One May Not Retain Personal Data Forever: The Judgment in Google Spain
The Court of Justice of the European Union recently held in Google Spain that an individual may, in some cases, request that Google take down personal information from its search results.
The dispute in the main proceedings concerned a decision by the Spanish Data Protection Agency, ordering Google to remove personal data relating to Mr Costeja González from its search results. These concerned an announcement of a real-estate auction connected with the recovery of social security debts, which had appeared on a Spanish newspaper’s website upon order of the Ministry of Labour and Social Affairs to attract as many bidders as possible. The announcement was made in 1998, and the attachment proceedings had been fully resolved.
Having established that Directive 95/46 on the protection of individuals with regard to the processing of personal data applies to search engines (paras. 21-41), the Court ruled that the processing of personal data at issue in the main proceedings fell within its territorial scope, even though Google Inc. has its seat in the United States. Relying on the wording of the Directive and on its objective of ‘ensuring effective and complete protection of the fundamental rights and freedoms of natural persons’, the Court ruled that the establishment of a Spanish subsidiary (Google Spain) with the purpose of selling advertising space on Google to Spanish clients sufficed to bring the processing within the territorial scope of the Directive (paras. 45-60).
In the absence of any other legitimate ground for the processing of these data, Google had to establish that it was ‘necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests [or] fundamental rights and freedoms of the data subject’ (Article 7(f) Directive). In this connection, the Court noted that the processing of personal data by a search engine ‘is liable to affect significantly the fundamental rights to privacy and to the protection of personal data’ (Articles 7 and 8 of the Charter of Fundamental Rights of the European Union), in that it ‘enables any internet user to obtain … a structured overview of the information relating to that individual that can be found on the internet … and … to establish a more or less detailed profile of him’ (para. 80). It was held that, due to the potential seriousness of that interference, it could not be justified by economic interests (para. 81).
Moreover, a ‘fair balance’ should be sought between the legitimate interest of internet users in having access to that information, and the fundamental rights of the data subject (para. 81). Whilst the data subject’s rights would override, ‘as a general rule’, the interest of internet users, that balance may depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information. This interest could vary according to the role played by the data subject in public life (para. 81). Interpreting the data subject’s rights in light of the fundamental rights to privacy and to the protection of personal data, the Court held that he or she ‘may … request that the information in question no longer be made available to the general public by its inclusion in such a list of results’ (para. 97).
Two points are of particular importance. First, the territorial scope of EU data protection legislation has been ruled to be particularly broad. This development is to be welcomed from a data protection perspective. Second, similarly to the data retention case, the Court appears very protective of the right to respect for private life and the right to the protection of personal data. The impugned data had been lawfully processed by the newspaper and were, above all, true. However, an individual may still, in some cases, request that such information be ‘consigned to oblivion’, without having to establish that such processing ‘causes prejudice’ to him or her (para. 96) or to first request that the original website take it down (paras. 82-88). This seminal judgment marks another step towards the creation of a fully-fledged EU Charter jurisprudence.