Case title:
Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
Date of Order:
13 May 2014
Bench:
V. Skouris (President), K. Lenaerts (Vice-President), M. Ilešič (Rapporteur), L. Bay Larsen, T. von Danwitz, M. Safjan, J. Malenovský, E. Levits, A. Ó Caoimh, A. Arabadjiev, M. Berger, A. Prechal and E. Jarašiūnas, JJ. Advocate General: N. Jääskinen.
Parties:
Google Spain SL and Google Inc. (Appellants before the Audiencia Nacional) v the Spanish Data Protection Agency (AEPD) and Mr Mario Costeja González (Respondents). The matter reached the CJEU as a preliminary reference under Article 267 TFEU from the Audiencia Nacional (National High Court), Spain.
SUBJECT
Data protection and privacy law; the right to be forgotten (right to de-listing); liability of internet search engines such as Google for processing personal data; and the territorial reach of EU data protection law over non-EU tech companies.
IMPORTANT PROVISIONS
- Directive 95/46/EC (Data Protection Directive), Article 2(a), (b) and (d): definitions of “personal data”, “processing” and “controller”.
- Article 4(1)(a) and (c): when a Member State’s national data protection law applies, including to controllers with an “establishment” in that State.
- Article 6(1)(c) to (e): data must be adequate, relevant, not excessive, kept up to date and retained no longer than necessary.
- Article 7(f): processing based on legitimate interests, subject to the data subject’s overriding rights.
- Article 9: exemptions for processing carried out solely for journalistic purposes.
- Article 12(b): right to rectification, erasure or blocking of non-compliant data.
- Article 14, first paragraph, subparagraph (a): right to object on compelling legitimate grounds.
- Article 28(3) and (4): powers of national supervisory authorities.
- Charter of Fundamental Rights of the EU, Articles 7 and 8: respect for private life and protection of personal data.
- Spanish Organic Law No 15/1999: Spain’s law transposing Directive 95/46.
Overview
What will appear if you type your name into Google? In 2010, when a Spanish-German national Mario Costeja González searched his name online, embarrassing information popped on the screen regarding attachment proceedings on his social security debt (Para 14). The debts had been settled long before, but Mr. Costeja González complained to the AEPD on 5 March 2010, requesting La Vanguardia, the Catalan newspaper that had posted the announcement, to remove or alter the two pages (19 January and 9 March 1998) of La Vanguardia. He also requested that Google remove or conceal the data from its search results. The complaint argued that the attachment proceedings were ‘already completely resolved several years ago’ and, therefore, any reference to them was ‘entirely irrelevant’ (Para 15).
AEPD delivered a partially dissenting decision on 30 July 2010, rejecting the complaint against La Vanguardia and ruling in favor of the complainant against Google Spain and Google Inc. The former had published the notice on the order of the Ministry of Labour and Social Affairs to attract bidders (Para 16). However, the latter were held responsible; search engine operators process personal data, bear responsibility for processing, and can be ordered to withdraw data from their index even if the webpage is online and lawful (Para 17).
Google Spain and Google Inc. appealed the decision before the Audiencia Nacional, which joined the actions and asked the CJEU on 27 February 2012 about the obligations of search engines to persons who do not want information about them to be “located, indexed and made available to internet users indefinitely” (Para 19). The Grand Chamber’s response became one of the most talked-about privacy rulings of the internet age, laying the “right to be forgotten” in the GDPR’s Article 17.
Issues raised
- Material scope: is a search engine’s finding, indexing, storing and displaying of third-party web content a “processing of personal data” and is Google the “controller” of that processing? (Question 2(a) and (b))
- Territorial scope: is EU (and Spanish) data protection law applicable to Google Inc., a US company, because it has a Spanish subsidiary that sells advertising? (Question 1)
- Extent of responsibility: can Google be ordered to remove links from search results directly, without the original publisher first deleting the information, and even if the original publication is lawful? (Question 2(c) and (d))
- The right to be forgotten: can a person ask a search engine to de-list lawfully published, true information about them simply because it is prejudicial or they want it forgotten with time? (Question 3)
Arguments Advanced By The Appellant
Google Spain and Google Inc., aided on multiple points by the Greek, Austrian and Polish Governments, made the following submissions:
- •No “processing”, and certainly no “controller”: Google argued that search engines “process all the information available on the internet without effecting a selection between personal data and other information”, and that even if this were processing, the operator “has no knowledge of those data and does not exercise control over the data” (Para 22). The Greek Government also emphasized that search engines are mere intermediaries and should be controllers only when they cache data longer than technically necessary (Para 24).
- Google Spain is only an advertising arm: the processing is carried out solely by Google Inc. in the US, with no involvement of Google Spain, the role of which is limited to supporting the group’s advertising business, which is separate from search (Para 51).
- Go to the publisher, not the search engine: citing proportionality, Google submitted that “any request seeking the removal of information must be addressed to the publisher of the website concerned”, since the publisher is best placed to judge lawfulness and it has the most effective and least restrictive means of removal. Forcing search engines to de-index will ignore the rights of publishers, other internet users and Google itself (Para 63). Further the Austrian Government said that a search engine should be told to remove data only if the data was already considered illegal or wrong or if the person who provided the data had won an argument, against the publisher (Para 64).
