give the information contained in such a list of results ubiquitous character (see, in this sense , judgment eDate Advertisement and others, C-509/09 and C-161/10, EU:C2011:685, section 45).

(...) in order to respect the rights established by these provisions, provided that the requirements established therein are actually met, the manager of a search engine is obliged to remove from the list of results obtained after a search carried out based on the name of a person links to web pages, published by third parties and containing information relating to this person, also in the event that this name or this information is not previously or simultaneously deleted from this web page, and, where appropriate, even if the publication on such pages is in itself lawful.”

Consequently, the processing of personal data carried out by the manager of a search engine allows a list of results to be obtained from a "name" that offer information about a person that may affect their private sphere. Once the interested party has submitted his request for the cancellation of his personal data to the search engine, he must examine it and proceed, where appropriate, to the deletion of the specific links from the list of results, without having to previously or simultaneously to go to the person in charge of the website.

SEVENTH: The Rights Protection procedure is instituted as a consequence of the denial of any of the rights regulated in the data protection regulations (access, rectification, cancellation and opposition) when, once exercised before the person responsible for the file, completing all the established requirements, the latter does not respond within the legally established term, or if the response offered does not comply with the right or is not satisfactory to the interested party.

In the present case, the examination of the documentation provided has only proven that the claimant exercised the right of cancellation with respect to two links:

1. A.A.A.

2. C.C.C.

Regarding links, the claimant has the possibility, if it suits his right, to request the cancellation before the requested entity and, if it does not answer or the answer is unsatisfactory, he can file a claim with this Agency for denial of his right by providing the documentation corresponding accreditation, without prejudging the result of the resolution issued by this body.

EIGHTH: Regarding the right of cancellation exercised before Google Inc., the origin or not of attending, in the present case, the request that after a search carried out, your name not be linked to certain results, must be analyzed.

In the present case, and taking into account what is indicated in the previous Legal Basis, in October 2015, the claimant exercised the right before Google in relation to the following URLs:

1. A.A.A.

2. C.C.C.

In these links appear the data of the claimant published in a Constitutional Court ruling of July 2015, in which the appeal filed by the interested party against a ruling that agreed to reject the opening of a jurisdictional incident on the request for operation is dismissed. abnormal of the Constitutional Court.

The list of results obtained in a search based on a name, web page or information related to a person, facilitates the accessibility and dissemination of information to any Internet user who performs a search on the interested party, constituting an interference in the fundamental right to respect for the private life of the interested party.

In accordance with the Judgment of the Court of Justice of the European Union in its section 99:

"Articles 12, letter b), and 14, first paragraph, letter a), of Directive 95/46 must be interpreted in the sense that, when analyzing the application requirements of these provisions, it will be necessary to examine, in particular , if the interested party has the right that the information in question relating to his person is no longer, in the current situation, linked to his name by a list of results obtained after a search carried out based on his name, without the appreciation of the existence of such a right presupposes that the inclusion of the information in question in the list of results causes harm to the interested party. Since the latter can, taking into account the rights recognized by articles 7 and 8 of the Charter, request that the information in question is no longer made available to the general public by including it in such a list of results, these Rights prevail, in principle, not only over the economic interest of the search engine manager, but also over the interest of said public in accessing the aforementioned information in a search that is based on the name of that person. However, this would not be the case if it turned out, for specific reasons, such as the role played by the interested party in public life, that the interference with their fundamental rights is justified by the overriding interest of said public in having, as a result of this inclusion, access to the information in question.”

Regarding Google's allegations in reference to the non-competence of this Agency to order a search engine measures that limit access to resolutions of the Constitutional Court, it should be noted that in accordance with the aforementioned ruling of the Court of Justice of the European Union, this The Agency has the power to urge a search engine not to associate the name of an affected person with the links offered in the search results, regardless of whether the interested party has not previously contacted the webmaster or person responsible for the publication on the web of origin, provided that the information that appears in the links in question lacks relevance and public interest. Likewise, it is recalled that the information will be preserved on the website of origin, in accordance with the Ruling of the National Court of December 29, 2014, which provides the following:

“On the other hand, freedom of information is satisfied by its subsistence at the source, that is, on the website where the information is published by the editor, without the fact of eliminating the links to the information from the list of results. web page object of claim by the affected, prevents that using other data to reach the aforementioned web page, but not from its name.

