It was made public yesterday, Tuesday, May 13th, the decision of the Court of Justice of the European Union (EUCJ) in Case C-131/12 on the questions submitted by Spanish High Court (Audiencia Nacional) in the proceedings involving Google Spain, SL Google Inc. and the Spanish Data Protection Commissioner and a Spanish citizen.
The decision is particularly striking as it divorces from the criteria proposed by the General Attorney (Mr. Niilo Jääskinen ) in its Conclusions of 25 June 2013 on the right to apply for the de-indexation of certain content. In this sense, in contrast with the position of General Attorney that data subjects cannot exercise their cancellation rights in front of Internet search engine services provider, the EUCJ has confirmed that they are allowed to request the de-indexation of content. The EUCJ defends that, in general, the data subject’s interest must prevail over both the economic interest of the Internet search engine services provider, and the interest of third parties (the general public) of finding a specific information in connection with a given research about the data subject.
The EUCJ accepts however that, the cancellation/ blocking request made by the data subject can be rejected when, for specific reasons (such as having the data subject a public post), the interference with the fundamental rights concerned is justified by the overriding interest of third parties to, as a result of this indexation, have access to information on the data subject. It further clarifies that backing the enforceability of this right does not entail that indexation of the information causes damages to the data subject.
With the above in mind, in principle, it is possible to exercise the so-called “right to be forgotten” in front of Internet search engine services providers, which will be obliged to process such request in all cases, it being only possible to reject cancellation or blocking of data exceptionally, when a major interest of third parties (the public) to find this information by making a research on the data subject is reputed.
Regarding the rest of questions raised within the proceedings brought by the Spanish Audiencia Nacional, the ruling backs the General Attorney and states:
- The activity of Internet search engine services providers should be considered a “data processing”, as defined in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with respect to the processing of their personal data and the free movement of such data (the Directive).
- Internet search engine services providers should be considered “data controllers”, as defined in the Directive, as the decide on the purposes and means for the processing.
- A subsidiary in a Member State of an entity not located in a Member State that is performing an activity closely connected to the activity of the parent company (e.g. to advertise and promote the sale of advertising spaces associated with the search patterns of Google Search users) should be considered as an establishment in said Member State acting “in the framework of the activities” of the Controller (reference contained in Article 4 of the Directive that cannot be interpreted restrictively), and therefore the Member State data protection regulations shall be applicable.