- No general right to be forgotten: Articles 12(b) and 14(a) give rights when the way the data is used breaks the rules or when there are strong reasons to do so and not just because someone thinks the data is harmful or wants it to never exist in the first place (Para 90). The Commission joined Google on this specific point.
Arguments advanced by the respondent
Mr. Costeja González, aided by the Spanish, Italian, Austrian and Polish Governments and the European Commission (on the first issues), made the following submissions:
- Search is distinct processing: a search engine clearly processes personal data, in a manner distinct from and with different objectives than the website publisher, and the operator is the controller because it decides the purposes and means of that processing (Para 23).
- Google Spain is an “establishment”: given the inextricable link between Google Search and Google Spain’s advertising activity, the latter is an establishment of Google Inc. and the processing occurs in the context of its activities (Para 47). Article 4(1)(a) only requires processing “in the context of the activities” of the establishment, not processing by the establishment itself (Para 52).
- Direct orders against search engines: the national authority may directly order a search engine to remove information from its index, without first approaching the publisher, and the lawfulness of the original publication does not reduce Google’s obligations (Para 65).
- Privacy includes the right to be forgotten: a person may oppose indexing where dissemination through the search engine harms them and their rights to privacy and data protection, which include the right to be forgotten, outweigh the operator’s interests and the general interest in freedom of information (Para 91).
JUDGEMENT ANALYSIS
The Grand Chamber unanimously ruled in favor of Mr Costeja González on all issues. However, it is the reasoning behind the judgment that is momentous. The Court interpreted the 1995 Directive, which predates Google’s appearance on the horizon, through the prism of the Charter of Fundamental Rights, and importantly, held that the processing of personal data in search results is not ‘exempt from the fundamental rights guaranteed by the Charter’.
A. Google Is A “Controller” Processing Personal Data
Article 2(b) of the Directive, which lists activities which constitute ‘processing’, clearly includes crawling, indexing, storing, displaying and providing access to the search results. As the Court observed:
“in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results” (Para 28)
No difference was made by the fact that the data had already been published and remained in their original form (Paras 29-31). On the issue of whether Google was a ‘controller’ within the meaning of Article 2(a), the Court held:
“It is the search engine operator which determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of that activity and which must, consequently, be regarded as the ‘controller’ in respect of that processing” (Para 33)
However, it is in paragraphs 36-38 that the true significance of the Court’s analysis emerges. The Court noted that a search engine does far more than a newspaper classifieds section. It explained that a search for a name would yield the user ‘a structured overview of the information relating to that individual that can be found on the internet enabling them to establish a more or less detailed profile of the data subject’ (Para 37).
It is this function that makes a search engine different. The fact that website owners could prevent a search engine from indexing their pages using robots.txt or noindex directives was of no avail (Paras 39-40).
B. Eu Law Applies To Google Inc Through Its Spanish Subsidiary
Google’s argument that the search engine was controlled exclusively from California was rejected. Google Spain was an “establishment” for the purposes of Article 15(3). The Court reasoned that the concept of “in the context of the activities” carried out by an undertaking established in a Member State “must be interpreted broadly … given the particular territorial breadth of the scope of application of the [1995] Directive as chosen by the legislator” (Para 54). The Court then proceeded to demonstrate the close ties between the corporate group and Google Spain. It observed that
“the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed” (Para 56)
As a consequence of the inextricable link between ad revenues and search, the processing of personal data occurred “in the context of the activities” of Google Spain, because the ads appeared on the same page as the search results (Para 57). The Court did not need to consider the other issues in this Section because it was satisfied that the first ground was sufficient to establish Google Spain’s liability (Paras 59, 61). The ‘follow the money’ approach is a useful reminder to any multinational group that derives revenues from processing the data of EU residents via a local subsidiary.
C. Search Engines Could Be Directly Ordered By Data Subjects To De-List
Articles 12(b) and 14(a) of the Data Protection Directive were interpreted by the Court in light of Articles 7 and 8 of the Charter. It acknowledged the fundamental importance of name searches, and therefore
“the interference with the right to privacy resulting therefrom cannot be justified by merely the economic interest which the operator of such an engine has in that processing” (Para 81)
A balancing act had to be performed between the “interest of internet users in accessing the information” and the “the fundamental rights of the data subject to control of his or her personal data” (Para 81). This assessment was to be made on a case by case basis, taking into account the relevance and sensitivity of the information, as well as the role of the data subject in public life (Para 81). Of particular note is the Court’s dismissal of Google’s argument that it was merely a conduit for information, and that data subjects should turn to the publishers. The Court observed that
“effective and complete protection of data users could not be achieved if the latter had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites” (Para 84)
And further highlighted the differences between the obligations of the publishers and search engines (Para 85). It also noted that in some circumstances, the erasure from a publisher’s website might not even be possible due to the Journalist’s exemption under Article 9. Furthermore, the balancing test outlined in Para 81 was different for each party: the right to privacy dominated for the data subject whereas the search engine had to weigh the public interest in the information (Para 86).
