(May 21, 2014) On May 13, 2014, the Grand Chamber of the European Court of Justice (ECJ) delivered its judgment in a case involving a Spanish national and Google Inc., in which it upheld the request of the Spanish national to order Google to withdraw personal data related to him and to prevent further access to such data. (Judgment of the ECJ (Grand Chamber), Case C-131/12, Google Spain SL, Google Inc v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González (May 13, 2014), EUR-LEX.)
Background
The Spanish national filed a complaint in 2010 with the Spanish Data Protection Agency (SDPA) against the publisher of a newspaper and against Google. The crux of his complaint was that when an Internet user searched the applicant’s name, Google results would show a link to a 1998 article of the newspaper La Vanguardia, stating that a real estate auction in connection with the applicant was held following attachment proceedings, in order to recover social security debts. The applicant requested the SDPA to order Google Spain and Google Inc. to remove or conceal the personal data related to the La Vanguardia article. (Id. ¶¶ 14-15). The SDPA upheld the complaint against Google. As a result, Google Spain and Google Inc. instituted legal proceedings against the SDPA’s decision before the National High Court (Audiencia Nacional) in Spain. (Id. ¶¶ 17-18.)
Preliminary Reference Before the ECJ
Among the issues referred to the ECJ, Spain’s National High Court asked (a) whether the AEPD may directly order Google to withdraw from its indices a piece of information published by third parties and (b) whether the right of erasure and/or the right to object, as provided for in European Union Directive 95/46/EC, enable the data subject to request directly that operators of search engines prevent the publication of information related to the subject on the grounds that such information might be prejudicial to the subject or because the data subject wants to be forgotten, after a period of time even though the information was lawfully published by third parties. (Id. ¶ 20, 2(c) & 3; Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995, O.J. (L 281) 31, EUR-LEX.)
Judgment of the ECJ
In analyzing the applicable legislation, the ECJ stated that under Directive 95/46/EC, which regulates the processing of personal data and grants certain rights to data subjects regarding their data, the data subject has the right to object to the processing of his personal data on legitimate grounds, unless national legislation provides otherwise. The data subject has the right to object to the controller who does the processing, and if his request is not met, then he has the right to complain to the national supervisory authority or to the national court. (Judgment of the ECJ (Grand Chamber), Case C-131/12, supra, ¶¶ 76-77.)
The ECJ stated that the processing of personal data of the nature involved in this case is liable to affect greatly the fundamental rights of privacy and personal data protection. Due to the potential serious nature of the interference with the data subject’s rights, the Court said that such interference cannot be justified solely on the basis of the economic interest of the processor of a search engine. The ECJ said that a balancing act must be applied between the legitimate interests of Internet users in having access to this information and the rights of privacy and personal data protection of the data subject. (Id. ¶¶ 80 & 81.)
In the view of the ECJ, the operator of a search engine, as the controller of the processing of personal data, is obliged to ensure that the processing takes place in compliance with the safeguards provided for in Directive 95/46/EC. (Id. ¶ 83.)
The Court observed that the right to erasure and the right to object are to be interpreted in such a manner that either enables the data subject to require the operator of a search engine to erase data prejudicial to him or allows him to be “forgotten” after a certain period has elapsed. (Id. ¶ 89.)
The ECJ noted that article 12(b) of Directive 95/46/EC gives the right to data subjects to request the erasure or blocking of data when processing of personal data is incompatible with the Directive in instances when the data are inaccurate, inadequate, irrelevant, or excessive, considering the purposes of the processing. (Id. ¶ 92.)
Therefore, the ECJ reasoned that processing of personal data that was initially lawful may after the passage of time become incompatible with the purposes of the Directive, when those data are no longer necessary given the purposes for which they were initially collected, especially when the data are inadequate, irrelevant, or no longer relevant. (Id. ¶ 93.)
The ECJ concluded that the data subject’s interest in having links related to his name removed “override, as a rule, not only the economic interest of the operator of the search engine, but also the interest of the general public in finding that information upon a search relating to the data subject’s name.” (Id. ¶ 97.) However, the Court indicated that an exception may be made in cases where an individual played a role in public life and any interference with his/her right to privacy and personal data protection would be justified “by the preponderant interest of the general public in having access to information.” (Id. ¶ 97.) In the case at hand, the ECJ did not accept the notion that there was a preponderant interest of the public in having access to information related to a real estate auction that occurred 16 years ago. (Id. ¶ 98.)