CJEU - C‑131/12 - Google Spain and Google

CJEU - C-131/12 Google Spain

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 12(b) Directive 95/46/EC Article 14(1)(a) Directive 95/46/EC Article 2(d) Directive 95/46/EC Article 4(1)(a) Directive 95/46/EC Article 4(1)(c) Directive 95/46/EC Article 2(b) Directive 95/46/EC
Decided:	13.05.2014
Parties:	Agencia Española de Protección de Datos (AEPD) Google Inc. Google Spain SL Mario Costeja González
Case Number/Name:	C-131/12 Google Spain
European Case Law Identifier:	ECLI:EU:C:2014:317
Reference from:	AN (Spain)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	Frederick Antonovics

The CJEU held that an Internet search engine operator is considered the controller (Article 2(d) Directive 95/46) in respect of the processing (within the meaning of Article 2(b) Directive 95/46) that it carries out of personal information which appears on web pages published by third parties, namely the (i) finding, (ii) indexing, (iii) temporary storing, and (iv) making it available to web users in a particular order. As such, search engine operators have to comply with the obligations provided for by that Directive, in particular by removing information connected to a person published by third parties from the list of results displayed following a search made on the basis of a person’s name.

English Summary

Facts

In March 2010, Mario Costeja Gonzalez, a Spanish national, lodged a complaint against the newspaper 'La Vanguardia Ediciones', Google Spain and Google Inc. with the Spanish DPA (AEPD). The complaint was based on the fact that when internet users entered his name in Google Search, they would find links to two pages of the newspaper (from 19 January and 9 March 1998) on which an announcement mentioning his name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts that he owed.

The AEPD rejected the complaint in so far it related to the newspaper, as the articles had been lawfully published by order of the Ministry of Labour and Social Affairs. However, it upheld the complaint against Google Spain and Google Inc. because it considered "that it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties."

The two Google entities brought separate actions before the Spanish High Court appealing the AEPD's decision. The court joined the two cases, and stated that the case raised the question of what obligations are owed by operators of search engines to protect personal data. It held that the answer to this question depended on the correct interpretation of Directive 95/46.

Thus, it referred the following questions to the CJEU:

With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation:

(a) must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise:

when the undertaking providing the search engine sets up in a Member State an office or subsidiary for the purpose of promoting and selling advertising space on the search engine, which orientates its activity towards the inhabitants of that State, OR

when the parent company designates a subsidiary located in that Member State as its representative and controller for two specific filing systems which relate to the data of customers who have contracted for advertising with that undertaking, OR

when the office or subsidiary established in a Member State forwards to the parent company, located outside the European Union, requests and requirements addressed to it both by data subjects and by the authorities with responsibility for ensuring observation of the right to data protection, even where such collaboration is engaged in voluntarily?

(b) Must Article 4(1)(c) of Directive 95/46 be interpreted as meaning that there is “use of equipment … situated on the territory of the said Member State”:

when a search engine uses crawlers or robots to locate and index information contained in web pages located on servers in that Member State, OR

when it uses a domain name pertaining to a Member State and arranges for searches and the results thereof to be based on the language of that Member State?

(c) Is it possible to regard as a use of equipment, in the terms of Article 4(1)(c) of Directive 95/46, the temporary storage of the information indexed by internet search engines? If the answer to that question is affirmative, can it be considered that that connecting factor is present when the undertaking refuses to disclose the place where it stores those indexes, invoking reasons of competition?

(d) Regardless of the answers to the foregoing questions and particularly in the event that the Court … considers that the connecting factors referred to in Article 4 of [Directive 95/46] are not present:

must Directive 95/46 … be applied, in the light of Article 8 of the [Charter], in the Member State where the centre of gravity of the conflict is located and more effective protection of the rights of … Union citizens is possible?

2. As regards the activity of search engines as providers of content in relation to Directive 95/46 …:

(a) in relation to the activity of [Google Search], as a provider of content, consisting in locating information published or included on the net by third parties, indexing it automatically, storing it temporarily and finally making it available to internet users according to a particular order of preference, when that information contains personal data of third parties: must an activity like the one described be interpreted as falling within the concept of “processing of … data” used in Article 2(b) of Directive 95/46?

(b) If the answer to the foregoing question is affirmative, and once again in relation to an activity like the one described:

must Article 2(d) of Directive 95/46 be interpreted as meaning that the undertaking managing [Google Search] is to be regarded as the “controller” of the personal data contained in the web pages that it indexes?

