Right to Be Forgotten,
CJUE, Google Spain (2014)
Mr. Costeja Gonzalez (Lawyer practitioner in a law firm) lodged with the Spanish Data Protection Authority a complaint against "La Vanguardia", which publishes a daily newspaper with a large circulation and Google Spain and Google Inc.
The complaint was based on the fact that, when an internet user entered Mr Costeja name in the Google search engine, he would obtain links to two pages of La Vanguardia, of 19 January and 9 March 1998 respectively, on which an announcement mentioning his name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts.
By the complaint Costeja Gonzalez requested:
- La Vanguardia, to remove or alter those pages so that the personal data relating to him no longer appeared or to use certain tools made available by search engines in order to protect the data. (The publication of La Vanguardia was a mandatory publication, therefore the Spanish authority had to reject the request to remove the article from "La Vanguardia").
- Google, to remove the personal data relating to him. He stated in this context that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant. (The Spanish authority accepted this request, Google challenged this decision in front of a judge in Madrid, however in Madrid didn't know if the request to remove from Google was in compliance or not with the European Directive 95/46, so he asked for clearance from the Court of Justice (preliminary reference procedure), the question asked are the one that follow).
The complaint was upheld in so far as it was directed against Google Spain and Google Inc.\ The Authority (Agencia Espanola de Proteccion de Datos) considered that operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society.
Google Spain/Google, Inc. appealed to the Audiencia Nacional de Madrid. The latter issued an order for reference to the CJEU with the following questions:
- Does the activity carried out by Google as search engine amount to a processing of personal data? (Is what google is doing covered by the Directive, are we dealing with data processing or not?)
- If so, does Google qualify as data controller? (Is Google a Data Controller or a Data Processor? Only if google is a data controller is obliged to remove information, otherwise the only responsible is the newspaper)
- If so, may a national data protection authority order Google to remove links to indexed information without prior consulting the owner of the web page?
- If so, is such an obligation excluded when the information contains personal data lawfully published by third parties?
Advocate General JAASKINEN (suggesting body that suggest which could be the solution, colored answers show the relation between the advocate general and the court of justice answers.).
"The particularly complex and difficult constellation of fundamental rights that this case presents prevents justification for reinforcing the data subjects' legal position under the Directive, and imbuing it with a right to be forgotten. This would entail sacrificing pivotal rights such as freedom of expression and information.
I would also discourage the Court from concluding that these conflicting interests could satisfactorily be balanced in individual cases on a case‑by‑case basis, with the judgment to be left to the internet search engine service provider."
- Does the activity carried out by Google as search engine amount to a processing of personal data? Yes
Agree
Application of EU law, broad interpretation of the notion of 'establishment' and of the words 'in the context of the activities'.
'in the light of the objective of Directive 95/46 of ensuring effective and complete protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data, those words cannot be interpreted restrictively'.
- Does Google qualify as data controller? Yes Disagree
It has no relevance whether the search engine has actually knowledge of the fact the personal data are contained in the websites subject to indexing. (The Court said that google is responsible since it's responsible of the indexing and the amplification of the search engine, the Court is manipulating the interpretation of the Directive 95/46 to apply).
Therefore, it amounts to a data controller and as such bears the obligations provided by the Directive 95/46.
Search engine provider as "controller", this finding is not supported by empirical evidence but rather relies on the goal of affording individuals' data privacy broad protection.
'it would be contrary not only to the clear wording of the Directive but also to its objective - which is to ensure, through a broad definition of the concept of 'controller', effective and complete protection of data subjects - to exclude the operator of a search engine from that definition on the ground that it does not exercise control over the personal data published on the web pages of third parties'.
- Does a "right to be forgotten" have any legal grounds? Yes Disagree
(Literally speaking no, because these aren't information false or incomplete, these are simply old).
Art. 12 and 14 of the Directive 95/46 provide data subjects with the right to objection and to request the erasure or blocking of personal data in case of unlawful processing of the same. In the Court's view, since not up-to-date news amounts to not correct information, an unlawful processing of personal data is at stake and, accordingly, the rights under Art. 12 and 14 are enforceable against the search engine provider.
Broad interpretation of "unlawful processing".
Art. 12, lit. b of the Directive as legal ground for the RTBF, Extensive interpretation of this provision: the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data.
Not a numerus clausus of conditions: Art. 12, lit. b only mentions some examples of the conditions authorizing data subject to enforce their rights.
- May a national data protection authority order Google to remove links to indexed information? Yes Disagree
It is first for the search engine provider, in its capacity as data controller, to receive the requests of data subjects under Art. 12 and 14 and, if the case, to remove from the search results links to contents considered to be in breach of the right to be forgotten.
No prior consultation of the web site owner is necessary (freedom of expression at risk?) (A private company such Google is now deciding the balance between privacy and access to information, freedom of speech, it is the privatization of some fundamental rights, however it ). However, data subjects may go before the competent DPA or judicial authority and ask for the removal of undesired contents.
Processing of personal data and freedom of expression. Article 9 of the Directive does not apply to the processing of personal data carried out by search engine providers. The Court has revisited the broad interpretation of the scope of this exception provided in Satamedia with respect to the relationship between data protection and freedom of information.
An Internet search engine provider may, upon certain conditions, remove from the search results certain links to undesirable contents. Removal of search results is upon request of the concerned natural/legal person. No guarantees for users' freedom of information and the dawn of the so-called "right to be forgotten."
Why Google wanted to have U.S. Law applicable rather than the Spanish/European Law? In Europe there is a different consideration of the freedom of expression, especially when it is compared to other rights. Now, the Court of Justice declared that the freedom of expression shall be balanced with the right of an individual to be "forgotten." Who carries out this balance? On which basis? (Huge Conflict of Interest, due to a lack of public informatic structure).
Article 17 - GDPR (2018) (Ultimate decisions in Europe, still active nowadays).