Google Spain (2014): The Right to Be Forgotten and Data Protection
Google Spain SL v Agencia Española de Protección de Datos (AEPD) (Case C-131/12), commonly known as Google Spain or the Right to Be Forgotten case, is a landmark judgment of the Court of Justice of the European Union delivered on 13 May 2014. The case established that search engines are data controllers in respect of the personal data displayed in search results and that individuals have the right, under certain conditions, to request the removal of links to personal information that is inadequate, irrelevant, or excessive. The judgment transformed the landscape of data protection in the digital age and established the right to be forgotten as a principle of EU law.
Facts of the Case
Mario Costeja González, a Spanish national, discovered that an online archive of a Spanish newspaper, La Vanguardia, contained an announcement of a real estate auction relating to a debt he had incurred in 1998, which had since been resolved. When he searched for his name on Google, the search results displayed links to the newspaper announcement. Costeja González complained to the Spanish Data Protection Agency (AEPD), requesting that La Vanguardia remove the information and that Google Spain remove the links from its search results.
The AEPD rejected the complaint against La Vanguardia (on the ground that the publication was legally justified) but upheld the complaint against Google Spain and Google Inc., requiring them to remove the links. Google challenged the decision before the Spanish Audiencia Nacional, which referred questions to the CJEU concerning the scope of the Data Protection Directive (Directive 95/46/EC), the territorial application of EU data protection law, and the rights of individuals to control their personal data.
Search Engines as Data Controllers
The CJEU held that Google, as the operator of a search engine, was a data controller within the meaning of Article 2(d) of the Data Protection Directive. The Court reasoned that the search engine’s activities of finding, indexing, storing, and making available personal information on the internet constitute the “processing of personal data.” The search engine determines the purposes and means of this processing, as it decides what information to index, how to organise it, and how to present it in search results.
The Court rejected Google’s argument that it merely provided access to information already published on third-party websites. The search engine played a decisive role in making personal information accessible to internet users who would not otherwise have found it. The processing of personal data by search engines affects the privacy rights of individuals in a manner that is distinct from and additional to the publication by the original source. The search engine therefore has responsibilities as a data controller that are independent of the original publisher.
The Territorial Scope of EU Data Protection Law
Google argued that its data processing was carried out by Google Inc. in the United States, and that Google Spain, a Spanish subsidiary, was merely a commercial representative with no involvement in the processing of personal data. The Court rejected this argument, holding that the processing of personal data by Google Inc. was carried out in the context of the activities of Google Spain. Google Spain was established in Spain to promote the sale of advertising space, and the processing of personal data by Google Inc. was inextricably linked to the sale of advertising space by Google Spain.
The Court’s interpretation of territorial scope was broad and purposive. The Directive applied to the processing of personal data by a search engine whose operator had a branch or subsidiary in a Member State that was engaged in activities closely linked to the data processing, even if the processing itself was carried out outside the EU. The judgment established that the territorial reach of EU data protection law extends to non-EU companies that have an establishment in the EU and that process personal data in connection with the activities of that establishment.
The Right to Be Forgotten
The CJEU interpreted Articles 12(b) and 14(1)(a) of the Data Protection Directive as conferring a right on individuals to request the removal of links to personal information from search results. The right applies where the information is inadequate, irrelevant, or excessive in relation to the purposes of the processing, or where the information is no longer relevant given the time that has elapsed. The individual does not need to demonstrate that the information causes harm; the right exists where the data subject has a legitimate interest in the removal of the link.
The right to be forgotten is not absolute. The Court held that a balance must be struck between the individual’s privacy rights under Articles 7 and 8 of the Charter of Fundamental Rights and the legitimate interests of internet users in accessing the information under Article 11 of the Charter (freedom of expression and information). The balance may depend on the nature of the information, its sensitivity, the public interest in access, the role of the data subject in public life, and the time that has elapsed.
The Court provided guidance on the balancing exercise. Where the data subject is a public figure and the information relates to their public life, the public interest in access may outweigh the privacy interest. Where the data subject is a private individual and the information is sensitive, outdated, or excessive, the privacy interest will generally prevail. The balancing is context-specific and must be assessed on a case-by-case basis.
The Implementation of the Judgment
The Google Spain judgment had immediate practical consequences. Google received hundreds of thousands of removal requests within days of the judgment, and the company established an advisory committee of experts to develop criteria for evaluating requests. Google and other search engines have processed millions of removal requests since 2014, delisting links where the conditions of the judgment are satisfied.
The right to be forgotten varies across Member States in its application. The CJEU has held that search engines should delist results from all EU domain extensions (e.g., google.de, google.fr) where the right is established, but not necessarily from global domain extensions (google.com). The Court addressed this issue further in Google v CNIL (Case C-507/17), holding that EU law does not require global delisting but that Member States may order global delisting under certain conditions.
Incorporation into the GDPR
The right to be forgotten, as established in Google Spain, was codified in Article 17 of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). Article 17 sets out the right to erasure (right to be forgotten) and specifies the grounds for erasure, including where the personal data is no longer necessary, the data subject withdraws consent, the data has been unlawfully processed, or the data must be erased to comply with a legal obligation.
The GDPR also establishes exceptions to the right to be forgotten, including where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest, or for the establishment, exercise, or defence of legal claims. The GDPR’s codification of the right to be forgotten has given the Google Spain principles a firm legislative basis in EU law.
The Legacy of Google Spain
Google Spain is one of the most influential CJEU judgments of the digital age. It established that privacy rights in the digital environment require search engines to take responsibility for the personal data they process and that individuals have a right to control the accessibility of their personal information online. The judgment has been cited in data protection proceedings around the world and has influenced the development of data protection law in other jurisdictions. It remains the leading authority on the right to be forgotten and the obligations of search engines under EU data protection law.