Google ordered by the CJEU to respect the right to be forgotten online

Through its judgment of May 13, 2014^[1], the Court of Justice of the European Union (“CJEU“) allows individuals to obtain directly from the operator of a search engine, such as Google, the removal, under certain conditions, of links to web pages that display personal data relating to them.

In 2010, Mr. Mario Costeja González, a Spanish national, lodged with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, the “AEPD”) a complaint against La Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain, in particular in Catalonia) and against Google Spain and Google Inc.

Mr. Costeja González contended that, when an internet user entered his name in the Google search engine, the list of results would display links to two pages of La Vanguardia’s newspaper, dated January and March 1998. These pages contained, in particular, an announcement for a real-estate auction organized as a result of attachment proceedings for the recovery of social security debts owed by Mr. Costeja González.

Mr. Costeja González requested that La Vanguardia be ordered either to remove or alter the pages in question so that the personal data relating to him would no longer appear.

Mr. Costeja González also requested that Google Spain or Google Inc. be ordered to remove from the list of results displayed when his name was entered into the search engine all the links to the web pages of La Vanguardia that included personal data relating to him.

Mr. Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.

In order to adjudicate the dispute between Mr. Costeja González on the one hand, and Google Spain and Google Inc. on the other hand, the Spanish court before which the case had been brought decided to stay the proceedings and to refer a series of questions to the CJEU for a preliminary ruling^[2].

The Spanish Court asked the CJEU to provide clarification on how Directive 95/46 of October 24, 1995 on the protection of individuals with regard to the processing of personal data should be interpreted in the context of these Internet technologies, which appeared after the publication of the Directive.

In its judgment of May 13, 2014, the CJEU responded to these questions and provided the following clarifications.

Article 12 b) of Directive 95/46 imposes on Member States the obligation to guarantee “every data subject the right to obtain from the controller [of his/her personal data] (…), as appropriate, the rectification, erasure or blocking of data, the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data.”

The CJEU first specified that the activity of a search engine like Google, which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to Internet users according to a particular order of preference, must be classified as “processing of personal data” within the meaning of Directive 95/46 when that information contains personal data. It also explained that the operator of such a search engine must be regarded as the “controller” in respect of that processing of the personal data, within the meaning of Directive 95/46.

Then, the CJEU pointed out that in order to comply with the rights laid down in Directive 95/46, in particular in Article 12 b° thereof, the operator of a search engine is, in certain circumstances, obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages published by third parties and containing information relating to that person.

The CJEU added that this obligation also applies in a situation where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when the publication of such information on those pages is, in itself, lawful.

Finally, in response to the question whether Directive 95/46 enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he/she wishes that the information displayed on those pages relating to him/her personally be “forgotten” after a certain time, the CJEU held that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with Directive 95/46, the links and information in the list of results must be erased.

In this respect, the CJEU noted that even an initially lawful processing of accurate data may, in the course of time, become incompatible with Directive 95/46 where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.

In such a case, the links to the web pages displaying such information must be erased from the list of results unless there are some particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the general public in having access to the information in question.

The CJEU specified that the data subject may make such a request without having to previously prove that the diffusion of such information is prejudicial to him/her.

Regarding the specific situation of Mr. Costeja González, the CJEU concluded that as this situation concerned the display, in the list of results that the internet user obtains by making a search by means of Google Search on the basis of the data subject’s name, of links to pages of the on-line archives of a daily newspaper that contain announcements mentioning the data subject’s name and relating to a real-estate auction connected with attachment proceedings for the recovery of social security debts, it should be held that, having regard to the sensitivity for the data subject’s private life of the information contained in those announcements and to the fact that its initial publication had taken place 16 years earlier, the data subject establishes a right that this information should no longer be linked to his name by means of such a list.

Accordingly, the CJEU held that insofar as in the case in point there did not appear to be particular reasons substantiating a preponderant interest of the public in having, in the context of such a search, access to that information, the data subject was entitled, pursuant to Directive 95/46, to request that those links be removed from the list of results.

[1] Case C-131/12 Google Spain SL, Google Inc. / Agencia Española de Protección de Datos, Mario Costeja González

[2] A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the CJEU about the interpretation of European Union law or the validity of a European Union act. The CJEU does not decide the dispute itself. It is for the national court or tribunal to adjudicate the case in accordance with the Court’s decision