Google Spain v AEPD and Mario Costeja González
|Google Spain v AEPD and Mario Costeja González|
|Submitted 27 February 2012|
Decided 13 May 2014
|Full case name||Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González|
|Case Type||Reference for a preliminary ruling|
|Nationality of parties||Spanish|
|Procedural history||Reference of the Audiencia Nacional (Spain)|
|An Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. An individual may request hyperlinks to be removed from the search engine's index.|
|Interprets Directive 95/46/EC|
Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (2014) is a decision by the Court of Justice of the European Union (CJEU). It held that an Internet search engine operator is responsible for the processing that it carries out of personal information which appears on web pages published by third parties.
The outcome of the ruling is that an Internet search engine must consider requests from individuals to remove links to freely accessible web pages resulting from a search on their name. Grounds for removal include cases where the search result(s) "appear to be inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed.":92 If the search engine rejects the request, the individual may ask relevant authorities to consider the case. Under certain conditions, the search engine may be ordered to remove the links from search results.
The decision was claimed as a so-called right to be forgotten, although the Court did not explicitly grant such a right, depending instead on the data subject's rights deriving from Article 7 (respect for private and family life) and Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.
The General Data Protection Regulation was mooted to include a right to be forgotten, but between the draft and the final version this was changed to a right to request erasure for a set of specific reasons.
In 1998 the Spanish newspaper La Vanguardia published two announcements in its printed edition regarding the forced sale of properties arising from social security debts. The announcements were published on the order of the Spanish Ministry of Labour and Social Affairs and their purpose was to attract as many bidders as possible. A version of the edition was later made available on the web.
One of the properties described in the newspaper announcements belonged to Mario Costeja González, who was named in the announcements. In November 2009, Costeja contacted the newspaper to complain that when his name was entered in the Google search engine it led to the announcements. He asked that the data relating to him be removed, arguing that the forced sale had been concluded years before and was no longer relevant. The newspaper replied that erasing his data was not appropriate since the publication had been on the order of the Spanish Ministry of Labour and Social Affairs.
Costeja then contacted Google Spain in February 2010, asking that the links to the announcements be removed. Google Spain forwarded the request to Google Inc., whose registered office is in California, United States, taking the view that this was the responsible body. Costeja subsequently lodged a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) asking both that the newspaper be required to remove the data, and that Google Spain or Google Inc. be required to remove the links to the data. On 30 July 2010, the Director of AEPD rejected the complaint against the newspaper but upheld the complaint against Google Spain and Google Inc., calling on them to remove the links complained of and make access to the data impossible.
- Google Inc. was not within the scope of the EU Directive 95/46/EC (Data Protection Directive) and its subsidiary Google Spain was not responsible for the search engine
- there was no processing of personal data within the search function
- even were there processing, neither Google Inc. nor Google Spain could be regarded as a data controller
- in any event, the data subject (Costeja) did not have the right to erasure of lawfully published material
The Audiencia Nacional joined the actions and stayed the proceedings pending a preliminary ruling from the CJEU on a number of questions regarding the interpretation of the Data Protection Directive. These questions fell into three groups. In essence they concerned:
- the territorial scope of the Directive
- the legal position of an Internet search engine service provider under the Directive, especially in terms of the Directive's material scope and as to whether the search engine could be regarded as a data controller
- whether the Directive establishes a so-called right to be forgotten
All of these questions, also raising important points of fundamental rights protection, were new to the court. Because new points of law were involved, the opinion of an advocate general was sought by the court.
Written proceedings followed by an oral hearing were held on 26 February 2013, at which, besides the parties, the governments of Austria, Greece, Italy, Spain and Poland and the European Commission gave their opinion. Advocate General Niilo Jääskinen gave his opinion on 25 June 2013, after which judgment was given on 13 May 2014.
