AEPD (Spain) - TD/00005/2020
From GDPRhub
| AEPD - TD/00005/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 17 GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | TD/00005/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | Expediente Nº: TD/00005/2020 (in ES) |
| Initial Contributor: | Pablo Rossi |
The Spanish Data Protection Agency (AEPD) rejects A.A.A's claims against Google Spain, SL. The complaint concerned an alleged violation of the applicant's right of erasure (Article 17 GDPR). However, the conflicting information had been anonymized by the webmaster of the concerned website (not by GOOGLE SPAIN), leaving the procedure without subject matter since the claims of the complainant had already been satisfied.
English Summary
Facts
On 11/09/2019, Mr(s). A.A.A exercised a right to erasure (to be forgotten) in relation to an URL against GOOGLE SPAIN, S.L. The complainant, whose personal data appear in a news article from 2012, considered that the information in the search results was old, obsolete and inaccurate, and that it had no impact on the present and no relevance that could contribute to public debate.
On 20/01/2020, the Director of the AEPD agreed to admit the claim presented by the claimant against GOOGLE SPAIN, S.L, and agreed to transfer the claim to the latter, giving a fifteen working days deadline to present allegations. GOOGLE stated in their allegations that the complainant exercised her right of erasure, but her claims were refused on lawful grounds.
The application was then re-examined and it was found that the personal data of the complainant was no longer published on the disputed website. The publisher/webmaster of the disputed website had anonymised the personal data of the complainant by replacing her name with initials. As a consequence, the disputed URL did not even appear among Google search results anymore when searching for her name.
After examining the arguments presented by the defendant, they were transferred to the claimant so that she could formulate arguments that could be considered appropriate. In the allegations of the complainant, she claimed that the fact that the URL that was subject of the complaint no longer appeared among the search results based on her name was due to negotiations with the original webmaster, not by any action from GOOGLE.
Furthermore, she claimed that GOOGLE SPAIN had repeatedly refused to remove the link on the basis of the right to information, a right that that the original website did not felt affected at any moment, removing the content without any objection. On the basis of the above, the complainant considers that GOOGLE’s conduct could constitute an infringement.
Dispute
Was the right to erasure of the claimant (Article 17 GDPR) violated by the actions carried out by GOOGLE SPAIN?
Holding
The AEPD held that the purpose of this kind of proceedings is to ensure that the rights of the affected parties are duly restored. In the present case, regardless of whether GOOGLE refused to remove the URL, and given that the claimant’s name is not linked to the claimed URL on GOOGLE’s search results anymore, the claims of the complainant had been satisfied, and therefore the complaint should be dismissed for a lack of subject matter.
Comment
There are obvious links between the present case and the landmark decision that the Google Spain case (European Union Court of Justice Case number C-131/12) represents.
The Spanish Data Protection Agency, in this resolution, mentions the 2014 decision from the ECJ, making again clear the fact that the search engine is the controller of the data (since it determines the means and purposes of the processing), attaching therefore to it all the responsibilities that the GDPR establishes.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
File No.: TD/00005/2020 RESOLUTION Nº: R/00188/2020 Having regard to the complaint lodged with this Agency on 11 September 2019 by D. A.A.A., against GOOGLE LLC, GOOGLE LLC (GOOGLE SPAIN, S.L.), for not that their right to terminate has been duly observed. The procedural actions provided for in Title VIII of the Law have been carried out Organic 3/2018 of 5 December on the Protection of Personal Data and Guarantee of digital rights (hereinafter LOPDGDD), the following have been found FACTS FIRST: On 11 September 2019, Mr. A.A.A. (hereinafter referred to as the claimant) exercised a right of deletion in relation to a URL against GOOGLE LLC, GOOGLE LLC (GOOGLE SPAIN, S.L., hereinafter, the claimed). Specifically, it requests that your personal data not be associated in the search results to the following URLs: ***URL.1 The complainant has submitted to this Agency that his personal data appear in a news item of the year 2012, considers that the indexed information is old, obsolete and deals with data that is inaccurate and has no impact on the present nor does it become relevant that it can contribute to the public debate. SECOND: On 10 January 2020, in accordance with Article 65.4 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights and for the purposes of Article 64(2), the Director of the Spanish Data Protection Agency agreed to admit to the claim filed by the claimant against the respondent and agrees to give the complaint, so that within fifteen working days he can present the arguments that it considers appropriate and the parties are informed that the maximum for The procedure will take six months to be resolved, so that, in summary, the following allegations: GOOGLE states in the allegations made during the present proceedings that, the complainant exercised the right to deletion in