Case C‑131/12
Google Spain SL
and
Google Inc.
v
Agencia Española de Protección de Datos (AEPD)
and
Mario Costeja González
(Request for a preliminary ruling
from the Audiencia Nacional)
(Personal data — Protection of individuals with regard to the processing of such data — Directive 95/46/EC — Articles 2, 4, 12 and 14 — Material and territorial scope — Internet search engines — Processing of data contained on websites — Searching for, indexing and storage of such data — Responsibility of the operator of the search engine — Establishment on the territory of a Member State — Extent of that operator’s obligations and of the data subject’s rights — Charter of Fundamental Rights of the European Union — Articles 7 and 8)
Summary — Judgment of the Court (Grand Chamber), 13 May 2014
1. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Article 2 — Processing of personal data — Definition — Activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it, storing it and making it available to internet users — Included — Controller —Definition — Operator of a search engine — Included
(European Parliament and Council Directive 95/46, Art. 2(b) and (d))
2. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Observance of fundamental rights — Privacy and the protection of personal data — Fair balance between the right to information and the rights guaranteed by the Charter of Fundamental Rights of the European Union
(Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46)
3. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Article 4 — National law applicable — Processing of data in the context of the activities of the establishment set up on the territory of a Member State by an operator of a search engine — Scope — Promotion and sale by means of that establishment of the advertising space directed at the inhabitants of that Member State which is offered by the engine — Included
(European Parliament and Council Directive 95/46, Art. 4(1)(a))
4. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to personal data and right to object to the processing thereof — Right to request the removal of links to web pages from the list of results — Conditions
(European Parliament and Council Directive 95/46, Arts 12(b) and 14, first para., (a))
5. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to personal data and right to object to the processing thereof — Search made by means of a search engine on the basis of a person’s name — Display of a list of results — Right to request that that information no longer be made available to the general public
(Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Arts 6(1)(c) to (e), 12(b) and 14, first para., (a))
1. Article 2(b) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as processing of personal data when that information contains personal data.
This interpretation is not affected by the fact that the data have already been published on the internet and are not altered by the search engine. The operations referred to in that provision must also be classified as such processing where they exclusively concern material that has already been published in unaltered form in the media.
Furthermore, the operator of a search engine must be regarded as the controller in respect of that processing of personal data, within the meaning of Article 2(d) of Directive 95/46. Inasmuch as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.
(see paras 29, 30, 38, 41, operative part 1)
2. Processing of personal data carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. That is all the more the case because the internet and search engines render the information contained in such a list of results ubiquitous. In the light of its potential seriousness, that interference cannot be justified by merely the economic interest which the operator of such an engine has in that processing. A fair balance must be sought in particular between the legitimate interest of internet users in access to information and the data subject’s fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
(see paras 36, 38, 80, 81, 97)
3. Article 4(1)(a) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.
In such circumstances, the activities of the operator of the search engine and those of its establishment situated in a Member State, although separate, are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed.
(see paras 51, 55, 56, 60, operative part 2)
4. Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
Since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, the data processing carried out by the operator of a search engine is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.
(see paras 87, 88, operative part 3)
5. It follows from the requirements laid down in Article 6(1)(c) to (e) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. Therefore, if it is found, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of the directive because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.
In this context, it is not necessary, in order to find a right of the data subject that the information relating to him personally should no longer be linked to his name by a list of results, that the inclusion of the information in question in the list of results causes prejudice to him.
As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, request that the information in question no longer be made available to the general public by its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question.
(see paras 93, 94, 96-99, operative part 4)