Advocate general's opinion
Advocate General Jääskinen made frequent reference in his opinion to the fact that the Data Protection Directive predates the Google era (it dates from 1995 and is due to be replaced in May 2018 by the General Data Protection Regulation). On the first set of questions, the advocate general found that Google's business model brought Google Inc. and Google Spain within the scope of the Directive.:64–68 On the second set of questions concerning the material scope of the Directive, the advocate general held that Google could not be regarded as a data controller: Google's search activities involve the processing of personal data, but Google does not thereby become a data controller for the content of the material when the processing is carried out in a haphazard, indiscriminate and random manner. In the advocate general's view the sense of the Directive was that "the controller is aware of the existence of a certain defined category of information amounting to personal data and the controller processes this data with some intention which relates to their processing as personal data".:B 76–83
In the event that the court did not agree with his finding that Google was not a data controller, the advocate general considered the third set of questions relating to a right to be forgotten. He held that the rights of freedom of information and expression took precedence over any such right to erasure, and urged the court not to allow case-by-case resolution of such conflicts as that would likely lead to the "automatic withdrawal of links to any objected contents or to an unmanageable number of requests handled by the most popular and important Internet search engine service providers.":133
The Court of Justice of the European Union ruled that an Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties, upholding a right of erasure.
The court considered the material scope of the Directive first. The court rejected Google's submission, supported by the Advocate General, that it could not be regarded as a data controller within the scope of the Data Protection Directive, adopting a literal interpretation of article 2(b), giving definitions and relying on Lindqvist.:21–41:25
Regarding the territorial scope of the Directive, the court observed that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an 'establishment' within the meaning of the directive.:48–49 The court rejected Google Inc.'s argument that it was not carrying out its data processing in Spain, holding that the promotion and selling of advertising space by its subsidiary Google Spain was sufficient to constitute processing within the meaning of the directive.:50–57 To have ruled otherwise would have been to undermine the effectiveness of the directive and the fundamental rights and freedoms of individuals that the directive seeks to ensure.:58 The court thus endorsed the Advocate General's view that Google Inc. and Google Spain should be treated as a single economic unit.:66–67
Concerning the obligations and duties of the operator of a search engine, the court held that in the present case Article 7(f) of the directive, relating to legitimacy of processing, requires a balancing of the opposing rights and interests of the data subject (González) and the data controller (Google), taking into account the data subject's rights deriving from articles 7 (respect for private and family life) and 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.:73–74 Article 14(a) of the Directive, relating to the data subject's rights, allows the data subject, at least in the cases covered by articles 7(e) and 7(f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation.:76 Article 12(b) of the directive, relating to the data subject's right of access to the data, allows the data subject to request erasure of the data. Such request may be made directly of the controller, who must then duly examine the merits of the request. If the request is not granted, the data subject may then direct the request to a supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.:77
Regarding the question relating to the so-called right to be forgotten, the court noted that Google Spain, Google Inc., the Greek, Austrian and Polish governments and the European Commission considered that this question should be answered in the negative.:90 The court held, however, that the processing of data which is "inadequate, irrelevant or excessive" (i.e. not merely inaccurate) might also be incompatible with the directive.:92 In such cases, where the data is incompatible with the provisions of article 6(1)(e) to (f) of the directive, relating to data quality, the information and links in the list of the results must be erased.:94 It is not necessary that the information is prejudicial to the data subject.:96
The ruling balances the right to privacy and data protection in European law with the legitimate interest of the public to access such information, and it does not mandate that information is instantly removed upon request. It distinguishes between public figures and private persons. The Court stressed that Internet search engines profile individuals in modern society in an ubiquitous manner, in a way that could not otherwise have been obtained formerly save only with the greatest difficulty.:80 The data subject's rights must therefore in general override "as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject's name", but that would not be the case if the role played by the data subject in public life is such "that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question".:97
Google subsequently published an online form which can be used by EU citizens or EFTA nationals to request the removal of links from its search results if the data linked is "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed". On 31 May 2014, the first day of the service, Google received over 12,000 requests from people asking the company to remove certain links about them from its search results.
On 19 June 2015, Google announced it would remove links to nonconsensual pornography ("revenge porn") on request. Commentators noted that this was not the same thing as implementing a "right to be forgotten" as the company already has policies in place dealing with sensitive personal data such as social security numbers and credit card numbers. However, the consumer advocacy group Consumer Watchdog subsequently called on Google to extend the right to be forgotten to US users, filing a complaint with the Federal Trade Commission.
