Under the Law on Data Protection, individuals have the right to access, rectify, cancel, and oppose personal data in search engine indexes and digital archives, under certain circumstances. A claim by a Spanish national against Google based on these rights ended up before the European Court of Justice, which in its 2014 landmark decision favored privacy rights by recognizing the right of individuals to request that search engines remove links to their personal data when the linked information does not meet the standards of appropriateness and relevance, is outdated, has become irrelevant, or lacks any public interest.
I. Domestic Law
In Spain the right to protection of personal data has been recognized under the Law on Data Protection (LOPD) and Royal Decree 1720/2007, which regulates application of the Law (RDLOPD). The Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency) is the enforcement authority on data protection.
Under this legal regime, individuals have the right to access, rectify, cancel, and oppose personal data in search engine indexes and digital archives, under certain circumstances. These rights are known as the “ARCO” rights (for acceso, rectificacióon, cancelación y oposición [access, rectification, cancellation, and opposition]). They include the right to know what personal data is contained in a file, the right to amend incorrect or incomplete data in a file, the right to suppress and block incorrect data in a file, and the right to object to the processing of personal data within a file. These are personal rights and may only be exercised by the affected person or his or her legal representative. File managers may not charge fees in order to process claims involving the exercise of these rights.
II. Right of Cancellation
The right of cancellation gives individuals the right to cancel inappropriate or excessive personal data that is held in an entity’s file. The exercise of this right may only be carried out by the person concerned, who should address the firm or public entity holding the data, identifying the specifics of the data in question and the justification for its removal.
The entity responsible for the file must render a decision on the cancellation petition within ten days after receipt of the request. If a decision is not rendered by the deadline or is unsatisfactory, the petitioner may seek protection before the AEPD.
If granted, the cancellation order will mandate the removal of the data, which will still be retained by public administrations, judges, and courts when required by law or contractual obligations.
III. Right of Opposition
Individuals may exercise the right to oppose the use of personal data when the interested party’s consent for its processing is not required and the request is based on a legitimate and well-founded reason related to the personal situation of the affected individual, unless the law requires otherwise; when the files are aimed at advertising or commercial purposes; or when the use of personal data aims at adopting a decision involving the affected individual based solely on an automated treatment of the personal data.
The right of opposition may only be exercised by the affected individual through a request directed to the entity or person responsible for the data treatment, stating the legitimate grounds justifying the opposition. The entity responsible for the file’s management must reach a decision within ten days after receipt of the request, and either exclude the personal data as requested or deny the petition on reasoned grounds. If the petition is not decided within the deadline or if the entity holding the file that contains the personal data denies the right to opposition, the petitioner may seek redress before the AEDP upon submitting evidence that the file’s holder has denied the opposition petition.
IV. The Right to Be Forgotten
According to the AEDP,
[t]he so-called “right to be forgotten” is an expression derived from the rights of cancellation and opposition regulated under the LOPD as applied to internet browsers. The right to be forgotten encompasses the right to prevent the dissemination of personal information through the internet when its publication does not meet the standards of appropriateness and relevance, when the information is already outdated or became irrelevant or lacks any public interest, even if the original publication is legitimate and protected by the freedoms of expression and information, such as the information available in official gazettes.
In this regard, the LOPD provides that personal data may be canceled when it has stopped being necessary or pertinent for the purpose for which it was originally collected or recorded. Personal data will not be kept beyond the time period needed to fulfill its purpose. In exceptional circumstances it may be maintained for historical, scientific, or statistical purposes.
V. Google v. Spain
Based on the LOPD rights of cancellation and opposition, Spanish national Mario Costeja González filed a complaint before the AEDP in 2010 against La Vanguardia, a Spanish newspaper, and Google Spain for 1998 auction legal notices that cited Costeja González. The legal notices were required by the Ministerio de Trabajo y Asuntos Sociales (Ministry of Labor and Social Matters) in reference to auctions of real estate seized to secure social security contributions owed by Costeja González. Costeja González argued that links to the auction notices were no longer necessary because the seizure proceeding involving his social security debt had been settled more than ten years ago and therefore its mention was entirely irrelevant. He requested that La Vanguardia remove the pages or change them so that his personal information was no longer shown. He also requested that Google remove links to the 1998 auction notices in order to remove them from Google Search results.
The AEDP dismissed Costeja González’s claim against La Vanguardia, but granted the claims against Google. Google then filed an appeal before the Audiencia Nacional (Spain’s highest court), which in turn referred the case to the European Court of Justice (ECJ).
