Spain, Audiencia Nacional (National High Court), ROJ 2433/2017, ordinary, 11 May 2017

Deciding bodies and decisions
Spain, Audiencia Nacional (National High Court), ROJ 2433/2017, ordinary, 11 May 2017
Area of law
Data protection - right to beforgotten
Summary Facts Of The Case

In 1998, La Vanguardia newspaper of Spain published two articles concerning an attachment and garnishment action against Costeja González. In 2009, he contacted the newspaper, asserting that when his name was entered in, there was still a reference to the pages of the newspaper concerning the legal action. González argued that the information should be removed because the proceedings were concluded years earlier and that there was no outstanding claim against him. The newspaper, however, denied his demand, claiming that the legal action was published pursuant to an order by Spain’s Ministry of Labor and Social Affairs. Then in 2010, he contacted Google Spain, arguing that the online search results of his name should not make reference to the newspaper’s publication of his legal proceedings. Upon Google’s failure to comply, González brought a complaint before Spain’s Data Protection Agency against the newspaper, Google Spain, and Google Inc. The Agency dismissed the action against the newspaper, reasoning that the publication was made pursuant to a government order. But it upheld the complaint against Google and its subsidiary, Google Spain. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future. Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the Court of Justice.

The National High Court of Spain presented the following questions to the European Court of Justice for a preliminary ruling: (1) Whether the EU Directive 95/46 as implemented through the national legislation of a member State can be applied to a foreign Internet search engine company that has a branch or subsidiary with the intent to promote and sell advertising space geared towards the inhabitants of that member State; (2) Whether the Internet search engines’ act of locating information published by third parties, and later indexing and making the information available to Internet users can be considered as “processing of personal data” within the meaning of the Directive; (3) Whether the operator of a search engine must be regarded as a “controller” with respect to the processing of personal data under Article 2(d) of the Directive; (4) Whether on the basis of legitimate grounds to protect the right to privacy and other fundamental rights envisioned by the Directive, operators of Internet search engines are obligated to remove or erase personal information published by third party websites, even when the initial dissemination of such information was lawful. Article 1 of Directive 95/46 obligated EU States to protect “the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.” At the same time, it prohibits restrictions on the free flow of personal data between the EU members. The Directive defined personal data as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.” The act of processing such information includes “any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.” Under Article 2(d), a “controller” of personal data is any “natural or legal person, public authority, agency or any other body, which alone or jointly with others determines the purposes and means of the processing of personal data.”

The National High Court had to decide on 230 cases regarding claims of individuals against Google Inc. and Google Spain S.L. for not erasing personal data which was accessible to the public through its search engine. The National High Court selected one of those cases and asked the CJEU about the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Article 7 and 8 of the Charter.

The case selected by the National High Court involved the request of an individual to delete the information published in 1998 in the newspaper La Vanguardia in which his name appeared for a real-estate auction connected with proceedings for the recovery of social security debts. At the same time, this information of the newspaper was available to the public in the internet through the search engine of Google Inc. and Google Spain S.L.. The Spanish National Agency for Data Protection issued an administrative resolution ordering Google Inc. and Google Spain S.L. to eliminate the personal data requested and excluding the newspaper's liability.

The decision of the CJEU in Google Spain has attracted wide attention. Three findings of the decision of the CJEU should be highlighted. First, the CJEU interpreted Articles 2(b) and 2(d) of Directive 95/46/EC and concluded that: the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d). Second, the activity of ‘processing of personal data’ should be considered to be carried out in the territory of a Member State, in this case, in Spain. Third, a case by case analysis of the rights and interests in conflict is warranted: on the one hand, the rights of Article 7 and 8 of the Charter, and on the other the right of the public to access information. This analysis should be performed case by case, taking into account the nature of the personal data in question and the interests of the public in having access to this information.

The National High Court, following the decision of the CJEU in Google Spain, first established a general approach to all cases and, after that, resolved the particular case at bar. In relation to the general approach, the National High Court stated: (1) the individual (data subject) seeking to eliminate personal data must file a complaint before the "controller" of the information or the Spanish National Agency for Data Protection, showing the links and results connected to this personal data, as well as the nature and content of this personal data; (2) in the context of this complaint, the "controller" or the Spanish National Agency for Data Protection must balance the rights in conflict -right to personal data and right to access to information-, taking into account the specific situation of the individual (case by case analysis of the rights in conflict); (3) the elimination of the data will be justified, inter alia, in light of the nature of the information, the sensitivity to the private life to the individual, the irrelevance of the data for the aims alleged for the processing, or the time elapsed.

The National High Court applied this general approach to the case at bar and annulled the decision of the Spanish National Agency for Data Protection. In this case, the National High Court understood that the right to access to information prevails over the right to personal data. The applicant was a surgeon widely known in the scientific arena. He had a public profile and his services were advertised in the website. The opinions of the internet forum of 2008 were related to his professional background and performance and not to his personal life. Finally, the opinions were expressed in a critical way, but not through insults or degrading terms. For all these reasons, the information was sensitive and of public interest and should remain accessible to the public.
Relation to the scope of the Charter

The debate, both at the national level and before the CJEU, was whether the case fell within the scope of application of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data. The territorial application of the Directive and the concept of “processing personal data” were the key for the application of Directive 95/46/EC. The National High Court, through the preliminary reference, helped the CJEU in order to clarify these two relevant issues. After the CJEU declared that Directive 95/46/EC was applicable, the Charter also became relevant for solving the issue. The Directive was interpreted by the CJEU in light of articles 7 and 8 of the Charter, being the Charter determinant for the final outcome of the CJEU decision and, at the end, for the National High Court.

Relation between the Charter and EHCR

There were a potential link between articles 7 and 8 of the Charter and article 8 of the ECHR and the ECrtHR case law developing it. However, nor the National High Court or the CJEU in Google Spain refers to the ECHR and the case law of the ECtHR.

Impact on Jurisprudence

After the decision of the CJEU in Google Spain and its implementation by the National High Court in the first 18 cases, Google Spain S.L. and Google Inc. decided to withdraw from 130 judicial cases. Google Spain S.L. and Google Inc. decided to maintain active approximately 80 cases. The alliance of the CJEU and the National High Court has resulted in the voluntary reduction of cases: it has had a clear deterrence effect, reinforcing the National High Court position. The decisions of the National High Court in the other pending cases vary in light of the result of the balancing test. In some of them the result is in favour of the right to personal data, in others the right to access to information is predominant. There are also cases in which the National High Court declares that the applicant has not identified accurately the information qualified as personal data and, therefore, the balancing test cannot be performed. However, all the decisions apply consistently the general approach established by the National High Court following the decision of the CJEU.

Sources - CJEU Case Law
Judgement of the Court (Grand Chamber), 13 May 2014, Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, C-131/12 (Google Spain)

Relevant Judicial Dialogue Techniques

Project implemented with financial support of the Fundamental Rights & Citizenship Programme of the European Union
© European University Institute 2019
Villa Schifanoia - Via Boccaccio 121, I-50133 Firenze - Italy