WELCOME TO CHARLES RUSSELL SPEECHLYS.
We would like to place strictly necessary cookies and performance cookies on your computer to improve our website service.
Otherwise, we'll assume you are OK to continue. Please close this message
On 5 March 2010, Mr González, lodged a complaint with the Spanish data protection authority (DPA) against La Vanguardia Ediciones SL (La Vanguardia), a Spanish newspaper and also against Google Spain and Google Inc.
The complaint was based on the fact that if an internet user entered Mr González's name into Google they would obtain links to two pages of La Vanguardia's newspaper from 1998 regarding Mr González's financial difficulties and the repossession and auction of his property.
Mr González argued that the proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
Mr González therefore requested:
The DPA rejected the complaint in so far as it related to La Vanguardia, taking the view that the publication of personal data about Mr González was legally justified as it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction of his property in order to secure as many bidders as possible.
On the other hand, the complaint against Google Spain and Google Inc. was upheld. The DPA considered that operators of search engines are subject to data protection legislation and were therefore required to remove the web pages at the request of Mr González.
Google Spain and Google Inc. brought separate actions against that decision before the Spanish National High Court, which were then later joined. The High Court decided to stay the proceedings and to refer the following questions to the European court for a preliminary ruling.
Under EU data protection law, if an organisation:
then it must comply with the principles of the data protection Directive, particularly the obligations to ensure that personal data is relevant and not kept for longer than reasonably necessary.
Mr González's argument was that the personal data about him was no longer relevant and had been retained for longer than reasonably necessary and therefore, Google, ought to remove it from the search engine result.
The search engine did not discriminate between personal data and other information on the internet and therefore could not be regarded as 'processing' personal data.
Even if Google was regarded as 'processing' personal data, the operator of a search engine has no knowledge of those data and does not exercise control over that data and therefore is not a 'data controller'.
The business of Google Spain was limited to providing support to Google's group's advertising activity, which is separate from its search engine service.
The activity of a search engine consisting of finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and making it available to internet users according to a particular order of preference must be classified as 'processing of personal data'.
The operator of the search engine operator must be regarded as being a 'data controller' as it is the search engine, which determines the purposes for processing that personal data.
To exclude the operator of a search engine from the definition of a 'controller' on the ground that it does not exercise control over the personal data published on the web pages of third parties, would be contrary, not only to the definition of a 'controller' as set out in law, but also to the objective of protecting individuals through a broad definition of a 'controller'.
The activities of Google Inc. as operator of the search engine and those of its Spanish establishment are inextricably linked.
The very display of personal data on a search results page constitutes processing of such data as that display of results is accompanied, on the same page, by advertising linked to the search terms.
It is therefore clear that the processing of personal data in the search engine is carried out "in the context of" the commercial and advertising activity of Google Spain.
When the operator of a search engine sets up a branch or subsidiary which is intended to promote or sell advertising space offered by that engine and which directs its activities towards citizens of a particular member state, that will constitute an 'establishment' for the purposes of EU data protection law.
This article was written by Janine Regan.
For more information please contact Janine on +44 (0)20 7203 6798 or firstname.lastname@example.org.