In a decision rendered on May 13, 2014, the ECJ determined that search engines engage in the processing of data because they navigate the internet in an automatic, continuous, and systematic manner searching for information. The decision further established that since Google, a US-based company, had a Spanish subsidiary, it was subject to EU law because it operated as an establishment in Spain and carried out its commercial transactions there through advertising space accessible in its search engine. Based on EU legislation and specifically EU Directive 95/46 on Data Protection, the ECJ ruled that Google had an obligation to remove links to pages displayed by third parties, in this case La Vanguardia newspaper, when they became inadequate, irrelevant, or excessive in relation to the purposes for which they were collected by the mere fact of the passage of time, even if the content published by the third parties was lawful. The ECJ also recognized the right of individuals to request that search engines remove links to personal data. It concluded that there was not a preponderant public interest in access to the links offered by the search engine related to auction notices for a debt that was settled sixteen years before that outweighed Costeja González’s privacy interests. Therefore, the court granted the plaintiff the right to demand that the search engine erase all search result links to his name and the 1998 auction legal notices.
The decision also established that the right to be forgotten is not without limitations. The balance between the privacy rights of the individual affected and the legitimate interest of the search engine may depend on the type of information involved, such as the sensitivity for the privacy of the individual in question, the public interest in access the information, and the status of the individual in the public sphere.
VI. Current Status on the Right to Be Forgotten
Since the Costeja González decision, anyone in Spain who wants search results related to personal data removed must make a direct claim to the search engine in question, which must then decide on a case-by-case basis whether there are justified grounds for the request. This is the case if the individual’s right of privacy takes precedence over the public interest to access such information. If the petition is denied, the petitioner may seek redress through the courts.
As a consequence of the ECJ decision, search engines such as Google, Yahoo, and others now offer users a special form to request the removal of links according to data protection standards.
Prepared by Graciela Rodriguez-Ferrand
Senior Foreign Law Specialist
 Ley Orgánica 15/1999, de Protección de Datos de Carácter Personal [Law on Personal Data Protection (LOPD)], Boletín Oficial del Estado [B.O.E.] Dec. 14, 1999, http://www.agpd.es/portalwebAGPD/canaldocumentacion/ legislacion/estatal/common/pdfs/2014/Ley_Organica_15-1999_de_13_de_diciembre_de_Proteccion_de_Datos_ Consolidado.pdf, archived at https://perma.cc/N3MM-XMLE.
 Real Decreto 1720/2007, de 21 de diciembre, por el que se aprueba el Reglamento de desarrollo de la Ley Orgánica 15/1999, de 13 de diciembre, de protección de datos de carácter personal [Royal Decree 1720/2007, . . . Approving the Regulation of the Law on Data Protection (RDLOPD)], B.O.E. Jan. 19, 2008, http://www.agpd.es/ portalwebAGPD/canaldocumentacion/legislacion/estatal/common/pdfs/2014/Real_Decreto_1720-2007_de_ 21_de_diciembre_por_el_que_se_aprueba_Reglamento_de_desarrollo_Ley_Organica_15-1999_Consolidado.pdf, archived at https://perma.cc/BGV3-FKN3.
 LOPD art. 35.
 Juan Pablo Aparicio Vaquero & Alfredo Batuecas Caletrio, En Torno a la Privacidad y la Protección de Datos en la Sociedad de la Información 2 (Granada, 2015).
 Id. at 73.
 LOPD art. 16; RDLOPD arts. 31–33.
 RDLOPD art. 23.
 LOPD art. 16.3.
 RDLOPD art. 34.
 LOPD art. 16.5.
 RDLOPD art. 35.2.
 ‘Derecho al Olvido’?, AEDP, http://www.agpd.es/portalwebAGPD/CanalDelCiudadano/derecho_olvido/index-ides-idphp.php (last visited Nov. 15, 2017), archived at https://perma.cc/BEF7-NCFA.
 LOPD art. 4.5.
 Case C-131/12, Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González, ECLI:EU:C:2014:317, http://curia.europa.eu/juris/celex.jsf?celex=62012CJ0131&lang1=en& type=TXT&ancre, archived at https://perma.cc/UUQ6-FRXS.
 Aparicio Vaquero & Batuecas Caletrio, supra note 4, at 78.
 Id. at 79.
 Id. at 81.
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (1995 Data Protection Directive), 1995 O.J. (L 281) 31, http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A 31995L0046, archived at https://perma.cc/MB6S-347M.
 Aparicio Vaquero & Batuecas Caletrio at 82.
 Id. at 83.
 Id. at 85–86.
 Id. at 90.
Last Updated: 04/16/2018