Editing CJEU - C‑131/12 - Google Spain

From GDPRhub

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Latest revision Your text
Line 55: Line 55:
  
 
==== Thus, it referred the following questions to the CJEU: ====
 
==== Thus, it referred the following questions to the CJEU: ====
# With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation:
+
# "With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation:
  
 
'''(a)''' must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise:
 
'''(a)''' must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise:
Line 98: Line 98:
  
 
=== Holding ===
 
=== Holding ===
 
+
In Progress
==== Controller/Processor (Article 2(b), (d) Directive 95/46)? ====
 
The Court first assessed whether "''the activity of a search engine (...) which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference''" must be classified as 'processing of personal data' per Article 2(b) Directive 95/46 when that information contains personal data, and if so if the search engine is considered the controller (per Article 2(d) Directive 95/46) in respect of that processing.
 
 
 
Google submitted that because it made no selection between information and personal data when displaying search results, it should not be considered a processor, and that it "''cannot be regarded as a ‘controller’ in respect of that processing since it has no knowledge of those data and does not exercise control over the data.''" The claimants disagreed, submitting that search engines determine the means and purposes as operators of such processing and are therefore controllers in respect of it.
 
 
 
The Court then analysed the process behind displaying search results and found that "''in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results.''" Thus, it held that Google was a processor because this wording echoes that of Article 2(b) Directive 95/46. It also held that Google was the controller in respect of this processing because "[''i]t is the search engine operator which determines the purposes and means of that activity''" and it would be contrary to the objective of Article 2(d), namely to "''ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects''", to exclude the operators of search engines from the definition.
 
 
 
==== Establishment (Article 4(1)(a) Directive 95/46)? ====
 
The Court then turned to the question of "''whether it is possible to apply the national [Spanish] legislation transposing Directive 95/46 in circumstances such as those at issue in the main proceedings.''" The answer to this question rested on the notion of 'establishment' within the meaning of Article 4(1)(a) Directive 95/46. It considered whether this provision "''is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State(...) when one or more of the following three conditions are met:''
 
 
 
* ''the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State, or''
 
* ''the parent company designates a subsidiary located in that Member State as its representative and controller for two specific filing systems which relate to the data of customers who have contracted for advertising with that undertaking, or''
 
* ''the branch or subsidiary established in a Member State forwards to the parent company, located outside the European Union, requests and requirements addressed to it both by data subjects and by the authorities with responsibility for ensuring observation of the right to protection of personal data, even where such collaboration is engaged in voluntarily.''"
 
 
 
The Court analysed the Google's activity in Spain, and found that meeting the first aforementioned condition sufficed for the processing by the company to have been "''carried out in the context of the activities of an establishment of the controller on the territory of a Member State''" per Article 4(1)(a) Directive 95/46.
 
 
 
==== Responsibility of the operator of a search engine under Directive 95/46 ====
 
The Court then considered whether Articles 12(b) and 14(a) Directive 95/46 create an obligation for operators of search engines to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, even cases where that name or information is not erased beforehand or simultaneously from those web pages, and when the publication on those pages is lawful.
 
 
 
Google submitted it is the responsibility of the publisher to respond to requests for the removal of information. The claimants argued that "''the national authority may directly order the operator of a search engine to withdraw from its indexes and intermediate memory information containing personal data that has been published by third parties''."
 
 
 
The Court deemed that a balance ought to be struck between the legitimate interest of internet users potentially interested in having access to the information requested to be removed from the search results and the data subject’s fundamental rights under Articles 7 and 8 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT Charter]. It highlighted that "the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information" could shift that balance in favour of the interest of the public, particularly when the data subject plays a public role in society. It nonetheless held that "''in order to comply with the rights laid down in [Articles 12(b) and 14(a) Directive 95/46] and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.''"
 
 
 
==== Scope of the data subject’s rights guaranteed by Directive 95/46 ====
 
The Court finally considered whether data subjects essentially have a 'right to be forgotten' derived from Articles 12(b) and 14(a) Directive 95/46. It assessed Article 6(1)(c) to (e) of Directive 95/46 and held that "''even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed.''"
 
 
 
It applied this test to the present case, and determined that "''having regard to the sensitivity for the data subject’s private life of the information contained in those announcements and to the fact that its initial publication had taken place 16 years earlier''", Mario Costeja Gonzalez had a right for the links he originally complained about to be removed from the list of results (when searching his name).
 
 
 
In other words, the Court affirmed that data subjects had a 'right to be forgotten' under Directive 95/46.
 
  
 
== Comment ==
 
== Comment ==

Please note that all contributions to GDPRhub are considered to be released under the Creative Commons Attribution-NonCommercial-ShareAlike (see GDPRhub:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please answer the question that appears below (more info):

Cancel Editing help (opens in new window)

Template used on this page: