The Chamber for Contentious Administrative Proceedings ("Sala de lo Contencioso-Administrativo") of the Spanish Supreme Court has recently issued two decisions dealing with the liability regime that applies under Spanish law to Google Spain in connection with the processing of personal data through the world-known Internet research engine. The paradox is that these decisions contradict the position recently taken by the Civil Chamber of the Supreme Court ("Sala de lo Civil") on an identical case.
On the one hand, the Civil Chamber considered in its decision dated April 16, 2016 that Google Spain (the Spanish subsidiary of Google which activities are just focused in the field of marketing) should be deemed liable for the processing of personal data executed through the research engine operated by Google. Hence, the said Chamber considered that Google Spain should be deemed as joint and severally liable for that data processing. The main reason for this is that, under that view, the involvement of a marketing entity (such as Google Spain) is intrinsically connected with the global operation of activities by Google in general. Therefore, Google Spain should be deemed liable for an activity where -according to the approach taken by the Civil Chamber- it would be indirectly involved.
On the contrary, the Chamber for Contentious Administrative Proceedings has considered in two decisions dated March 8, 2016 and June 13, 2016 that no such liability should be given, since Google Spain is nothing but a marketing subsidiary that is not involved in the said processing of personal data. The said Chamber bases its approach on the interpretation it makes of the provisions of the recently-approved EU General Data Protection Regulation.
Regardless of this piece of legislation not entering into force until May 28, 2018, the Chamber for Contentious Administrative Proceedings of the Spanish Supreme Court considers that its provisions must be taken into account in order to achieve a better understanding of the situation and its regulatory environment. In this respect, the decision sets forth that any claim filed by Spanish users should be forwarded to Google, Inc. and that the Spanish Data Protection authority should only get involved in case the corresponding requests were not properly managed and responded by Google, Inc.
As a matter of fact, the decision considers that the procedures that have been put in place by Google, Inc. in order to deal with requests related to the right to be forgotten (namely, the use of an online form which is directly accessible by the user and free of charge) are acceptable under Spanish law as well as under the General Data Protection Regulation.
This lack of coincidence between the two Chambers of the Spanish Supreme Court lead to a complex legal situation. Certainly, the existence of contradictory criteria creates a significant degree of confusion as the reliability on the right criteria in this type of matters will not exist under Spanish law until both Chambers reach a coincident conclusion.
