We would like to place strictly necessary cookies and performance cookies on your computer to improve our website service.
To find out more about how we use cookies and how you can change your cookies settings, please read our  cookies statement.                
Otherwise, we'll assume you are OK to continue.   Please close this message

Gonzalez is remembered as a man who is forgotten

28 May 2014

On 5 March 2010, Mr González, lodged a complaint with the Spanish data protection authority (DPA) against La Vanguardia Ediciones SL (La Vanguardia), a Spanish newspaper and also against Google Spain and Google Inc.

The complaint was based on the fact that if an internet user entered Mr González's name into Google they would obtain links to two pages of La Vanguardia's newspaper from 1998 regarding Mr González's financial difficulties and the repossession and auction of his property.

Mr González argued that the proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.

Mr González therefore requested:

  • firstly, that La Vanguardia be required either to remove or alter those pages so that the personal data relating to him no longer appeared or to use certain tools made available by search engines in order to protect the data, and
  • secondly, that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia.

Why was the newspaper not party to the proceedings?

The DPA rejected the complaint in so far as it related to La Vanguardia, taking the view that the publication of personal data about Mr González was legally justified as it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction of his property in order to secure as many bidders as possible.

On the other hand, the complaint against Google Spain and Google Inc. was upheld. The DPA considered that operators of search engines are subject to data protection legislation and were therefore required to remove the web pages at the request of Mr González.

Google Spain and Google Inc. brought separate actions against that decision before the Spanish National High Court, which were then later joined. The High Court decided to stay the proceedings and to refer the following questions to the European court for a preliminary ruling.

What were the main issues the court examined?

Under EU data protection law, if an organisation:

  • processes personal data
  • is a data controller
  • has an establishment, or uses equipment in, a member state of the European Union

then it must comply with the principles of the data protection Directive, particularly the obligations to ensure that personal data is relevant and not kept for longer than reasonably necessary.

Mr González's argument was that the personal data about him was no longer relevant and had been retained for longer than reasonably necessary and therefore, Google, ought to remove it from the search engine result.

What were Google's arguments?

Google's search engine did not "process" personal data

The search engine did not discriminate between personal data and other information on the internet and therefore could not be regarded as 'processing' personal data.

Google was not a "data controller"

Even if Google was regarded as 'processing' personal data, the operator of a search engine has no knowledge of those data and does not exercise control over that data and therefore is not a 'data controller'.

The search engine was run by Google Inc which was not "an establishment" or nor using "equipment" in a member state of the European Union"

The business of Google Spain was limited to providing support to Google's group's advertising activity, which is separate from its search engine service. 

What did the European Court say?

The activity of a search engine consisting of finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and making it available to internet users according to a particular order of preference must be classified as 'processing of personal data'.

The operator of the search engine operator must be regarded as being a 'data controller' as it is the search engine, which determines the purposes for processing that personal data.

To exclude the operator of a search engine from the definition of a 'controller' on the ground that it does not exercise control over the personal data published on the web pages of third parties, would be contrary, not only to the definition of a 'controller' as set out in law, but also to the objective of protecting individuals through a broad definition of a 'controller'.

The activities of Google Inc. as operator of the search engine and those of its Spanish establishment are inextricably linked. 

The very display of personal data on a search results page constitutes processing of such data as that display of results is accompanied, on the same page, by advertising linked to the search terms. 

It is therefore clear that the processing of personal data in the search engine is carried out "in the context of" the commercial and advertising activity of Google Spain.

When the operator of a search engine sets up a branch or subsidiary which is intended to promote or sell advertising space offered by that engine and which directs its activities towards citizens of a particular member state, that will constitute an 'establishment' for the purposes of EU data protection law.

This article was written by Janine Regan.  

For more information please contact Janine on +44 (0)20 7203 6798 or janine.regan@crsblaw.com.