Likewise, it should be noted that this Agency has verified that the Constitutional Court has determined to replace the claimant's data with initials, in the content of the url claimed as No. 1. However, the Google search engine continues to associate the name of the affected to said url.

In the present case, as has been accredited during the procedure, the address number 2 is no longer accessible, so the claim for Protection of Rights with respect to said web link is dismissed.

Regarding address No. 1, this Agency has verified that it appears indexed by Google when searching for the claimant's name in said search engine, despite the fact that the data of the interested party is not published in the content of said address. Web address.

Consequently, it is appropriate to uphold this claim for Protection of Rights so that Google Inc adopts the necessary measures to prevent searches for its name in the European versions of Google search results from influencing the classification of that page.

NINTH: Regarding the exercise of the right of cancellation filed by the claimant before the Constitutional Court referring to a URL of the Court on a Judgment, the following should be noted:

The issue of publicizing the decisions of the Constitutional Court has been analyzed by the Constitutional Court itself, in its judgment 114/2006, of April 5, in which it states that: "art. 164.1 CE establishes (...) a specific constitutional requirement of maximum dissemination and publicity of the jurisdictional resolutions of this Court, which is specified, on the one hand, in that, together with the most obvious and express formal obligation to publish certain resolutions in the Official Gazette, there is also an implicit material obligation to give the greatest accessibility and public dissemination to the content of all those jurisdictional resolutions of the Court that incorporate constitutional doctrine, regardless of their nature and the process in which they are issued; and, on the other, that the publicity must be of the complete resolution”.

He then reiterates this statement, specifying that: "the publicity that must be guaranteed is that of the judicial resolution in its entirety, including, usually, the complete identification of those who have been a party to the respective constitutional process, insofar as it allows to ensure interests of undoubted constitutional relevance, such as, above all, the proof of the impartial exercise of constitutional jurisdiction and the right of all to be informed of the circumstances, including personal ones, of the cases that, due to their transcendence, accede, precisely, to this jurisdiction; and this without forgetting that, in many cases, the knowledge of such circumstances will be necessary for the correct understanding of the application, in the case, of the constitutional doctrine itself.

Regarding the scope of the legal obligation of publicity, specifically, the aforementioned judgment subsequently states "... that any question related to the possible omission of the identification of the parties involved in a constitutional process, both in the judicial resolution that is issued and in The publicity of the same is made by this Court, under the formal obligation of publication in the Official Gazette or the material obligation to give it the maximum dissemination, is of a jurisdictional nature and corresponds to resolve it exclusively and excluding this Court with the sole subjection to the provisions of the Constitution and the Organic Law of the Constitutional Court."

In accordance with this doctrine, the Constitutional Court claims for itself, exclusively and exclusively, the competence to determine if it is appropriate to restrict the publicity of a constitutional Judgment. Consequently, the Spanish Agency for Data Protection cannot enter to examine this matter.

At this point, it is necessary to cite the judgment of the National Court of October 30, 2013, which states:

No objection can be made to this constitutional doctrine that revolves around the activity of the Constitutional Court as the "supreme interpreter of the Constitution" in the exercise of jurisdictional functions, which, as we said, extends both to the publication of its resolutions in the BOE as well as its dissemination through insertion in its jurisprudential compilations by any means, including access to them through the Internet.

This consideration is solidly supported by the reform operated on Organic Law 2/1979, of October 3, of the Constitutional Court, through Organic Law 6/2007, of May 24, which redrafted its article 86, paragraphs second and third -located in Title VII, called "Of the common provisions on procedure"-, where after indicating the form that the jurisdictional decisions of the Constitutional Court must take -auto and sentence-, it provides the following:

"two. The judgments and statements referred to in Title VI shall be published in the "Official State Gazette" within 30 days of the date of the ruling. The Court may also order the publication of its records in the same manner when it deems it appropriate.

3. Without prejudice to the provisions of the preceding section, the Court may provide that the judgments and other resolutions handed down be published through other means, and will adopt, where appropriate, the measures it deems pertinent for the protection of personal data. rights recognized in article 18.4 of the Constitution”.