- In a Guardian piece, Julia Powles remarks that the ruling provides an essential platform for public debate as the European Commission considers reform of the Directive in its upcoming General Data Protection Regulation.
- Guy Vassall-Adams of Matrix Chambers characterises the judgment as profoundly harmful to the operation of the Internet and a betrayal of Europe's legacy in protecting freedom of expression:
The court's reductionist approach is to require that all published information must have a specific public interest justification. This approach is profoundly erroneous and stems in large part from failing to keep in mind the private/public distinction. Most of what is published on the internet has no specific public interest justification and there is no specific public interest which could relate to most pieces of biographical information about an individual. Facebook is an extremely valuable resource for freedom of expression and information sharing, but most of the "personal data" published there be it banal or wacky would not avail itself of any specific public interest defence. The point is that it shouldn't have to; there is an inherent value in the free circulation of information and ideas which the court has completely overlooked.— Guy Vassall-Adams, Matrix Chambers
- German Professor Niko Härting wrote a summary of the worries about undervaluing the importance of freedom of information and communication, as well as the dangers of abuse of such a system, stemming from this decision;
"Privacy by default" will encourage politicians, celebrities and other public figures to put their lawyers on track when they find inconvenient information online. And as the use of a search engine like Google is essential for finding information, the elimination from the results of search engines will provide a convenient and essential tool to suppress information.
- A piece on TheUndisciplined.com drew attention to the fact that Google's classification as a "data controller" could be appropriate regarding Google's collection and use of aggregated and personal data for advertising and other commercial purposes, but that the information presented by an automated service in the form of results from a search engine might not be as easily designated as "controlled" or "processed" data;
[...]the problems which really result from the court's ruling stem from the designation of Google and other search engines as "data controllers", as this is setting the threshold for "processing" or "controlling" of information rather low. Without any active "processing" of the information, beyond simply how it interacts with the automatic systems behind the search engine, it is hard to see how companies such as Google should be expected to exercise quality control over such information. It is also very important to keep in mind that Google's formula for generating search results is a totally different topic from Google Adwords and Google's processing of actual personal data for advertising reasons. That sort of data processing is only used for targeted ads and the like, and it is not this "data controlling" about which we talk when we discuss search results from Google's search engine. Popular dissatisfaction with companies like Google who collect and benefit from the use of personal data and preferences might have led some to confuse Google's data gathering for advertising practices with the workings of the algorithms used to automatically generate search results.
- The Harvard Law Review (HLR) examines criticism that the court got it wrong. HLR says these critics are ignoring that the Court made a reasonable interpretation of the Directive's text and the privacy values it contains. Their failure to fully engage with these values and to acknowledge that the measure enjoys widespread support across the EU undermine their contribution to the policy debate.
Google published its advisory committee's report on how the ruling should be implemented on 5 February 2015. Their advisory committee includes Luciano Floridi, Professor of Philosophy and Ethics of Information at the University of Oxford, Frank La Rue, who served as UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, from August 2008 to August 2014, and Jimmy Wales, a founder of Wikipedia. The committee recommended that only national links, not global links, should be removed, and that publishers should be notified of the removals and have the right to challenge them.
On 7 February 2015, The Times reported that the chairwoman of the Article 29 Working Party, Isabelle Falque-Pierrotin, has warned Google that it faces legal action if it fails to heed its warnings over the way Google is policing the ruling. The working party wants Google to stop notifying publishers and to remove its links globally.
- Bodil Lindqvist v Åklagarkammaren i Jönköping (Lindqvist)
- Melvin v. Reid (US case law)
- Florida Star v. B. J. F. (US case law)
- Streisand effect – filing lawsuits to protect privacy may result in significant media attention
- LICRA v. Yahoo!
References and sources
- "EU court backs 'right to be forgotten' in Google case". BBC News. 13 May 2014.
- "Press release No 70/14 (Judgment in Case C-131/12)" (PDF). CJEU.
- David Streitfeld (13 May 2014). "European Court Lets Users Erase Records on Web". New York Times. Retrieved 14 August 2014.
