Google Spain SL v. Agencia Espanola de Proteccion de
Datos, E.C.J., No. C-131/12, 5/13/14
Holding: EU data subjects can compel
Google Inc. and other Internet search engines to remove from their
search results links to websites containing data subject's personal
Potential Impact:Landmark decision establishes
extraterritorial jurisdiction of EU data protection law over Google
and other Internet companies, imposes burdens on Web companies.
May 13 --Data subjects in the European Union have the right to
compel Google Inc. and other Internet search engines to remove
search results linking to websites containing personal information
about them, the European Union Court of Justice ruled in a landmark May
13 decision Google Spain SL v. Agencia Espanola de Proteccion
de Datos, E.C.J., No. C-131/12, 5/13/14).
The court's partial rejection of the June 2013 recommended opinion of the
court's advocate general is a significant application by the EU's
highest court of EU data protection law to U.S. companies such as
Google, Microsoft Corp., Twitter Inc. and Facebook Inc.
The ruling is a "big deal," establishing extraterritorial
jurisdiction of EU data protection law over Google, which has
"strenuously resisted" efforts to apply EU law to it, Daniel P.
Cooper, a partner with Covington & Burling LLP in London, told
Bloomberg BNA May 13.
The ruling may "open the floodgates for tens of thousands of
requests to have legal, publicly available information about
Europeans taken out of a search index or links removed from
websites," James Waterworth, the head of the Brussels office of the
Computer& Communications Industry Association, said in a May 13
While the ruling targets Google directly, its impact may be felt
by the press, social media sites and any other business that
publishes links to personal information online, John Armstrong, a
partner at CMS Cameron McKenna LLP in London, said in a May 13
Representatives from Twitter, Microsoft and Facebook declined
May 13 Bloomberg BNA requests to comment.
The case concerned a Spanish national who asked the Spanish Data
Protection Agency (AEPD) to enforce a right to be forgotten by
obliging Google to remove search results linking his name to
newspaper details of debt recovery proceedings against him.
Spain's National Court (Audiencia Nacional) referred the case to
the ECJ in March 2012 for a clarification of EU law in relation to
the complaint against Google .
Reform of the EU Data Protection Directive: 'Right to Be
Forgotten'--What Should Be Forgotten and How?--Axel Spies, Bingham
McCutchen LLP, Washington and Frankfurt
The European Commission's proposed data protection regulation to
replace the EU Data Protection Directive (95/46/EC) included a
right to be forgotten principle (11 PVLR 178, 1/30/12). The version
of the proposed regulation approved by the European Parliament
March 12 changed the nomenclature to a "right to erasure" of
personal data, which also would create an obligation for companies
receiving such a request to forward the request to other data
processors to which the data have been transferred (13 PVLR 444,
The activities in which search engines engage--"finding
information published or placed on the internet by third parties,
indexing it automatically, storing it temporarily and, finally,
making it available to internet users according to a particular
order of preference"--amount to data processing, and a search
engine carrying out such processing is a data controller under the
EU's 1995 Data Protection Directive (95/46/EC), the ECJ said in its
Consequently, search engines should be required to remove links
at the request of a data subject, a right that is granted by
Article 14 of the Data Protection Directive, the court said.
In a May 13 statement accompanying the ruling, the court added
that the right to request removal of links should be balanced with
"the legitimate interest of internet users potentially interested
in having access to that information," but the rights of data
subjects "override, as a general rule, that interest of internet
The court statement added that search engine results could
"establish a more or less detailed profile" of the person being
searched. In addition, the court said, "the effect of the
interference with the person's rights is heightened on account of
the important role played by the internet and search engines in
"In the light of its potential seriousness, such interference
cannot, according to the Court, be justified by merely the economic
interest which the operator of the engine has in the data
processing," the court statement said.
Search engines should consider requests from data subjects for
removal of links and could be referred by data subjects to national
data protection authorities in cases of refusal, the court
The court found that Google's data processing operations are
subject to EU data protection law, even though those operations
take place outside the EU. The ruling also said that a request from
a data subject for removal of a search engine link doesn't imply
that the information to which the link refers should be removed
from its initial place of publication.
On extraterritoriality, the court statement said it was
sufficient that Google has a Spanish subsidiary that deals with
advertising sales, because the Spanish subsidiary "is intended to
promote and sell, in the member state in question, advertising
space offered by the search engine in order to make the service
offered by the engine profitable."
Cooper said the ruling could influence the decisions of non-EU
corporations to establish subsidiaries in the EU.
"It marks a fork in the road where companies might retrench and
pull back," because Internet companies would either have to accept
falling under the jurisdiction of EU data protection law, or find
other ways to "try to insulate themselves" from the law's
provisions on data processing, he said.