relation to a URL that he said appeared among the results of the search engine when making a query from your name and by e-mail was refused for cause. The application has been re-examined and it has been found that on the The personal data of the complainant are no longer published on the disputed website because the editor or webmaster of the controversial website has anonymized the personal data of the person concerned, by replacing his name with initials. And since As a consequence of the above, the disputed URL does not even appear among Google search results when searching from his name. That it is not credited in the claim that the disputed URL appears between search engine results when performing the search by name. THIRD: Having examined the allegations made by the Respondent, they are the subject of transfer to the complaining party, so that, within 15 working days, it formulates allegations that it deems appropriate: The complainant states in the allegations made during the The Commission shall ensure that the link which is the subject of the complaint is no longer appears among the search results starting from the name, but it has not been to Google, but for the negotiations with the original webmaster. That Google has repeatedly refused to remove the link using This is a standard model based on the right to information, a right which the original website was not affected at all and withdrew without any objection. That it is considered that the conduct of the Respondent could constitute Violation. LEGAL FOUNDATIONS FIRST: The Director of the Spanish Agency of Data Protection, as laid down in Article 56(2) inin relation to Article 57(1)(f), both of Regulation (EU) 2016/679 of European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter referred to as the RGPD); and in Article 47 of the Organic 3/2018 of 5 December on the Protection of Personal Data and Guarantee of digital rights (hereinafter LOPDGDD). SECOND: Article 64.1 of the LOPDGDD, provides that: "1. Where the procedure relates solely to the failure of an application to exercise the rights laid down in Articles 15 to 22 of the Regulation (EU) 2016/679, shall be initiated by a formal admission agreement, which shall shall be adopted in accordance with the following Article. In this case, the time limit for resolving the procedure shall be six months, counting from from the date the claimant was notified of the settlement of admission to procedure. After this period, the person concerned may consider estimated your claim." THIRD: Article 17 of the RGPD provides the following: "The data subject shall have the right to obtain without undue delay from the controller of the processing the deletion of personal data concerning him, which shall be obliged to delete the personal data without undue delay when any of the following circumstances apply: (a) the personal data are no longer necessary for the purposes for which they were collected that were collected or otherwise treated; (b) the data subject withdraws the consent on the basis of which the processing of in accordance with Article 6(1)(a) or Article 9(2)(a) (a), and this is not based on any other legal basis; (c) the data subject opposes the processing pursuant to Article 21(1); and no other legitimate grounds for processing prevail, or the data subject to object to the processing pursuant to Article 21(2); (d) the personal data have been processed unlawfully; (e) the personal data must be deleted in order to comply with an obligation established in Union law or in the law of the Member States to be adopted in apply to the controller; (f) personal data have been obtained in connection with the provision of services of the information society referred to in Article 8(1). 2. When you have made personal data public and are obliged, by virtue of the provisions of paragraph 1, to delete such data, the person responsible for treatment, taking into account the available technology and the cost of its implementation, take reasonable measures, including technical measures, with a view to inform the persons in charge who are processing the personal data of the request from the person concerned to delete any link to such personal data, or any copies or replicas thereof. 3. Paragraphs 1 and 2 shall not apply where processing is necessary: (a) to exercise the right to freedom of expression and information (b) for the fulfilment of a legal obligation requiring the processing of data required under Union law or under the law of the Member States to be apply to the controller, or for the performance of a task carried out in the public interest or in the exercise of public authority conferred on the responsible; (c) for reasons of public interest in the field of public health in accordance with with Article 9(2)(h) and (i) and (3); (d) for archiving purposes in the public interest, for scientific research purposes or historical or statistical purposes, in accordance with Article 89(1) in to the extent that the right referred to in paragraph 1 would make it impossible or seriously impede the achievement of the objectives of such treatment, or (e) for the formulation, exercise or defence of claims. FOURTH: Regarding the nature of the searcher as responsible for treatment, it should be noted that a search engine is a tool that provides the user access to certain websites. To do this, the tool accesses a list of pre-indexed links and offers the user a list of web addresses that point to pages containing the selected words by the user. The Judgment of the Court of the European Union of 13 May 2014, in its paragraph 28, states that "by