CJEU - C‑131/12 - Google Spain
|CJEU - C‑131/12 Google Spain|
Article 12(b) Directive 95/46/EC
Article 14(1)(a) Directive 95/46/EC
Article 2(d) Directive 95/46/EC
Article 4(1)(a) Directive 95/46/EC
Article 4(1)(c) Directive 95/46/EC
Article 2(b) Directive 95/46/EC
|Parties:||Agencia Española de Protección de Datos (AEPD)|
Google Spain SL
Mario Costeja González
|Case Number/Name:||C‑131/12 Google Spain|
|European Case Law Identifier:||ECLI:EU:C:2014:317|
|Reference from:||AN (Spain)|
|Language:||24 EU Languages|
The CJEU held that an Internet search engine operator is considered the controller (Article 2(d) Directive 95/46) in respect of the processing (within the meaning of Article 2(b) Directive 95/46) that it carries out of personal information which appears on web pages published by third parties, namely the (i) finding, (ii) indexing, (iii) temporary storing, and (iv) making it available to web users in a particular order. As such, search engine operators have to comply with the obligations provided for by that Directive, in particular by removing information connected to a person published by third parties from the list of results displayed following a search made on the basis of a person’s name.
In March 2010, Mario Costeja Gonzalez, a Spanish national, lodged a complaint against the newspaper 'La Vanguardia Ediciones', Google Spain and Google Inc. with the Spanish DPA (AEPD). The complaint was based on the fact that when internet users entered his name in Google Search, they would find links to two pages of the newspaper (from 19 January and 9 March 1998) on which an announcement mentioning his name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts that he owed.
The AEPD rejected the complaint in so far it related to the newspaper, as the articles had been lawfully published by order of the Ministry of Labour and Social Affairs. However, it upheld the complaint against Google Spain and Google Inc. because it considered "that it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties."
The two Google entities brought separate actions before the Spanish High Court appealing the AEPD's decision. The court joined the two cases, and stated that the case raised the question of what obligations are owed by operators of search engines to protect personal data. It held that the answer to this question depended on the correct interpretation of Directive 95/46.
Thus, it referred the following questions to the CJEU:
- "With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation:
(a) must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise:
- when the undertaking providing the search engine sets up in a Member State an office or subsidiary for the purpose of promoting and selling advertising space on the search engine, which orientates its activity towards the inhabitants of that State, OR
- when the parent company designates a subsidiary located in that Member State as its representative and controller for two specific filing systems which relate to the data of customers who have contracted for advertising with that undertaking, OR
- when the office or subsidiary established in a Member State forwards to the parent company, located outside the European Union, requests and requirements addressed to it both by data subjects and by the authorities with responsibility for ensuring observation of the right to data protection, even where such collaboration is engaged in voluntarily?
(b) Must Article 4(1)(c) of Directive 95/46 be interpreted as meaning that there is “use of equipment … situated on the territory of the said Member State”:
- when a search engine uses crawlers or robots to locate and index information contained in web pages located on servers in that Member State, OR
- when it uses a domain name pertaining to a Member State and arranges for searches and the results thereof to be based on the language of that Member State?
(c) Is it possible to regard as a use of equipment, in the terms of Article 4(1)(c) of Directive 95/46, the temporary storage of the information indexed by internet search engines? If the answer to that question is affirmative, can it be considered that that connecting factor is present when the undertaking refuses to disclose the place where it stores those indexes, invoking reasons of competition?
(d) Regardless of the answers to the foregoing questions and particularly in the event that the Court … considers that the connecting factors referred to in Article 4 of [Directive 95/46] are not present:
must Directive 95/46 … be applied, in the light of Article 8 of the [Charter], in the Member State where the centre of gravity of the conflict is located and more effective protection of the rights of … Union citizens is possible?
2. As regards the activity of search engines as providers of content in relation to Directive 95/46 …:
(a) in relation to the activity of [Google Search], as a provider of content, consisting in locating information published or included on the net by third parties, indexing it automatically, storing it temporarily and finally making it available to internet users according to a particular order of preference, when that information contains personal data of third parties: must an activity like the one described be interpreted as falling within the concept of “processing of … data” used in Article 2(b) of Directive 95/46?
(b) If the answer to the foregoing question is affirmative, and once again in relation to an activity like the one described:
must Article 2(d) of Directive 95/46 be interpreted as meaning that the undertaking managing [Google Search] is to be regarded as the “controller” of the personal data contained in the web pages that it indexes?
(c) In the event that the answer to the foregoing question is affirmative:
may the [AEPD], protecting the rights embodied in [Article] 12(b) and [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, directly impose on [Google Search] a requirement that it withdraw from its indexes an item of information published by third parties, without addressing itself in advance or simultaneously to the owner of the web page on which that information is located?
(d) In the event that the answer to the foregoing question is affirmative:
would the obligation of search engines to protect those rights be excluded when the information that contains the personal data has been lawfully published by third parties and is kept on the web page from which it originates?
3. Regarding the scope of the right of erasure and/or the right to object, in relation to the “derecho al olvido” (the “right to be forgotten”), the following question is asked:
must it be considered that the rights to erasure and blocking of data, provided for in Article 12(b), and the right to object, provided for by [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, extend to enabling the data subject to address himself to search engines in order to prevent indexing of the information relating to him personally, published on third parties’ web pages, invoking his wish that such information should not be known to internet users when he considers that it might be prejudicial to him or he wishes it to be consigned to oblivion, even though the information in question has been lawfully published by third parties?’
Share your comments here!
Share blogs or news articles here!