CJEU endorsement of the “right to be forgotten” in the EU

Paul David (via Flickr)

Yesterday, May 13, 2014, the
CJEU has issued a ruling in the matter C-131 / 12 that faced Google against the Spanish Data Protection Agency.

On March 5, 2010, Mr.
Costeja González filed a claim against Vanguardia Ediciones SL and
against Google Spain, SL and Google Inc. before the AEPD. In the claim
requested that La Vanguardia be required to modify or eliminate those
pages, so that your personal data does not appear, or that it uses
the tools provided by search engines to protect those
data. In turn, Mr. Costeja González requested that Google be required
Spain or Google Inc. to hide or delete your personal data, so that
would not be included in the search results and would no longer be linked to the
La Vanguardia links. All of these requests were based on the fact that the embargo
to which Mr. Costeja González was subjected at the time was totally
solved and resolved for several years and was currently of no interest
some.

On July 30, 2010, the AEPD
dismissed the claim against the publisher and upheld the claim made
against Google Spain, SL and Google Inc., urging them to remove the data from their
index and make future access to them impossible. In view of the
results, Google Spain, SL and Google Inc. filed appeals before the
National Court to request the annulment of the AEPD resolution.

In this context, the Hearing
Nacional suspended the procedure and brought before the Court of Justice of the
European Union (CJEU) a series of preliminary questions:

Firstly, the CJEU qualifies
as “processing of personal data” the activity of search engines
consisting of “finding information published or put on the Internet by third parties,
index it automatically, store it temporarily and, finally,
make it available to Internet users according to an order of preference
determined”, thus making the manager responsible for this treatment.
of the search engine, which will guarantee the satisfaction of the
demands of the Directive 95/46, as well as the full and effective protection of
the rights of the interested parties.

With regard to the
territorial application, the CJEU rejects the argument put forward by Google of
that Google Search does not process personal data in the
activity carried out in Spain. The CJEU grants the status of
establishment, in the terms established by the Directive, to Google Spain,
SL, as it is the subsidiary of Google Inc. in Spain. When a company that is
located in a third state, has an establishment in a member state and
carry out processing of personal data to allow the operation of
your search engine in the establishment of the member state, the Directive
considers that this treatment is carried out 
“in the framework of the activities” of the establishment of the member state,
provided that your objective is to sell or promote your goods or services in that
state.

Regarding the scope
of the search engine responsibility as content providers in
In relation to the Directive, the CJEU establishes that the manager of a motor
search is required to remove from the results list generated after
perform a search based on a person's name, links to
web pages published by third parties that contain information related to this
person. Likewise, the CJEU adds that this obligation also exists in the case
in which that name or information is not previously or simultaneously deleted from those
web pages, even if the publication is lawful. The CJEU reasons that a vision
structure of information relating to that person potentially affects
Your private life.

In turn, the CJEU determines the
need to consider, on the one hand, the right of access to information
user, and on the other, the right to the protection of personal data
personal of the affected person. This balance depends on the nature of the
information in question and the social function performed by the affected person.

Finally, the CJEU establishes the
possibility that after some time, the affected person, in exercise of the right to
I forget, request deletion of the obtained results list. Whether
checks that the list is currently incompatible with the Directive, the
Information and links contained therein should be removed. They will be
all this data is incompatible when it is revealed to be inadequate, not relevant or
no longer relevant or excessive in relation to the purposes for which they were
treated and the time elapsed.