exploring the Internet in an automated, constant and The manager of a search engine will systematically look for the information published there. search collects such data which it extracts, records and subsequently organizes in the indexing programs, keeps on its servers and, where appropriate, communicates and provides access to its users in the form of result lists of its searches. Since these operations are explicitly and unconditional in Article 2(b) of Directive 95/46, must be regarded as treatment within the meaning of that provision, without it being relevant whether the search engine also perform the same operations with other types of information and does not distinguish between these and personal data. (…) Paragraph 33: However, it is the search engine manager who determines the ends and means of this activity and, thus, of the processing of personal data carried out by the same in the framework of the latter and should therefore be held responsible for it processing under the said Article 2(d). (…) Paragraph 35: In this connection, it should be noted that the processing of data The search engine activity is carried out in the context of a distinguishes it from that of Internet site publishers, which consists of making This data is displayed on a web page and added to it. Paragraph 41: (...) the activity of a search engine, which consists of finding information published or placed on the Internet by third parties, automatically indexed, to store it temporarily and finally to make it available to Internet users according to a certain order of preference, must be qualified as data processing personal, within the meaning of Article 2(b), where such information contains personal data and, on the other hand, the manager of a search engine should be considered the controller of such processing within the meaning of the aforementioned Article 2(d). Consequently, the Court considers that the manager of the search is the data controller in determining the purposes and means of their activity. FIFTH: With regard to the applicable regulations, the following should be noted: The judgment of the Grand Chamber of the Court of Justice of the European Union of dated 13 May 2014, considers in accordance with Article 4(1)(a) of Directive 95/46, in paragraphs 55, 56, 57 and 60, the following: "it should be considered that the processing of personal data carried out in order to operation of a search engine such as Google Search, managed by a company which has its registered office in a third country but has a establishment in a Member State, is carried out in the context of the activities of that establishment if it is intended to be promoted and sold in that State member of the search engine advertising spaces, which serve to to make the service proposed by the engine profitable. Indeed, in such circumstances, the activities of the search engine manager and those of its establishment situated in the Member State concerned are The activities related to the spaces are inextricably linked, since the activities related to the advertising are the means for the search engine in question to be economically profitable and given that this engine is, at the same time, the medium that allows the above-mentioned activities to be carried out. (...) the very presentation of personal data on a result page of a search results page constitutes a processing of such data. So or, since this presentation of results is accompanied, in the same page, of the advertising presentation linked to the search terms, is obliged to declare that the processing of personal data in question is carried out in the context of the advertising and commercial activity of the establishment of the person responsible of processing in the territory of a Member State, in this case the territory Spanish. (...) should be interpreted as meaning that data processing is carried out in the context of the activities of an establishment of the person responsible for such treatment in the territory of a Member State, within the meaning of that provision, where the manager of a search engine creates in the Member State a branch or a subsidiary intended to ensure the promotion and sale of spacevadvertising proposed by the above-mentioned engine and whose activity is aimed at inhabitants of this Member State." SIXTH: In relation to the possibility of exercising the right of withdrawal before the search engine without going to the person responsible for the website, the aforementioned The Court of Justice of the European Union, in paragraphs 80 and 88, states that "a data processing (...) carried out by the manager of a search engine, you can significantly affect the fundamental rights of respect for privacy and protection of personal data when the search carried out using that search engine is carried out from the name of a natural person, each time that such treatment allows any Internet user to obtain through the list of results a structured view of information about this person that can be on the Internet, potentially affecting a multitude of aspects of their lives Without this engine, they would not have been interconnected or could only have been It was very difficult and thus allows you to establish a profile more or less detailed information on the person concerned. In addition, the effect of interference in such rights of the data subject is multiplied because of the important role played by The Internet and search engines in modern society, which give information contained in such a result list is ubiquitous (see, in this eDate Advertisin and others, C-509/09 and C-161/10, EU:C2011:685, paragraph 