The search engine is responsible as a data controller
With judgment of May 13th 2014 in case n. C-131/12 in the matter of Google Spain SL and Google Inc. against Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, Court of Justice of the European Union ruled upon request for a preliminary ruling under Article 267 TFEU.
The Court, pursuant to Articles 2, 4, 12 e 14 of Directive 95/46/EC, whereas the subject of matter is protection of individuals with regard to the processing of personal data contained on websites by search engines, material and territorial scope of the Directive, responsibility of the search engine within the extent of data subject’s right, holds the liability of search engine for the processing of personal information appearing on third parties web pages.
Short but strong: a 36-word article changed one man’s life
There is a newspaper named La Vanguardia Ediciones SL, based in Catalonia and with a large circulation all around Spain. It uses to allocate real estate announcements on part of its pages, the kind of forced sale and auctions too.
One day of 1998, on behalf of the Spanish Ministry of Labour and Social Affairs, La Vanguardia publishes the forced sale of a property arising from social security debts toward Spanish Royals. The house is described by details, photographs are added as well as the name of the owner-debtor. He is Mario Costeja Gonzalez and his name will be perpetually related to Google.
A fresh news right from 1998
Eleven years after the announcement was published, Mario Costeja Gonzalez is sitting at the desk in front of his PC and is web-surfing.
He decides to go Google and enter a query with his own name.
With great concern, he discovers that the prominent position among Google’s results is hold by a 36-words article from 1998 where it is said that Mario Costeja Gonzalez’s home is being repossessed to pay off debts. Immediately asking for clarifications, Mr Gonzalez ascertains that La Vanguardia has published online all its archive dating 2009 backwards, including old news and even the ones deleted from their website pages.
Once joined internet, La Vanguardia’s archive immediately becomes an information available for search engines to be crawled. And so, it went. Google’s spiders crawled, indexed and returned this short article from the depth of La Vanguardia.
Mr Gonzalez’s reaction goes public. He is seeking removal of the link. House is sold, debts are payed, and the story is over: for no reasons, he should meet public opinion as a debtor.
But La Vanguardia is unremovable: debts were towards the Royals and the order to publish was issued by the Ministry, too much of a legitimation to obey Mr Gonzalez. Google’s answer sounds like the newspaper’s one and Mr Gonzalez can’t help but ask judicial protection.
The Streisand Effect or the unintended consequence
What was once a unique link to a short and old news of a web archive, it is now a thousand articles theme of web and press media, the moment’s most debated argument among search engine academics, it reaches countries and rise interests that otherwise would never be attracted by Gonzalez’s story.
What once was pleaded to be forgotten turns out to be unforgettable and for once in a lifetime Mr Gonzalez has in common with Barbra Streisand, whose request to take offline the photos of her Malibu house made the effect to publicize it even more.
From Audiencia Nacional to EU Court of Justice
After inquiry submitted to Spanish Agency of data protection by Mario Costeja Gonzalez, on 30 July 2010 Google Inc and Google Spain are called on to remove link to claimant’s personal information and to make access to related data impossible.
Google appeals the verdict before Audiencia Nacional, the National High Court of Spain. The Audiencia Nacional suspends the trial submitting the case to EU Court of Justice, for subsequent issues to be ruled.
After written proceedings and oral hearing where opinions were given by Austria, Greece, Italy, Spain, Poland and the EU Advocate General, Eu Court of Justice on 13 May 2014 issued decision.
Questions of parties
Depending on Mario Costeja Gonzalez’s claim, the Spanish Audiencia Nacional addresses EU Court of Justice three issues related to application of EU Directive transposed into Spanish organic law n. 15/1999 on the protection of personal data.
First, whether a US based undertaking like Google with worldwide business can be subjected to EU law; second, whether Google can be considered liable for personal data during crawling, indexing and storing processes as a data controller; third, whether a search engine can be ordered to remove one result upon individual’s request.
Google arguments that while Google Inc cannot be subjected to EU Data Protection Directive (95/46/EC), its subsidiary Google Spain is not liable as well.
In fact, defendant claims that search function of the search engine does not imply processing of personal data and, in the alternative, search engine cannot be regarded as a data controller. In addition, the individual has no right to ask for erasure of lawfully published material.
Advocate General pointing out the role of search engine
Since the matter raises points of fundamental rights protection, the opinion of an Advocate General is sought by the Court. He finds that both Google Inc and Google Spain are within the scope of EU Data Protection Directive that predated the case but, nevertheless, search engine cannot be regarded as a data controller because the processing data is carried out in a mechanical and random manner.
