In its ruling of 14 March 2016, the Spanish Supreme Court has declared that Google Inc., and not Google Spain, is the data controller of the personal data processed by its search engine and therefore must respond to the requests of data subjects relating to its cancellation right within the framework of the right to be forgotten on the internet.
In December 2011, the Director of the Spanish Data Protection Agency ("DPA") declared the existence of an infringement of the Spanish Data Protection Law (the "DPL") allegedly committed by Google Spain. A Spanish citizen had made a complaint to the DPA relating to the exercise of his data subject rights (i.e. right to access, cancellation, erasure and objection) and the DPA requested Google Spain to cancel the processing of the relevant personal data, processed through the search engine, 'Google Search', (the "Personal Data") and issued a decision declaring that Google Spain had infringed the Spanish DPL. Google Spain argued that it was not the data controller of the Personal Data because it only provided advertisement services to Google Inc. in Spain and subsequently appealed the decision of the DPA before the Spanish National High Court (the "High Court"). The High Court set aside Google Spain's appeal in December 2014. Google Spain subsequently appealed the ruling of the High Court before the Spanish Supreme Court.
Whereas the DPA, together with the Spanish National High Court considered that Google Spain had the status of co-controller of the Personal Data, in its ruling of 14 March 2016, the Spanish Supreme Court declared that Google Inc., and not Google Spain, was the sole data controller of the Personal Data. Therefore Google Spain is not obligated to address requests based on the right to be forgotten and such requests should be directed instead to Google Inc.
This reaffirmed the categorisation of a search engine as data controller of the data processed by such search engine, stated by the CJEU in 2014 (Case C-131/12). On this basis, Google Inc. is considered to be the data controller of the Personal Data because it is the company that manages the search engine and the one which determines "the purposes and means of the processing of personal data", in line with the wording of the DPD and the Spanish DPL.
The Supreme Court has supported its ruling with the statement made by the CJEU, that in the application of the national data protection legislation, the DPD does not require the processing of personal data to be carried out "by" the establishment concerned itself, but only that it be carried out "in the context of the activities" of the establishment. This indicates that although the activity of Google Spain is made in the context of the activities of Google Search, the processing of personal data is undertaken by Google Inc. This is the reason Spanish DPL is applicable to the processing of personal data processed by the search engine but Google Spain, as it is not the company which determines the purposes and means of the processing of personal data by the search engine, cannot be considered the data controller of such personal data and consequently is not obliged to address requests based on the right to be forgotten in Spain.
Organisations should be aware that the relevant data protection laws will not always be where the data subject is based, even where there is some establishment present, instead depending on where the data processing is most closely associated with.
The Spanish Supreme Court's Ruling can be accessed here, at the 'TSContencioso 6 Madrid 14.03.16'. (Spanish)