45). (...) to respect the rights set out in these provisions, provided that actually meet the requirements laid down in them, the manager of a search is required to remove from the list of results obtained after a search carried out on the basis of a person's name links to web pages, published by third parties and containing information relating to this person, alsoin the event that this name or this information is not previously deleted orsimultaneously from this website, and, where appropriate, although the publication in thesepages is in itself lawful." Consequently, the processing of personal data by the search engine manager allows a "name" to be listed as a results that provide information about a person that may affect their private. Once the person concerned has submitted his request for removal of his personal data to the search engine, you must examine it and proceed, in your case, to the removal of the specific links from the list of results, without prior or simultaneously have to go to the person responsible for the website. SEVENTH: Regarding the opening of a sanctioning procedure for alleged violations of data protection regulations, with the processing of claim in accordance with the provisions of Article 63.1 of the LOPDGDD, has given The Committee is concerned about the fact that the issues raised have not been resolved, without the need for administrative responsibilities in the framework of a sanctioning procedure. In this connection, mention should be made of the exceptional nature of the sanctioning procedure, from which it follows that - wherever possible - it should The prevalence of alternative mechanisms should be chosen if they have protection in the regulations in force, as is the case here. It should be noted that this procedure is established to ensure the exercise of the rights of access, rectification, deletion, limitation, portability and opposition that the above-mentioned standard enshrines. On the other hand, the sanctioning procedure, as its The name itself indicates, it has a sanctioning nature and as such constitutes one of the manifestations of the "ius puniendi" of the State. So, while in any case the constitutional function of this Agency is to guarantee the fundamental right to protection of personal data, it should be noted that with the sanctioning procedure the aim is to establish whether any infringements have been committed and where appropriate, the imposition of appropriate sanctions. It is the exclusive competence of this Agency to assess whether there are liabilities administrative procedures that must be purged in a sanctioning procedure and, in Consequently, the decision on its opening, there being no obligation to initiate a procedure for any request made by a third party. Such a decision must be based in the existence of elements that justify the initiation of the sanctioning activity, circumstances not present in the present case, in view of the proceedings therefore, the guarantees and rights of the affected party are duly restored. EIGHTH: In the present case, the claimant exercised the right before GOOGLE LLC, GOOGLE LLC (GOOGLE SPAIN, S.L.) in connection with the above-mentioned URL and requests that your personal data not be linked in the search results to from his name. Google responded by denying your claim, however, during the The Commission, in its submissions to the Court of First Instance, has that Agency which, having re-examined the request of the complainant and verified that on the disputed website your personal data are not published, nor the questioned URL appears among the search results when your name is entered. On the part of this Agency, it has been verified that, when carrying out a search for the name of the complaining party in the Google search engine, the URL results, the URL does not include your personal data. personal character nor information related to his person. The purpose of these proceedings is to ensure that the guarantees and rights of those affected are duly restored, therefore, in the present case, regardless of Google's refusal to remove the URL, which would be reason for analysis to see the relevance or not of what is published and given that, its name is not linked to the search results in the claimed URL, the claims of the complainant have been satisfied, and the case is therefore dismissed as there is no object of the claim. Having regard to the above-mentioned and other generally applicable precepts, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: TO DISMISSUE the claim made by Mr. A.A.A. against GOOGLE LLC, GOOGLE LLC (GOOGLE SPAIN, S.L.). SECOND: NOTICE this resolution to Mr. A.A.A. and GOOGLE LLC, GOOGLE LLC (GOOGLE SPAIN, S.L.). In accordance with the provisions of article 50 of the LOPDGDD, the This Resolution will be made public once the interested parties have been notified. Against this resolution, which ends the administrative route (article 18.4 of the LOPD), and in accordance with the provisions of article 123 of Law 39/2015, of 1 October, of the Common Administrative Procedure of Public Administrations, An appeal for reversal may be filed, optionally, with the Director of the Spanish Agency for Data Protection, within a month from day after notification of this resolution, or directly contentious appeal administrative before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the Provision Additional Fourth of Law 29/1998, of July 13, regulating the Jurisdiction Contentious-Administrative, within two months from the following day to the notification of this act, as provided in article 46.1 of said text legal.