That can be argued under the provisions of EU Data Protection Directive assuming that data controller must be conscious of processing personal information.
As to issue related to the right to be forgotten, Advocate General holds that right of freedom of information and expression overtake any right to erasure.
The EU Court of Justice upholds the “right to be forgotten”
Eu Court of Justice was called to pronounce about three questions, related at most to territorial scope of the EU Data Protection Directive and the right to be forgotten.
The first question is regarding the role of a search engine into the enforcement of Data Protection law and whether it could be regarded as a data collector within the scope of the Directive.
The second question is about the so-called right to be forgotten, or the right to ask search engine for erasure of resulting personal information.
The Eu Court of Justice's judgement rules that Google, and a search engine in general, is responsible for processing personal data from web pages published by third parties, and upholds the individual’s right to request erasure considering that purpose of Directive is ensuring fundamental rights and freedom of individuals.
Relevant provisions of Data Protection Directive 95/46
All the questions are evaluated under provisions of Directive 95/46 by which fundamental rights and freedom of natural person are protected, and in particular their right to privacy with respect to the processing of personal data (Article 1) recognized by European Convention for the Protection of Human Rights and by general principles of Community law.
The overall scope of the Directive is that Member State’s national law governs the responsibility of an established data controller carrying out processing of data inside that State and, if a data controller is established on several Member States by means of subsidiaries, he is subjected to each Member State’s national law.
Directive’s material scope tends to ensure protections balancing obligations imposed on data controller for security, government notification or quality of data, and rights conferred on individuals to be informed, consulted, entitled to object, and ask for correction.
Legal framework
This is the legal framework of EU Court decision, where, in particular, Article 2 of Directive contains definition of personal data, of processing, and of controller; Article 3 outlines the scopes of the Directive, that shall apply to the processing of data wholly or partly by automatic means which form part or are intended to of a filing system; Article 4 provides relationship between Member States national laws and EU Directive on the subject matter with regard to establishment of the data controller; Article 6 provides principles relating to the quality of data processing that must be at least relevant, aimed, adequate and not excessive; Article 7 set the boundaries of processing, that can be carried out only if not in contrast with fundamental rights and freedoms of data subject; Article 9 is about freedom of expression; Articles 12 and 14 entitle data subjects to access and object to the processing of data and Article 28 is related to Authorities for the application within each Member State of the provisions adopted by national laws pursuant to the EU Directive.
Google as a data controller
The Court rules that Google should be regarded as a data controller within the material scope of the Directive while, under its territorial scope, the Directive’s scope includes all the undertakings established within Europe and Google Spain, subsidiary of Google Inc, should be considered an establishment.
As for the role of data controller, EU Court of Justice finds that promotion and selling of advertising space constitute processing data under provision of the Directive.
The Court takes into account Charter of Fundamental Rights of the European Union Articles 7 relating to respect for private and family life and Article 8 relating to protection of personal data, in order to assess and balance individual’s rights and data controller’s interests.
Under Data Protection Directive Article 12 and 14, the Court finds that an individual as data subject is allowed on compelling legitimate grounds to object the processing of data related to him and to request erasure of the data.
Furthermore, the Court holds that a right to be forgotten should be recognized whenever the processing of data is “inadequate, irrelevant or excessive” and therefore incompatible with the provisions of the Directive relating to data quality. In such cases, the data controller can be compelled to erase the information and its related links from results, although the information is not prejudicial to the data subject.
Public interest as EU’s judgement leading motive
The judgment issued by the Court outlines that a search engine must consider requests to remove links to web pages containing the applicant’s name, any time the search result should appear to be “inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed” and, in case of search engine’s denial, the individual is allowed to ask Data Protection authorities to mandate the order.
Even if not explicitly granted, the decision acknowledges the existence of a right to be forgotten. Soon after the judgement, Google provided EU users with an online form to request the removal of links from its search results if the conditions of inadequacy, irrelevance, no longer relevance and excess in relation to purpose of processing are met.
Criticism has focused on the fact that Eu justice puts Data Protection under the lens of public interest requested for information to be published while personal information and data usually available thorough social media and other platforms are private.
Further points were discussed upon Google’s classification as a data controller, evaluated appropriate when Google uses personal data for advertising and other commercial purposes but not when processing data through automated service in form of results.
Development of the case
After the Court ruled, Mr Gonzalez asks Spanish authority for data protection to erase a link resulting after entering the query about him, with information over his judicial case.
The Spanish Court rejects the application because information to be deleted are still relevant for public interest.
Chinese courts ruled about the right to be forgotten for the first time in 2016, stating against the citizen’s right in favor of the search engine Baidu.