The Court of Justice of the European Union creates precedent according to which Google must erase personal data subsequent to a request by the person concerned

By Konstantinos Kakavoulis

The case Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (referred to as Google Spain v. Costeja Gonzalez) was decided before the Court of Justice of the European Union. The decision was issued on 25 June 2013. It constitutes a landmark for human rights in the digital age.

– Case history

On 5 March 2010, a Spanish citizen, Mario Costeja Gonzalez, filed a claim before the Spanish Authority for Personal Data Protection (AEPD) against a Spanish newspaper, Google Spain SL and Google Inc. The applicant complained that any Internet user, who typed his name in the Google search engine, would receive as a result two publications by some Spanish newspaper regarding a confiscation order for his house. The applicant requested that the newspaper erased his name from the publications and that Google removed his personal data in issue from the results it provides to its users. He argued that the confiscation procedure against his house had long been terminated and that any reference to it was totally irrelevant at present.

The Spanish Data Protection Authority dismissed the claim regarding the newspaper, but approved it regarding Google. According to the Authority, the newspaper was not obliged to repeal the publications, since they were lawfully published during the date on which they had been issued. On the contrary, it found that search engines are personal data processors and consequently Google Spain and Google Inc. had to erase the personal data, subsequently to the application filed by Mr. Costeja Gonzalez. The Authority based its decision on EU Directive 1995/46/EU.

Subsequently, Google Spain and Google Inc. appealed, against the aforementioned decision before the High Court of Spain. The latter referred a series of questions to the Court of Justice of the European Union (CJEU) regarding the correct implementation of the Directive. The questions concerned whether Google is subject to the notion of the processor of personal data and also whether, as an EU corporation, is subject to the provisions of the Directive. In case of a negative response, the High Court requested from the CJEU to determine Google’s liability as a data processor and assess whether a citizen has the right to request from Google to erase his personal data, namely the right to be forgotten.

– The CJEU decision

The CJEU found that Google is indeed a processor of personal data, since it “collects such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results” and since it determines the purposes and means of this processing. The Court also found that Google Spain is an affiliated company of Google Inc. and therefore, Google Inc. is subject to the EU Directive.

One of the main points of the decision concerns the legal obligations which search engines, such as Google, have, according to the Directive. The Court found that search engines have the right to process personal data, when this is necessary in order for the legitimate interest of the data holder or third parties to be served. This right is not absolute. It may be limited when it contests the interests or the fundamental rights of the data subject –especially its right to privacy. The Court underlined that the economic interests of the search engine are not enough to impose limitations on the right to privacy. The Court also reminded that the right to privacy in principle prevails over the right of the public to gain access to personal data of a non-public figure.

The Court decided that the data subject has undoubtedly a legitimate interest to deny the disclosure of its personal data, even if such disclosure is not harmful to it. This right is founded on its right to privacy. Consequently, the data subject –in the present case Mr. Costeja Gonzalez- can request the erasure of his data, if the information disclosed are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine”. In such an event, not only the data subject has the pertinent right, but also the data controller has the obligation to erase the data.

With this decision, the Court found that Mario Costeja Gonzalez had the right to request the erasure of his personal data from Google, while the latter had the obligation to erase them. Thus, this decision acknowledged the right to be forgotten for data subjects and the pertinent obligation for the data controller.

– Commentary on the decision

This decision is of great significance. It created precedent upon which subsequent rulings of the Court may be justified. Furthermore, national courts’ judgements may be based upon its reasoning or the opinions of the minority. We already see that the General Data Protection Regulation (GDPR) institutionalizes the right to be forgotten, in a way which constitutes a logical continuation of the decision at issue. It is therefore very important for the decision to be analysed and commented.

It must be underlined that the decision does not seem to distinguish between the consequences of removing data from a search engine and removing them from a website. The publication of data in a single website has significantly fewer consequences for the right to privacy and personal data protection than the disclosure of the same data in a search engine. The capability of the search engine to collect information, to aggregate them, to publish them as a whole and therefore create a whole profile for the user is something which may not be done by a single website. Thus, the data published in a search engine can be accessed by a wider public and can create a whole digital personality for a person. This reasoning was used by the Court in its judgement.

According to the same way of thinking, the removal of data from a search engine has much more important consequences than the removal of data from a website. The first influences in a much more substantial way the right to be informed. When someone searches for information regarding a person, it is much more probable that he searches for this information by typing the name of the said person in a search engine rather than searching for it in every single website, in which he considers that this name is possibly mentioned. Therefore, if the personal data of a person are removed from a search engine, the right to privacy of the said person and his personal data are more adequately protected than if such data are removed from a website. The right of the public to be informed is correspondingly affected. The latter is safeguarded under the Charter of Fundamental Rights of the EU Article 11. Although the Court noted the difference between the data processing by a search engine and a website, it did not deal with the right to be informed in the same way, despite the fact that the latter is influenced in a different fashion in the two cases.

Furthermore, the Court seems to consider only public interest reasons as capable of imposing limitations to the right to privacy and personal data protection. The right to be informed should be mentioned and used as a reason for delimiting the aforementioned rights. The protection of personal data is of great importance. However, it cannot be absolute. There are cases in which other rights –and not only public interest reasons- prevail and should be taken into account in the attempt to strike a fair balance. Thus, the Court should have included the right to be informed as a right, which should be weighted with the right to be forgotten. The outcome of this case would not have been different. However, this judgement may have serious implications in future cases. For this reason, the Court should have included this thought and should have referred to the EU Charter 11 in a more detailed fashion. The right to privacy and personal data protection prevail over the right to be informed. In any case, the two rights should be weighted by the Court, which should take into account the circumstances of the specific case.

Another very important point which was not clarified by the decision is the geographical implementation of the right to be forgotten, namely whether the right is implemented beyond the EU boundaries. Very strong arguments exist for both options. The issue will probably be clarified in the case Google v. France, pending before the same Court.

Much criticism has also been raised regarding the extended definition the Court gave to the notion of “personal data controller”. According to this criticism, not only search engines, but also their users, might be considered to be personal data controllers. This criticism has fallen short of substance, since the General Data Protection Regulation seems to define adequately the notion of “personal data controller”. Certainly, the implementation of the Regulation by the Court in cases to come is anticipated with great interest.

The judgement in the case Google Spain v. Mario Costeja Gonzalez constitutes a point of reference in the protection of personal data in the European, but also the international level. Google, which constitutes one of the most prominent personal data controllers, has established a procedure for the fast and easy access of its users to the right to be forgotten (you can have access to the pertinent application form by clicking here). Furthermore, the right to be forgotten is safeguarded under the GDPR. All personal data processors are obliged to respect it and all data subjects may enjoy it, with certain limitations. Mr. Costeja Gonzalez –intentionally or not- assisted in the establishment of a right, which will play an important role in the digital age in which we live in.