Euroopa Kohus
13.05.2014
Facts:
In 1998, Spanish newspaper La Vanguardia published 2 announcements regarding the forced sale of properties due to social security debts, one of which concerned Mr. González. These announcements were later made available online. In 2009, Mr. González contacted La Vanguardia to request the removal of the online content, arguing that the matter had been resolved years earlier and was no longer relevant. The newspaper declined his request, stating that the publication was legally justified.
Subsequently, Mr. González approached Google Spain and Google Inc. to request the removal of links to these announcements from search results. Google forwarded the request to Google Inc., which was based in the United States of America. After receiving no satisfactory response, Mr. González filed a complaint with the Spanish Data Protection Agency, which upheld his complaint against Google Spain and Google Inc., ordering them to remove the links. Google appealed this decision to the Audiencia Nacional, which referred several questions to the Court of Justice of the European Union for a preliminary ruling.
Questions referred to the CJEU by the national courts:
Does the operation of a search engine, such as Google, processing personal data by displaying links to third-party web pages, fall under the scope of the EU Data Protection Directive? Do individuals have the right to request the removal of links to personal data from search engine results, and under what conditions?
Court’s ruling:
The Court ruled that search engines process personal data when they collect, organize, and display information containing personal details. It held that search engine operators determine the purposes and means of this processing and are therefore considered data controllers under Directive. Although Google Inc. is based in the USA, the Court found that EU law applied due to the activities of its subsidiary, Google Spain, which promoted and sold advertising linked to the search engine. This commercial presence established a sufficient connection with the EU territory. Therefore, Google must comply with EU data protection laws, including respecting individuals’ rights over their personal data.
Importantly, the Court established the “right to be forgotten”, holding that individuals can request the removal of links to information that is outdated, irrelevant, or excessive, especially when it affects their privacy. However, this right is not absolute, as it must be balanced against the public’s right to access information and freedom of expression. This right may apply even when the original publication is lawful and remains accessible on the original website. The Court emphasized that the individual’s right to data protection and privacy generally overrides the public’s interest in accessing that information through a search engine. The Court emphasized that such requests must be assessed on a case-by-case basis, considering factors like the nature of the information, the role of the individual in public life, and the time elapsed since publication.