The ECJ today handed down a case in a landmark decision regarding data protection and the Internet (Case C-131/12 Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González).
The case concerns the EU Data Protection Directive (DPD) which establishes a system which controls the way in which data processing in the EU is carried out, giving the data subjects certain rights to correct data and to object to it. As well as issues as to the meaning of these rights, this case raises important questions about the scope of the directive – in terms of geography (its impact on non-EU resident processors) and in terms of the activities caught by it (what is processing and who is a ‘controller’). It has repercussions in terms of the applicability of EU law even to non-EU-based companies and the rights that individuals have against those processing their data – and it is clear now that this is not just first publishers of material but those who republish – including search engines.
The facts of the case are simple. A newspaper published a notice of auction in respect of the property of Mario Costeja González for unpaid debts. He subsequently paid the debts and the property was not auctioned. Some ten years later Google searches on his name bring up the newspaper advertisement. The Spanish courts had not agreed that the newspaper archive should be amended as the advertisement and so he brought an action to require Google to suppress these results. While AEPD agreed, Google appealed to the Audiencia Nacional (National High Court) which referred questions on the meaning of the DPD to the ECJ.
The ECJ first considered whether Google’s activities fell within the scope of the DPD. Google had argued that search engines do not distinguish between data protected by the DPD (personal data) and other data, and that furthermore it had no control over the data or the selection of the data. It therefore argued that it did not ‘determine […] the purposes and means of the processing of personal data’ as required by the terms of the DPD. The ECJ rejected these arguments. Firstly it was not contested that the data included ‘personal data’ which was processed: the fact that there was non-personal data in the search engine operations too seems irrelevant, as is the fact that the search engine results are of material that has already been published and is unaltered by the search engine, even where that publication was by the media. So, ‘a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results’ (paras 28-29). The ECJ emphasised that a broad definition must be given to ‘controller’ to ensure complete protection for data subjects. In assessing this, the ECJ looked not only to what Google does in terms of the organisation of the search engine but also the impact of the search engine on linking individuals to results. The ECJ concluded that:
as the activity of a search engine is therefore liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (para 38).
As regards territorial application, two possibilities arose. The first was that Google’s activities fell within Article 4(1)(a) which applies the DPD to those with an ‘establishment’ in a Member State. The second relates to Article 4(1)(c) which concerns the ‘use of equipment situated on the territory of the said Member State’. The Advocate General focussed on the first aspect, suggesting that although the processing is carried out by Google in the USA, it still had an establishment in Spain which although not processing data constituted an important element in Google’s business model by selling advertising thereby satisfying the requirement that the processing be ‘carried out in the context of the activities’ of the EU establishment. The ECJ seems broadly to have agreed, again emphasising the purpose of the DPD and the need to protect privacy (paras 53-54). The ECJ concluded:
the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed (para 56).
The ECJ then turned to whether Mr Costeja González had the right to ask for the information to be removed from the search results. The ECJ noted that – subject to limited exceptions – all data processing must comply with data quality principles found in Article 6 DPD; and with one of the legitimacy criteria in Article 7 DPD. Article 7 permits the processing of personal data where it is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject. By reasoning thus, the ECJ made the exercise one of balance, but bearing in mind the status of the individual’s rights as fundamental rights (para 74). The ECJ once again highlighted the reach and impact of the Internet and of search engines in structuring information, to hold that:
‘[i]n the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life’ (para 81).
The ECJ added that given the structuring function of a search engine, it may have more impact than first publication on a web page. On this basis, a search engine operator may be required to remove information. The ECJ took a similar approach with regard to the rights set out in Articles 12(b) and 14(a) DPD, which concerned the right to be forgotten. It held that:
‘having regard to the sensitivity for the data subject’s private life of the information … and to the fact that its initial publication had taken place 16 years earlier, the data subject establishes a right that that information should no longer be linked to his name by means of such a list’(para 98).
This finding is, however, subject to the public interest in having access to the information. While it seems unlikely that there is any such interest in this case, that is a matter for the referring court to determine.
In sum, this is a resounding win for Mr Costeja González and the Spanish data protection authorities.
Professor Lorna Woods is the Director of the LLM in Internet Law at the University of Essex.
This post originally appeared on the Law, Justice and Journalism website and is reproduced with permission and thanks
Leave a Reply