“Inclusion of the information in the search results … is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page” (Para 87). This explains why La Vanguardia’s archives could remain online, while the search results linking to them had to be de-listed.
D. The Right To Be Forgotten
This part of the judgment is of particular interest to data subjects, as the Court explicitly recognized a ‘right to be forgotten’. However, this right was found to be implicit in the data minimisation principles in Article 6(a) and (f). According to the Court:
“even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed” (Para 93)
and therefore ‘inadequate, irrelevant or no longer relevant, or excessive’ data should be deleted (Para 94). Notably, the Court held that ‘in order to find such a right that the inclusion of the information in the list of results causes prejudice to the data subject’ need not be established (Para 96). It then laid down the default position:
“in respect of personal data processing carried out in relation to the listing of a person’s name on the internet, the rights of the data subject to privacy must, as a general rule, prevail over not only the economic interests of the operator of the search engine but also the legitimate interests of the general public in finding that information upon a search relating to the data subject’s name, unless the opposite is demonstrated taking into account, in particular, the role played by the data subject in public life” (Para 97)
The Court then applied this standard to Mr Costeja González, observing that “the sensitivity for the data subject’s private life of the information contained in those announcements and to the fact that its initial publication had taken place 16 years earlier” (Para 98). The absence of any overriding public interest, which the national court was to assess, meant that he could exercise his right to be forgotten.
E. One critical view
While this decision is mostly seen as a move, for privacy there are some things to keep in mind.
- First the Court paid no attention to the views of Advocate General Jääskinen who thought that the Directive did not give a right to be forgotten when it comes to search engines. The Grand Chamber went much further than the AG, interpreting the Data Protection Directive in an exceptionally rights conscious manner.
- Secondly, freedom of speech was not given due weight. The Court used the vague language of the ‘interest of internet users’ while placing the onus of balancing on the national courts, and sidelined the fundamental right to freedom of expression. This prompted protests from media outlets and free speech advocates.
- Third, the ‘right to be forgotten’ essentially makes search engines the arbiters of what constitutes newsworthy information on the Internet. Users must request removals on an individual basis (Para 77), and the operators are tasked with deciding, on a case by case basis, whether an individual’s right to privacy outweighs the public’s interest in accessing the information (Para 97) – a judicial role which few companies are equipped to handle.
- Fourth, the tests are vague: the deletion of data should occur when they are “no longer relevant” (Para 94) or “unless the opposite is demonstrated taking into account, in particular, the role played by the data subject in public life” (Para 97).
- Most ironically, the very act of publishing the ruling and the subsequent media frenzy ensured that Mr Costeja González and his debt scandal were far more widely known than they had ever been before, thus defeating the very purpose of the ‘right to be forgotten’.
F. Why it matters today including in India
The ruling is today enshrined in the EU General Data Protection Regulation (GDPR) as the “right to erasure” under Article 17. However, as Google LLC v CNIL(C‑507/17, 2019) makes clear, the GDPR does not require global delisting by search engines. For Indian readers, it is important to note that Google Spain is often cited in judgments concerning the right to be forgotten.
India’s Supreme Court in Justice K.S. Puttaswamy v Union of India (2017) recognised informational privacy as a fundamental right. While the nine-judge bench did not specifically endorse the right to be forgotten, Justice Kaul’s concurring opinion refers to it.
High Courts across the country have granted similar relief: Sri Vasunathan v Registrar General (2017) (Karnataka High Court) and Jorawar Singh Mundy v Union of India (2021) (Delhi High Court) are two such examples. Statutorily, Section 12 of the new Digital Personal Data Protection Act, 2023 provides for the right to correction and erasure of personal data.
CONCLUSION
Google Spain v AEPD changed the internet. The CJEU held that (i) a search engine processes personal data and Google is the controller of that processing; (ii) EU data protection law applies to a non-EU search engine with an advertising subsidiary in a Member State; (iii) a search engine can be ordered to remove links even if the original page stays up and was lawfully published; and (iv) individuals can ask for de-listing of information that is inadequate, irrelevant, no longer relevant or excessive, without having to show harm, unless the public interest, for example because of their role in public life, prevails.
The case teaches a simple lesson: what is lawful to publish is not necessarily lawful to keep pushing to the top of a name search forever. Time matters. Context matters. And the companies that organise the world’s information carry responsibility for the profiles they create. At the same time, the judgment leaves hard questions about free expression and private gatekeeping that courts and legislators, in Europe and in India, are still answering.
Key Takeaways
- Search engines like Google are “controllers” of personal data under EU law.
- A local ad-sales subsidiary is enough to bring a foreign tech giant under EU data protection law.
- De-listing can be ordered against Google even when the original publication remains lawful.
- Lawful, true data can become non-compliant with the passage of time.
- No proof of prejudice is needed; public figures may face a higher bar.