(c) In the event that the answer to the foregoing question is affirmative:

may the [AEPD], protecting the rights embodied in [Article] 12(b) and [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, directly impose on [Google Search] a requirement that it withdraw from its indexes an item of information published by third parties, without addressing itself in advance or simultaneously to the owner of the web page on which that information is located?

(d) In the event that the answer to the foregoing question is affirmative:

would the obligation of search engines to protect those rights be excluded when the information that contains the personal data has been lawfully published by third parties and is kept on the web page from which it originates?

3. Regarding the scope of the right of erasure and/or the right to object, in relation to the “derecho al olvido” (the “right to be forgotten”), the following question is asked:

must it be considered that the rights to erasure and blocking of data, provided for in Article 12(b), and the right to object, provided for by [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, extend to enabling the data subject to address himself to search engines in order to prevent indexing of the information relating to him personally, published on third parties’ web pages, invoking his wish that such information should not be known to internet users when he considers that it might be prejudicial to him or he wishes it to be consigned to oblivion, even though the information in question has been lawfully published by third parties?’

Holding

Controller/Processor (Article 2(b), (d) Directive 95/46)?

The Court first assessed whether "the activity of a search engine (...) which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference" must be classified as 'processing of personal data' per Article 2(b) Directive 95/46 when that information contains personal data, and if so if the search engine is considered the controller (per Article 2(d) Directive 95/46) in respect of that processing.

Google submitted that because it made no selection between information and personal data when displaying search results, it should not be considered a processor, and that it "cannot be regarded as a ‘controller’ in respect of that processing since it has no knowledge of those data and does not exercise control over the data." The claimants disagreed, submitting that search engines determine the means and purposes as operators of such processing and are therefore controllers in respect of it.

The Court then analysed the process behind displaying search results and found that "in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results." Thus, it held that Google was a processor because this wording echoes that of Article 2(b) Directive 95/46. It also held that Google was the controller in respect of this processing because "[i]t is the search engine operator which determines the purposes and means of that activity" and it would be contrary to the objective of Article 2(d), namely to "ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects", to exclude the operators of search engines from the definition.

Establishment (Article 4(1)(a) Directive 95/46)?

The Court then turned to the question of "whether it is possible to apply the national [Spanish] legislation transposing Directive 95/46 in circumstances such as those at issue in the main proceedings." The answer to this question rested on the notion of 'establishment' within the meaning of Article 4(1)(a) Directive 95/46. It considered whether this provision "is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State(...) when one or more of the following three conditions are met:

the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State, or
the parent company designates a subsidiary located in that Member State as its representative and controller for two specific filing systems which relate to the data of customers who have contracted for advertising with that undertaking, or
the branch or subsidiary established in a Member State forwards to the parent company, located outside the European Union, requests and requirements addressed to it both by data subjects and by the authorities with responsibility for ensuring observation of the right to protection of personal data, even where such collaboration is engaged in voluntarily."

The Court analysed the Google's activity in Spain, and found that meeting the first aforementioned condition sufficed for the processing by the company to have been "carried out in the context of the activities of an establishment of the controller on the territory of a Member State" per Article 4(1)(a) Directive 95/46.

Responsibility of the operator of a search engine under Directive 95/46

The Court then considered whether Articles 12(b) and 14(a) Directive 95/46 create an obligation for operators of search engines to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, even cases where that name or information is not erased beforehand or simultaneously from those web pages, and when the publication on those pages is lawful.

Google submitted it is the responsibility of the publisher to respond to requests for the removal of information. The claimants argued that "the national authority may directly order the operator of a search engine to withdraw from its indexes and intermediate memory information containing personal data that has been published by third parties."

The Court deemed that a balance ought to be struck between the legitimate interest of internet users potentially interested in having access to the information requested to be removed from the search results and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. It highlighted that "the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information" could shift that balance in favour of the interest of the public, particularly when the data subject plays a public role in society. It nonetheless held that "in order to comply with the rights laid down in [Articles 12(b) and 14(a) Directive 95/46] and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful."

Scope of the data subject’s rights guaranteed by Directive 95/46

The Court finally considered whether data subjects essentially have a 'right to be forgotten' derived from Articles 12(b) and 14(a) Directive 95/46. It assessed Article 6(1)(c) to (e) of Directive 95/46 and held that "even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed."

It applied this test to the present case, and determined that "having regard to the sensitivity for the data subject’s private life of the information contained in those announcements and to the fact that its initial publication had taken place 16 years earlier", Mario Costeja Gonzalez had a right for the links he originally complained about to be removed from the list of results (when searching his name).

In other words, the Court affirmed that data subjects had a 'right to be forgotten' under Directive 95/46.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!