The case involved the request of an individual to delete the information published in 2010 in the Spanish Official Gazette (BOE), which was indexed in the Google search engine. This information declared the loss of the condition of civil servant because of a criminal conviction. The applicant requested to Google Spain S.L. the removal of this information. The Spanish National Agency for Data Protection issued an administrative resolution ordering Google Inc. and Google Spain S.L. to eliminate the personal data requested.
The Spanish Supreme Court declared in the case at bar that Google Spain S.L. is not responsible for the treatment of the data and, therefore, the requests to supress the data should be send to Google Inc. (located in the U.S.) and not Google Spain S.L. (which is only an intermediate without responsibility). The substantive outcomes of the CJEU decision and the follows ups decisions of the National High Court remain untouched (the criteria to suppress the data and the proportionality test have not change). The only change is that the recipient against the individual has to send his/her request for suppression.
The Spanish Supreme Court argues that the CJEU in Google Spain only stated that Google Spain S.L. was a subsidiary of Google Inc. and this condition was enough for the territorial application of Directive 95/46/EC (having Google Inc. a permanent “establishment” in the territory of the EU). Google Spain S.L. was necessary for the purposes of triggering the scope of application of the Directive. However, for the Spanish Supreme Court, the CJEU decision made clear that the only responsible for the treatment of the personal data was Google Inc. Google Spain S.L. only was a commercial brand (or commercial establishment) of Google Inc. which was the only responsible in determining the objectives and methods of processing the personal data. Thus, for the Spanish Supreme Court, Google Spain S.L. cannot be considered “responsible” of the processing of personal data because it does not participate in the determination of the objectives, aims and methods for processing such data. This is only a responsibility of Google Inc.

The debate, both at the national level and before the CJEU, was whether the case falls within the scope of application of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data. The territorial application of the Directive and the concept of “processing personal data” were the key for the application of Directive 95/46/EC. The National High Court, through the preliminary reference, helped the CJEU in order to clarify these two relevant issues. After the CJEU declared that Directive 95/46/EC was applicable, the Charter also became relevant for solving the issue. The Directive was interpreted by the CJEU in light of articles 7 and 8 of the Charter, being the Charter determinant for the final outcome of the CJEU decision and, at the end, for national courts.

Following to the decision of the National High Court, however, the Spanish Supreme Court (Contentious-Administrative Chamber) has declared that Google Spain S.L. is not responsible for the treatment of the data and, therefore, the requests to supress the data should be send to Google Inc. (located in the U.S.) and not Google Spain S.L. (which is only an intermediate without responsibility). See, for instance, the Spanish Supreme Court judgment (Contentious-Administrative Chamber) nº 574/2016, of 14 March 2016, ECLI:ES:TS:2016:964. However, the substantive outcomes of the CJEU decision and the follows ups decisions of the National High Court remain untouched (the criteria to suppress the data and the proportionality test have not change). The only change is the recipient against the individual has to send his/her request for suppression. To the contrary, also recently the Spanish Supreme Court (Civil Chamber) has decided, when action for damages is launched, that Google Spain S.L. is responsible. See the Spanish Supreme Court judgment (Civil Chamber) nº 210/2016, 5 April 2016, ECLI:ES:TS:2016:1280. In short, depending on the course of action, the private individual will have to follow different paths: (1) in the case that the goal is to request the suppression of the data, the request has to be sent to the Spanish National Agency for Data Protection or to Google Inc. (not Google Spain S.L.), and (2) in the case of a civil action for damages, the action could be pursued directly against Google Spain S.L..

In this regard, another judicial line has been opened: claims for damages for the non-elimination of personal data by the search engines. For the first time, the Provincial Court of Barcelona has sanctioned Google Spain S.L. for damages (8.000 euros in favour of the applicant) because the search engine did not eliminate personal data when a decision issued by the Spanish National Agency of Data Protection ordered to proceed with that elimination (Provincial Court of Barcelona, 364/2014, judgment of 17 July). As a consequence of the recognition of the search engines as "controllers" and that they are in charge of balancing the rights in conflict case by case, the search engines are liable for damages in case of not complying with their duties. Recently, the Spanish Supreme Court has ratified the compensation for damages in this case (see the Spanish Supreme Court judgment (Civil Chamber) nº 210/2016, 5 April 2016, ECLI:ES:TS:2016:1280).