EU Court of Justice Allows Individuals to Demand Google remove Search Results Containing their Names
June 17, 2014
EU Court of Justice Allows Individuals to Demand Google remove Search Results Containing their Names
Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), & Mario Costeja González,
Case C 131/12
V. Skouris, President, K. Lenaerts, Vice-President, M. Ilešič (Rapporteur), L. Bay Larsen, T. von Danwitz, M. Safjan, Presidents of Chambers, J. Malenovský, E. Levits, A. Ó Caoimh, A. Arabadjiev, M. Berger, A. Prechal and E. Jarašiūnas Judges
In 2010 Mario Costeja González, a Spanish national, lodged with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, the AEPD) a complaint against La Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain, in particular in Catalonia) and against Google Spain and Google Inc. Mr Costeja González contended that, when an internet user entered his name in the search engine of the Google group (‘Google Search’), the list of results would display links to two pages of La Vanguardia’s newspaper, of January and March 1998. Those pages in particular contained an announcement for a real-estate auction organised following attachment proceedings for the recovery of social security debts owed by Mr Costeja Gonzále
With that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appeared) or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Mr Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future. Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the Court of Justice.
International Law – protection of fundamental rights and freedoms – Personal data — Protection of individuals with regard to the processing of such data — Directive 95/46/EC, Articles 2, 4, 12 and 14 — Material and territorial scope — Internet search engines — Processing of data contained on websites — Searching for, indexing and storage of such data — Responsibility of the operator of the search engine — Establishment on the territory of a Member State — Extent of that operator’s obligations and of the data subject’s rights — Charter of Fundamental Rights of the European Union — Articles 7 and 8
- whether Article 2(b) of Directive 95/46 was to be interpreted as meaning that the activity of a search engine as a provider of content which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of that provision when that information contains personal dat
- Whether Article 4(1)(c) of Directive 95/46 could be interpreted as meaning that there is “use of equipment … situated on the territory of the said Member State”, when a search engine uses crawlers or robots to locate and index information contained in web pages located on servers in that Member State,
- Whether Google Search, as a provider of content, consisting in locating information published or included on the net by third parties, indexing it automatically, storing it temporarily and finally making it available to internet users according to a particular order of preference, when that information contained personal data of third parties: must an activity like the one described be interpreted as falling within the concept of “processing of … data” used in Article 2(b) of Directive 95/46?
- Whether the [AEPD], while protecting the rights embodied in [Article] 12(b) and [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, directly imposed on Google Search a requirement that it withdrew from its indexes an item of information published by third parties, without addressing itself in advance or simultaneously to the owner of the web page on which that information was located
- Whether the obligation of search engines to protect those rights would be be excluded when the information that contains the personal data has been lawfully published by third parties and was kept on the web page from which it originated
- Whether the rights to erasure and blocking of data, extended to enabling the data subject address himself to search engines in order to prevent indexing of the information relating to him personally, published on third parties’ web pages, invoking his wish that such information should not be known to internet users when he considers that it might be prejudicial to him or he wishes it to be consigned to oblivion, even though the information in question had been lawfully published by third partiesdirective 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Article 2 of Directive 95/46 states that for the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
Article 3 of Directive 95/46, entitled ‘Scope’, states in paragraph 1:
‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’
Article 4 of Directive 95/46, entitled ‘National law applicable’, provides:
‘1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;
(b) the controller is not established on the Member State’s territory, but in a place where its national law applies by virtue of international public law;
(c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.
- By searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results.
- Those operations, which are referred to expressly and unconditionally in the directive, must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data. The operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect.
- The operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive; given that it is the operator which determines the purposes and means of the processing. in this regard that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements. This was the only way that the guarantees laid down by the directive would be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.
- The operator was, in certain circumstances, obliged to remove links to web pages that were published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. Such an obligation may also exist in a case where that name or information was not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
- Processing of personal data carried out by such an operator enables any internet user, when he made a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet. This information potentially concerned a vast number of aspects of his private life and without the search engine; the information could not have been interconnected or could have been only with great difficulty. Internet users may thereby establish a more or less detailed profile of the person searched against. Furthermore, the effect of the interference with the person’s rights was heightened on account of the important role played by the internet and search engines in modern society, which rendered the information contained in such lists of results ubiquitous. In the light of its potential seriousness, such interference could not be justified by merely the economic interest which the operator of the engine had in the data processing.
- A fair balance should be sought in particular between that interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. Whilst it was true that the data subject’s rights also override, as a general rule, that interest of internet users. This balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
- If it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. The Court observed in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.
- When appraising such a request made by the data subject in order to oppose the processing carried out by the operator of a search engine, it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that was the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.