- Julia Powles (15 May 2014). "What we can salvage from 'right to be forgotten' ruling". Wired.co.uk. Retrieved 16 May 2014.
- "Judgment of the Court in Case C‑131/12 (Costeja)". CJEU.
- Baldry, Tony; Hyams, Oliver. "The Right to Be Forgotten". 1 Essex Court.
- The announcements in question: "Subhasta d'Immobles". La Vanguardia. 19 January 1998. p. 23. (in Catalan), accessed 16 May 2014. Translation: "Property auctions....the two undivided halves of a house at 8 Montseny St., owned by Mario Costeja González and Alicia Vargas Cots....."
- "Factsheet on the "Right to be Forgotten" ruling (case C-131/12)" (PDF). European Commission.
- Vassall-Adams, Guy. "Case comment: Google Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos, Mario Costeja González". eutopialaw.com. Matrix Chambers.
- Toobin, Jeffrey. "The Solace of Oblivion". newyorker.com. The New Yorker.
- Frantziou, Eleni. "Further Developments in the Right to be Forgotten: The European Court of Justice's Judgment in Case C-131/12, Google Spain, SL, Google Inc v Agencia Espanola de Proteccion de Datos". hrlr.oxfordjournals.org. Human Rights Law Review.
- Jay, Rosemary. "EU Court of Justice Advocate-General Issues Opinion in Google Search Case". Hunton & Williams LLP. Archived from the original on 11 April 2015.
- "Press release No 77/13 (Advocate General's Opinion in Case C-131/12)" (PDF). CJEU.
- "Opinion of Advocate General Niilo Jääskinen delivered on 25 June 2013 – Case C‑131/12". CJEU.
- "EU Court of Justice Upholds Right to Erasure in Google Search Case". Hunton & Williams LLP.
- "Judgment of the Court in Case C-101/01 (Lindqvist)". CJEU.
- Google sets up 'right to be forgotten' form after EU ruling BBC News, 30 May 2014. Retrieved 30 May 2014.
- "Google to Give Effect to Right to Remove Personal Data from Search Results". Hunton & Williams LLP.
- Powell, Rose (31 May 2014). "Google receives 12,000 requests to be 'forgotten' on first day". Sydney Morning-Herald. Retrieved 31 May 2014.
- Golbeck, Jennifer. "Google to Remove Revenge Porn from Search Results". slate.com. Slate.
- Eng, James. "Consumer Watchdog: Google Should Extend 'Right To Be Forgotten' to U.S." nbcnews.com. NBC News.
- Powles, Julia (21 May 2014). "What did the media miss with the 'right to be forgotten' coverage?". The Guardian.
- Härting, Niko. "Can a Search Engine be "Private by Default"?". cr-online.de/. CROnline.
- McNamee, Shane. "Europe and The Right to Be Forgotten: A Memorable Victory for Privacy or Defeat for Free Speech?". TheUndisciplined.com.
- "Google Spain SL v. Agencia Española de Protección de Datos". harvardlawreview.org. Harvard Law Review.
- "Guidelines on the implementation of the Court of Justice of the European Union judgment on "Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González" C – 131/12" (PDF). ec.europa.eu. European Commission.
- "Implementing the "right to be forgotten": the Article 29 Working Party speaks up". http://blogs.lse.ac.uk. London School of Economics. External link in
- "The Advisory Committee to Google on the Right to be Forgotten (report)". Google.
- Floridi, Luciano. "Should You Have The Right To Be Forgotten on Google? Nationally, Yes. Globally, No". WorldPost. huffingtonpost.com.
- Dean, James. "Respect European law, Google warned". The Times. the times.co.uk.
- Wolf, Brittany (Winter 2014). "Free Speech versus Human Dignity: Comparative Perspectives on Internet Privacy" (PDF). Tulane Journal of International and Comparative Law. 23 (1): 251–282.
- Shoor, Emily Adams (2014). "Narrowing the Right to Be Forgotten: Why the European Union Needs to Amend the Proposed Data Protection Regulation". Brooklyn Journal of International Law. 39 (1): 487–519. SSRN 2410240.
- Google privacy law ‘means total rethink of basic freedoms’ The Independent, 31 May 2014.