On May 13, 2014, the European Court of Justice (ECJ) in the Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD) — Case C 131-12, issued a preliminary ruling (i.e. an interpretation decision) on referral of the Spanish Audiencia Nacional (National High Court).
The ECJ found that a search engine’s retrieval and listing of information to the benefit of the searcher is “processing of personal data” if the information retrieved are personal data and that the search engine is a controller. In particular:
“the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d).”
The ECJ found that search engine was subject to EU privacy law if it established a branch or subsidiary to sell advertising spaces orientating “its activity towards the inhabitants of that Member State” and that, by doing so, the search engine was carrying out “processing of personal data … in the context of the activities of an establishment of the controller on the territory of a Member State”.
The search engine is obliged to delete results from the list:
“[I]n order to comply [with Article 12(b) and sub-paragraph (a) of the first paragraph of Article 14] … the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.”
The ECJ also found that, except in case the data subject is a public figure, he or she has the right to ask that
“that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject.”
This right descends from the “fundamental rights under Articles 7 and 8 of the Charter [of the Fundamental Rights of the European Union]” which
“ override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.”
Relevant Law: EU Directive 95/46/EC
Charter of Fundamental Rights of European Union
The full text of the judgment Case C 131-12 is available at: http://curia.europa…
Related press release available at http://curia.europa…
See also European Commission, Factsheet on the “Right to be forgotten”ruling (C-131/12) – here
Follow us on& Like us on