"Companies are going to have to make that judgment call," Cooper
said. However, some U.S. Internet companies are already established
in EU countries, such as Ireland and the U.K., and for many
companies the EU is "too important a market" to miss out on, he
On the court's finding that data subjects could oblige search
engines to remove search results, but couldn't oblige publishers to
remove original information, Cooper said the ruling had created
"one rule for the publisher and another rule for the web search
"It's just such a mind-bogglingly impossible decision," Fred
Cate, distinguished professor and C. Ben Dutton professor of law at
Indiana University Maurer School of Law, told Bloomberg News.
Google and other Web companies may have to consider charging a
fee for European users to cover the costs of staff to comb through
user requests to remove information, Cate, who is also a member of
the advisory board for Bloomberg BNA's Privacy & Security Law
Justin Brookman, director of the Center for Democracy and
Technology's Project on Consumer Privacy told Bloomberg News that
companies may now need "to hire an army of compliance officers" and
that may make it difficult for companies to "scalably compete
Google said in a May 13 statement to Bloomberg BNA that "this is
a disappointing ruling for search engines and online publishers in
general. We are very surprised that it differs so dramatically from
the advocate general's opinion and the warnings and consequences
that he spelled out. We now need to take time to analyse the
Advocate General Niilo Jääskinen in a June 2013 opinion said
that search engines couldn't be considered controllers of data
processing operations related to indexing of existing information
and that data subjects shouldn't have the right to oblige search
engines to delete links.
ECJ judgments usually follow closely the opinions of the
Cooper said that perceived attempts by Google to sidestep EU
data protection law were "perhaps offensive to European regulators"
and "that may have influenced the thinking" behind the court
During many discussions over the past several years with EU data
protection authorities, including arguments over data retention
time limits (7 PVLR 1344, 9/15/08), Google took the position that
EU laws shouldn't apply to its operations even if it had operations
in EU member states because its U.S. operations retained control
over the data.
The ECJ's interpretation of the EU Data Protection Directive
will affect more than 220 appeals made by Google against AEPD
rulings that are currently before the National Court in Madrid,
according to a May 13 AEPD statement provided to Bloomberg BNA.
"The agency welcomes the ECJ's support for its positions and its
binding establishment of a correct interpretation of the directive
in the future, as this will thwart renewed attempts to circumvent
its application with resulting damage to those affected," the AEPD
The AEPD said the ECJ judgment "definitively clarifies" the
responsibility of search engine operators with regard to personal
data protection and "puts an end to the lack of protection
generated by Google's refusal to submit to Spanish and European
regulations on the matter."
There is no exact right to be forgotten principle in the
relevant Spanish law, the Organic Data Protection Act (LOPD, Law
15/1999), but the court and AEPD broadly equated data subject
correction rights with the principle.
The ruling sharply divided privacy advocates and those that said
it could negatively affect free speech.
Sophie in 't Veld, Dutch liberal member of the European
Parliament, said in a May 13 statement that "this is a landmark
ruling. It puts results of a search engine within the scope of EU
data protection rules."
"Big internet companies can no longer escape EU data protection
rules by having their headquarters outside the EU," she said. "This
ruling puts Europe firmly back in the lead when it comes to data
protection in the world."
Mina Andreeva, spokeswoman for the European Commission, the EU's
executive arm, said at a May 13 briefing that the ruling was "good
news" and that it "reversed the burden of proof" with regard to the
deletion of personal data. Whereas previously, consumers had to
justify the deletion, data controllers now have to demonstrate why
data shouldn't be deleted, she said.
However, Jodie Ginsberg, chief executive of Index on Censorship,
which campaigns for free speech, said in a May 13 statement that
the ruling "violates the fundamental principles of freedom of
The judgment "allows individuals to complain to search engines
about information they do not like with no legal oversight. This is
akin to marching into a library and forcing it to pulp books,"
The ECJ's ruling "opens the door to anyone who wants to
whitewash their personal history," and is "a retrograde move that
misunderstands the role and responsibility of search engines and
the wider internet," Ginsberg added.
Paolo Balboni, scientific director of the European Privacy
Association, a think tank supported by companies including Google,
Facebook and Microsoft, said in a May 13 statement to Bloomberg BNA
that "the limited liability of search engines should be preserved,
they are not responsible for available content."
He added that the companies "must, however, actively cooperate
in order to best protect the rights of European internet
By Stephen Gardner
With assistance from Brett Allan King in Madrid;
Aoife White in Brussels; Dina Bass in Seattle;
Sarah Frier in San Francisco; Brian Womack in San
Francisco; Joel Rosenblatt in San Francisco
To contact the reporter on this story: Stephen Gardner in
Brussels at email@example.com
To contact the editors responsible for this story: Katie W.
Johnson at firstname.lastname@example.org;
Donald G. Aplin at email@example.com
The ECJ opinion is available at http://tinyurl.com/kt5bzvg.
The June 2013 opinion of the advocate general is available
To view additional stories from Privacy & Security Law Report® register for a free trial now