Therefore, the legal endorsement indicated to the broad, exclusive and exclusive jurisdiction of the Constitutional Court declared in STC 114/2006, of April 5, regarding the scope of publicity and dissemination of its resolutions in its aspects, formal and material , includes both the decision about the anonymization of the resolutions of said Court -by replacing his name and surnames with initials, which would affect, on the one hand, the publication in BOE of the resolution with its complete identification and, on the other , to its inclusion with the same content in the jurisprudential repertoires incorporated into the website of the Constitutional Court-, such as the decision on the adoption of the necessary technical measures to prevent the indexing of such resolutions by internet search engines -through the use of the file "robots.txt" - requested by the plaintiff.

That's right, both decisions directly affect the publicity and dissemination of the resolutions of the Constitutional Court as a manifestation of the judicial activity that it performs, in the terms in which they are configured constitutionally and in its Organic Law, and are conditioned by the protection of the rights recognized in article 18.4 of the Constitution, whose guardianship is entrusted to the Court itself in article 86.3 of the LOTC.

Well, the Chamber considers that the adoption of such decisions, with the consequent weighting of the rights and constitutional guarantees in conflict, is not a matter that exceeds the jurisdictional function of the Constitutional Court, as "supreme interpreter of the Constitution", exercises within the amparo appeal, in which it dictates the resolution or resolutions that are the object of publicity, but rather falls within it, even if it affects a "file", such as the one constituted by the jurisprudential compilation to which it gives access public through its web page, and even when it allows access through various links to the resolutions, which contain the identification data of the plaintiff.

The legal support of the new wording of article 86.3 of the LOTC to the constitutional doctrine included in the STC 114/2006, of April 5, is decisive to conclude in the exposed sense.

To this must be added that in the specific case at hand, the Constitutional Court, as the supreme interpreter of the Constitution, has pondered the eventual prevalence of fundamental rights and constitutional guarantees, with which the jurisdictional decision to grant maximum dissemination and publicity of the full content of the judgment, including the plaintiff's personal identification data, among which is the right to the protection of personal data, enshrined in article 18.4 of the EC, and has decided in exercise of its jurisdictional function to grant prevalence to such diffusion and publicity of its jurisdictional resolution.

Therefore, in relation to this jurisdictional decision regarding the publicity of the resolutions of the Constitutional Court, the Spanish Data Protection Agency has no competence, since the limitation of its functions that in this regard stems directly from the Constitution and the Organic Law of the Constitutional Court, as has been exposed, and does not imply a violation of Directive 1995/46/CE or the LOPD.”

For all these reasons, the claim that gave rise to this procedure for the protection of rights with respect to the Constitutional Court should be dismissed.

Notwithstanding the foregoing and as has been stated in the seventh legal basis of this resolution, it has been verified by this Agency that the Constitutional Court has determined to replace the claimant's data with initials, in the content of the url claimed.

Given the aforementioned precepts and others of general application,

The Director of the Spanish Data Protection Agency RESOLVES:

FIRST: ESTIMATE the claim made by D. B.B.B. against GOOGLE INC., urging this entity to adopt the necessary measures to prevent its name from being linked in the search results to the following url.

A.A.A.

SECOND: DISMISS the claim made by D. B.B.B. against GOOGLE INC. regarding the following url.

C.C.C.

THIRD: DISMISS the claim made by D. B.B.B. against the CONSTITUTIONAL COURT.

FOURTH: NOTIFY this resolution to GOOGLE SPAIN, S.L., as the establishment of the person in charge in Spain so that it can transfer it to Google Inc., and to D.B.B.B..

In accordance with the provisions of section 2 of article 37 of the LOPD, in the wording given by article 82 of Law 62/2003, of December 30, on fiscal, administrative and social order measures, this Resolution is will be made public, once the interested parties have been notified. The publication will be carried out in accordance with the provisions of Instruction 1/2004, of December 22, of the Spanish Agency for Data Protection on the publication of its Resolutions and in accordance with the provisions of article 116 of the RLOPD.

Against this resolution, which puts an end to the administrative process (article 18.4 of the LOPD), and in accordance with the provisions of article 116 of the LRJPAC, the interested parties may optionally file an appeal for reinstatement before the Director of the Spanish Agency of Data Protection within a month from the day following the notification of this resolution, or, directly, a contentious-administrative appeal before the Contentious-administrative Chamber of the National Court, in accordance with the provisions of article 25 and in section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following the notification of this act, according to the provisions of article 46.1 of the aforementioned legal text.

Mar Spain Martí Director of the Spanish Data Protection Agency
Retrieved from "https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_TD/00101/2016&oldid=29932"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki