National case details
Instance: Appellate on fact and law
Area of law
Safeguards for access to justice
Relevant principles applied
Preliminary rulingJudgement of the CJEU (Grand Chamber), 13 May 2014, Case C-131/12 Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and M. C. G.
30 July 2010
AEPD Decision regarding Mr. C. G.’s complaint.
27 February 2012
Decision of Audiencia Nacional for a preliminary ruling.
13 May 2014
Decision of the CJEU.
Identification of the case
- Organic Law No 15/1999 of 13 December 1999, transposing Directive n. 95/46
- Recitals n. 2, 10, 18, 19, 20, 25 and Articles 1, 2, 3, 4, 6, 7, 9, 12, 14, 28 of Directive n. 95/46
- Articles 7, 8, 47 of the CFREU
Summary of the case
Mr. C. G. lodged with the AEPD a complaint against La Vanguardia Ediciones SL – publisher of a daily newspaper – and both Google Spain and Google Inc., stating that whenever someone entered Mr. C. G.’s name on Google Search the search engine would display links to two 1998 La Vanguardia articles, reporting an announcement mentioning Mr. C. G. with regard to a real estate auction connected with attachment proceedings for the recovery of social security debts. Mr. C. G. requested in first place that La Vanguardia either removed or altered such web pages so that his name would be concealed or removed; in second place, he requested that Google Spain and Google Inc. conceal his personal data so that they would not appear anymore on the search results and on the links to La Vanguardia articles. The AEPD rejected the plaintiff’s requests with regard to the first complaint (against La Vanguardia) since the publication of the information was legally justified by order of the Ministry of Labor and Social Affairs. The second request – against Google Spain and Google Inc. – was instead upheld: the AEPD considered that search engines operators are subjected to data protection legislation since they carry out “data processing”. The AEPD, then, stated that it had the power to order search engine operators to withdraw some data as well as to prohibit such operators to access some data when the protection of the fundamental right to data protection is at stake.
- Administrative judicial enforcement
In the national proceeding an order from an administrative authority is challenged, asking for its annulment.
1. With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation:
(a) must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise:
– when the undertaking providing the search engine sets up in a Member State an office or subsidiary for the purpose of promoting and selling advertising space on the search engine, which orientates its activity towards the inhabitants of that State,
– when the parent company designates a subsidiary located in that Member State as its representative and controller for two specific filing systems which relate to the data of customers who have contracted for advertising with that undertaking,
– when the office or subsidiary established in a Member State forwards to the parent company, located outside the European Union, requests and requirements addressed to it both by data subjects and by the authorities with responsibility for ensuring observation of the right to data protection, even where such collaboration is engaged in voluntarily?
(b) Must Article 4(1)(c) of Directive 95/46 be interpreted as meaning that there is “use of equipment (…) situated on the territory of the said Member State”:
– when a search engine uses crawlers or robots to locate and index information contained in web pages located on servers in that Member State,
– when it uses a domain name pertaining to a Member State and arranges for searches and the results thereof to be based on the language of that Member State?
(c) Is it possible to regard as a use of equipment, in the terms of Article 4(1) (c) of Directive 95/46, the temporary storage of the information indexed by internet search engines? If the answer to that question is affirmative, can it be considered that that connecting factor is present when the undertaking refuses to disclose the place where it stores those indexes, invoking reasons of competition?
(d) Regardless of the answers to the foregoing questions and particularly in the event that the Court (…) considers that the connecting factors referred to in Article 4 of [Directive 95/46] are not present:
must Directive 95/46 (…) be applied, in the light of Article 8 of the [Charter], in the Member State where the centre of gravity of the conflict is located and more effective protection of the rights of … Union citizens is possible?
2. As regards the activity of search engines as providers of content in relation to Directive 95/46 (…):
(a) in relation to the activity of [Google Search], as a provider of content, consisting in locating information published or included on the net by third parties, indexing it automatically, storing it temporarily and finally making it available to internet users according to a particular order of preference, when that information contains personal data of third parties: must an activity like the one described be interpreted as falling within the concept of “processing of (…) data” used in Article 2(b) of Directive 95/46?
(b) If the answer to the foregoing question is affirmative, and once again in relation to an activity like the one described:
must Article 2(d) of Directive 95/46 be interpreted as meaning that the undertaking managing [Google Search] is to be regarded as the “controller” of the personal data contained in the web pages that it indexes?
(c) In the event that the answer to the foregoing question is affirmative:
may the [AEPD], protecting the rights embodied in [Article] 12(b) and [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, directly impose on [Google Search] a requirement that it withdraw from its indexes an item of information published by third parties, without addressing itself in advance or simultaneously to the owner of the web page on which that information is located?
(d) In the event that the answer to the foregoing question is affirmative:
would the obligation of search engines to protect those rights be excluded when the information that contains the personal data has been lawfully published by third parties and is kept on the web page from which it originates?
3. Regarding the scope of the right of erasure and/or the right to object, in relation to the “derecho al olvido” (the “right to be forgotten”), the following question is asked:
must it be considered that the rights to erasure and blocking of data, provided for in Article 12(b), and the right to object, provided for by [subparagraph (a) of the first paragraph of Article 14] of Directive 95/46, extend to enabling the data subject to address himself to search engines in order to prevent indexing of the information relating to him personally, published on third parties’ web pages, invoking his wish that such information should not be known to internet users when he considers that it might be prejudicial to him or he wishes it to be consigned to oblivion, even though the information in question has been lawfully published by third parties?’
With regard to question 2 (b), the Court states that, in order to achieve an effective protection of the right to data protection, a search engine operator must be considered a “controller” under article 2 (d) of Directive n. 95/46. The activity of a search engine is indeed liable to affect the fundamental right to data protection, since it renders such data accessible to any internet user. Thus, search engine operators are subjected to Directive n. 95/46 and must ensure that the requirements of the Directive are met in order to achieve full and effective protection of the data subjects.
Then the CJEU considers question 1 (a). The Court holds that, since Google Spain engages in effective and real exercise of activities through stable arrangements in Spain, it constitutes an “establishment” pursuant to article 4 (1) (a) of Directive n. 95/46. Notwithstanding, the same provision requires that the processing of personal data by the controller is ‘carried out in the context of the activities’ of an establishment of the controller. Such words, in light of the principle of effectiveness of the protection of the rights concerned, must be interpreted broadly, as made clear by recitals 18 and 20 of the Directive as well. Therefore, when a controller situated outside the EU has an establishment on the territory of a Member State which is in charge of selling advertising space offered by the search engine managed by the controller, the processing of data which occurs falls under Article 4 (1) (a) of Directive n. 95/46. Having resolved question 1 (a) the Court does not consider questions 1(b), (c) and (d).
The Court then examines questions 2 (c) and (d) on the extent of the responsibility of the controller and the obligations owed by it. The Court points out that the Directive must be interpreted according to rights conferred by Articles 7 and 8 of the CFREU. To ensure that those rights are effectively guaranteed, the controller must erase or rectify data which do not comply with the Directive requirements. However, since Article 7 (f) of Directive 95/46 allows the data processing when the controller pursues a legitimate interest – provided that it is not overridden by the interests and rights of the data subject – the administrative or judicial authority must carry out a balancing of interests. Following such balancing, the same authority may order the controller to remove from the results displayed on a search engine the links to the web pages concerning the data subject. Moreover, in order to ensure an effective protection of the data users, the order can be issued directly toward the controller (i.e. search engine operator) without having to first obtain the erasure of the information contested from the publisher.
With regard to the third and final question, the Court holds that even information initially processed lawfully may, over time, become no longer relevant or excessive with regard to the purpose they were initially published for. Therefore, such information and data can be erased as well.
Role of the Charter and role of the general principles on enforcement
Article 7 and 8 of the Charter are applied as guiding criteria in order to carry out a balancing process between the protection of fundamental rights of the data subject and a legitimate interest pursued by the controller. In particular, the Court states that, pursuant to Directive n. 95/46, personal data can be processed when there is a legitimate interest pursued by the controller: in order to balance such provision (Article 7 (f) of the Directive) with the protection of the right to protection of personal data, both the controller and the administrative/judicial authority must take into account Articles 7 and 8 of the Charter, which are then explicitly mentioned by the decision. The Court sets out a general rule stating that the right to data protection and privacy such as laid out by the Charter override the legitimate interest of internet users searching information through a search engine. Nevertheless, depending on the nature of the information, of the public interest to its disclosure and of its effect on the data subject’s private life, the balancing might lead to different outcomes.
In the decision there is not explicit reference to Article 47 of the Charter, although the Court, directly refers to the principle of effectiveness to assess the scope of the Directive n. 95/46. An indirect reference to the concept of effective judicial remedy as laid out in Article 47 can be recognized as the Court states that the data subject can file a complaint before an administrative or judicial authority directly against the controller, without having to first obtain the erasure of the contested data from the publisher. Indeed, since the publisher, as an establishment situated outside the EU, may not be subjected to EU legislation, the most effective remedy is for the judge to address the controller that, in this case, is the search engine operator, issuing an order to erase the contested data.
- Right to an effective remedy before a tribunal
No national provisions are examined and considered in the decision and the only national law source which is cited is the Spanish law transposing Directive n. 95/46.
Article 7 and 8 of the CFREU are regarded as relevant by the CJEU to the extent that they function as interpretation criteria in first place when assessing the obligation (owed by the data controller) to ensure the protection of the rights conferred by such articles; in second place when carrying out the balancing between the legitimate interests that can justify the processing of personal data and the fundamental rights to data protection and privacy.
Article 47 is not explicitly mentioned. Instead, the Court applies extensively the principle of effectiveness, making an indirect reference, when assessing the extent of the remedy at the disposal of the data subject, to the concept of effective judicial remedy.
The principle of effectiveness guides the CJEU when laying out its reasoning: in particular, it serves the purpose to assess the scope of Directive n. 95/46 and the remedies accessible to the data subject. In light of the principle of effectiveness, the Court upholds a broad interpretation of both the notion of controller pursuant to Article 2 (d) of the Directive and the notion of “data processing carried out in the context of the activities of an establishment of the controller on the territory of the Member State” pursuant to Article 4 (1) (a). Moreover, it is used as interpretation criterion by the Court when the decision points out that the data controller (or the administrative/judicial authority) must erase (or order to erase) data processed by a search engine not complying with Directive n. 95/46, without having to first obtain the erasure of such data from the publisher. The publisher might indeed be a website whose controller or manager refers to an establishment which is outside the EU and does not have a subsidiary in a Member State. Thus, it would not be subjected to EU legislation and the protection offered to data subject would no be effective. Instead, by placing the obligation directly on the search engine operator, as controller, the effectiveness of the protection is preserved.
Elements of judicial dialogue
- Direct dialogue between CJEU and National court (preliminary reference)
Conform interpretation with EU law as interpreted by the CJEU
The decision of the CJEU arises from a preliminary reference and is essentially aimed at offering an interpretation of some provisions of Directive n. 95/46 in light of the fundamental rights and principles protected by the Directive itself as well as by the CFREU.
To offer a comprehensive interpretation of the provisions of Directive n. 95/46 – especially with regard to its scope – complying with the Charter, so to avoid narrow interpretations by the national Courts.
It is expectable that national Courts, in light of this decision, will become more willing to engage in broad interpretations of Directive n. 95/46 with regard to both the material and territorial scope. In second place, national Courts will carry out a balancing of interests, in personal data cases, focusing on the significance of the rights conferred by Articles 7 and 8 of the CFREU.
Additional notes on the decision
In March 2012 a second proceeding before the Audiencia Nacional, dealing with circumstances similar to the decision here examined, was suspended on account of the preliminary reference operated by the same Court in the Google Spain v. M. C. G. proceeding. After the CJEU decision this second proceeding was decided as well. Such decision – ECLI: ES:AN:2015:567; Google Spain Sl v. AEPD –upheld the principles and criteria expressed by the CJEU, especially with regard to the relationship between Article 7 and 8 of the CFREU and the legitimate interest of the public to be informed as well as the freedom of information. The Spanish Court reassessed the importance of the balancing of interests and pointed out that, as the CJEU had highlighted, fundamental rights to data protection and privacy in principle prevail over the interests of the internet users, but, nevertheless, the judge must consider the nature and the relevance of information in order to decide whether or not ordering the erasure of the contested information. In particular, the national Court found that the indexing and storage on a search engine of data concerning candidatures for the municipal elections of 1999, though initially justified in light of the public interest to information pursued, was no longer relevant with regard to those same interests and thus such information had to be erased if so requested by the data subject, in light of the rights conferred by Articles 7 and 8 of the CFREU, as well as pursuant to Directive n. 95/46.
As far as other Member States are concerned, it is to mention that broad interpretation of the material and territorial scope of Directive n. 95/46 in light of the effectiveness of judicial protection, as well as the balancing of interests between the protection of fundamental rights of the data subject and the public interests at stake, has been upheld by the Milan Tribunal, in the decision n. 12623 of the 4th of January 2017, which stated that even the cache copies of personal data have to be erased at request of the data subject when there is no relevant public interest involved.