On December 2011, the Spanish Data Protection Agency ("DPA") initiated a procedure for the protection of the rights of access, rectification, erasure and objection against Google Spain for not cancelling the personal data of an individual exercising its "Right to be Forgotten".
During the administrative procedure, Google Spain stated that it could not be considered to be the data controller of the personal data and explained that its business relied on promoting and selling ad space on search results. But even so, the DPA established that Google Spain should take the necessary measures to exclude the individual's personal data from the search engine results. This conclusion was confirmed by the National High Court through a ruling that was appealed by Google Spain before the Spanish Supreme Court.
On its ruling resolving the appealing of Google Spain, dated 14 March 2016 reported on last month, the Administrative Chamber of the Spanish Supreme Court endorsed the assertion of the Court of Justice of the European Union with regards the qualification of search engines as data controllers (Caso C-131/12). Notwithstanding this endorsement, the Supreme Court pointed out that the data controller of the personal data processed within the search engine was Google Inc. – the company which decided the purpose of the processing of such data - and not Google Spain.
However, when the question of which company was the data controller of the personal data processed within the search engine came before the very same tribunal, the position appeared to be different with the Civil Chamber of the Supreme Court this time in its ruling on 5 April 2016, ordering Google Spain to pay €8,000 as compensation for the violation of fundamental rights. The information in question which related to a pardon for a drug dealing offence granted to the individual in question many years ago was still shown among the search engine results.
Because of the information shown by the search engine, the individual decided to initiate a procedure for the protection of his rights before the DPA against Google Spain, which had the same outcome that the abovementioned case initiated in 2011, the DPA ordered Google Spain to adopt the necessary measures to exclude the information concerning the pardon from the search engine results.
The Civil Chamber of the Supreme Court has here taken a broader interpretation of the concept of "data controller" and reaches the conclusion that there is an indissoluble link between the activities of Google Spain and Google Inc., and accordingly, Google Spain also qualifies as data controller.
The Civil Chamber of the Supreme Court's reasoning is based on the fact that a narrower interpretation of the concept of "data controller" would prevent the effective and complete protection of fundamental rights because it would be necessary for the individuals to initiate proceedings against the data controller, i.e. Google Inc., in the United States courts.
These two contradictory rulings of the Supreme Court reopen the debate on who is the relevant Google company that should answer the requests to exercise the right to be forgotten as data controller. While the Administrative Chamber follows a literal interpretation of the data protection legislation, the Civil Chamber tries to protect citizen's fundamental rights giving rise to the possibility that such citizens may be compensated when the data controller leaves requests to be forgotten un-responded to. Let's hope this controversy is clarified soon.
Data controllers in Spain should bear in mind the more data subject friendly approach of the Civil Chamber of the supreme court.
The case can be accessed here (Spanish).