JUDGMENT OF THE COURT (Grand Chamber)
(Personal
data — Protection of individuals with regard to the processing of such
data — Directive 95/46/EC — Articles 2, 4, 12 and 14 — Material and
territorial scope — Internet search engines — Processing of data
contained on websites — Searching for, indexing and storage of such
data — Responsibility of the operator of the search engine —
Establishment on the territory of a Member State — Extent of that
operator’s obligations and of the data subject’s rights — Charter of
Fundamental Rights of the European Union — Articles 7 and 8)
In Case C‑131/12,
REQUEST
for a preliminary ruling under Article 267 TFEU from the Audiencia
Nacional (Spain), made by decision of 27 February 2012, received at the
Court on 9 March 2012, in the proceedings
Google Spain SL,
Google Inc.
v
Agencia Española de Protección de Datos (AEPD),
Mario Costeja González,
THE COURT (Grand Chamber),
composed
of V. Skouris, President, K. Lenaerts, Vice-President, M. Ilešič
(Rapporteur), L. Bay Larsen, T. von Danwitz, M. Safjan, Presidents of
Chambers, J. Malenovský, E. Levits, A. Ó Caoimh, A. Arabadjiev,
M. Berger, A. Prechal and E. Jarašiūnas Judges,
Advocate General: N. Jääskinen,
Registrar: M. Ferreira, Principal Administrator,
having regard to the written procedure and further to the hearing on 26 February 2013,
after considering the observations submitted on behalf of:
– Google Spain SL and Google Inc., by F. González Díaz, J. Baño Fos and B. Holles, abogados,
– Mr Costeja González, by J. Muñoz Rodríguez, abogado,
– the Spanish Government, by A. Rubio González, acting as Agent,
– the Greek Government, by E.-M. Mamouna and K. Boskovits, acting as Agents,
– the Italian Government, by G. Palmieri, acting as Agent, and P. Gentili, avvocato dello Stato,
– the Austrian Government, by G. Kunnert and C. Pesendorfer, acting as Agents,
– the Polish Government, by B. Majczyna and M. Szpunar, acting as Agents,
– the European Commission, by I. Martínez del Peral and B. Martenczuk, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 25 June 2013,
gives the following
Judgment
1 This
request for a preliminary ruling concerns the interpretation of
Article 2(b) and (d), Article 4(1)(a) and (c), Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive
95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of
personal data and on the free movement of such data (OJ 1995 L 281,
p. 31) and of Article 8 of the Charter of Fundamental Rights of the
European Union (‘the Charter’).
2 The
request has been made in proceedings between, on the one hand, Google
Spain SL (‘Google Spain’) and Google Inc. and, on the other, the Agencia
Española de Protección de Datos (Spanish Data Protection Agency; ‘the
AEPD’) and Mr Costeja González concerning a decision by the AEPD
upholding the complaint lodged by Mr Costeja González against those two
companies and ordering Google Inc. to adopt the measures necessary to
withdraw personal data relating to Mr Costeja González from its index
and to prevent access to the data in the future.
Legal context
European Union law
3 Directive
95/46 which, according to Article 1, has the object of protecting the
fundamental rights and freedoms of natural persons, and in particular
their right to privacy with respect to the processing of personal data,
and of removing obstacles to the free flow of such data, states in
recitals 2, 10, 18 to 20 and 25 in its preamble:
‘(2) …
data-processing systems are designed to serve man; … they must,
whatever the nationality or residence of natural persons, respect their
fundamental rights and freedoms, notably the right to privacy, and
contribute to … the well-being of individuals;
...
(10) …
the object of the national laws on the processing of personal data is
to protect fundamental rights and freedoms, notably the right to
privacy, which is recognised both in Article 8 of the European
Convention for the Protection of Human Rights and Fundamental Freedoms
[, signed in Rome on 4 November 1950,] and in the general principles of
Community law; … for that reason, the approximation of those laws must
not result in any lessening of the protection they afford but must, on
the contrary, seek to ensure a high level of protection in the
Community;
...
(18) …
in order to ensure that individuals are not deprived of the protection
to which they are entitled under this Directive, any processing of
personal data in the Community must be carried out in accordance with
the law of one of the Member States; … in this connection, processing
carried out under the responsibility of a controller who is established
in a Member State should be governed by the law of that State;
(19) …
establishment on the territory of a Member State implies the effective
and real exercise of activity through stable arrangements; … the legal
form of such an establishment, whether simply [a] branch or a subsidiary
with a legal personality, is not the determining factor in this
respect; … when a single controller is established on the territory of
several Member States, particularly by means of subsidiaries, he must
ensure, in order to avoid any circumvention of national rules, that each
of the establishments fulfils the obligations imposed by the national
law applicable to its activities;
(20) …
the fact that the processing of data is carried out by a person
established in a third country must not stand in the way of the
protection of individuals provided for in this Directive; … in these
cases, the processing should be governed by the law of the Member State
in which the means used are located, and there should be guarantees to
ensure that the rights and obligations provided for in this Directive
are respected in practice;
...
(25) …
the principles of protection must be reflected, on the one hand, in the
obligations imposed on persons … responsible for processing, in
particular regarding data quality, technical security, notification to
the supervisory authority, and the circumstances under which processing
can be carried out, and, on the other hand, in the right conferred on
individuals, the data on whom are the subject of processing, to be
informed that processing is taking place, to consult the data, to
request corrections and even to object to processing in certain
circumstances’.
4 Article 2 of Directive 95/46 states that ‘[f]or the purposes of this Directive:
(a) “personal
data” shall mean any information relating to an identified or
identifiable natural person (“data subject”); an identifiable person is
one who can be identified, directly or indirectly, in particular by
reference to an identification number or to one or more factors specific
to his physical, physiological, mental, economic, cultural or social
identity;
(b) “processing of
personal data” (“processing”) shall mean any operation or set of
operations which is performed upon personal data, whether or not by
automatic means, such as collection, recording, organisation, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making available, alignment or
combination, blocking, erasure or destruction;
...
(d) “controller”
shall mean the natural or legal person, public authority, agency or any
other body which alone or jointly with others determines the purposes
and means of the processing of personal data; where the purposes and
means of processing are determined by national or Community laws or
regulations, the controller or the specific criteria for his nomination
may be designated by national or Community law;
...’
5 Article 3 of Directive 95/46, entitled ‘Scope’, states in paragraph 1:
‘This
Directive shall apply to the processing of personal data wholly or
partly by automatic means, and to the processing otherwise than by
automatic means of personal data which form part of a filing system or
are intended to form part of a filing system.’
6 Article 4 of Directive 95/46, entitled ‘National law applicable’, provides:
‘1. Each
Member State shall apply the national provisions it adopts pursuant to
this Directive to the processing of personal data where:
(a) the
processing is carried out in the context of the activities of an
establishment of the controller on the territory of the Member State;
when the same controller is established on the territory of several
Member States, he must take the necessary measures to ensure that each
of these establishments complies with the obligations laid down by the
national law applicable;
(b) the
controller is not established on the Member State’s territory, but in a
place where its national law applies by virtue of international public
law;
(c) the controller is
not established on Community territory and, for purposes of processing
personal data makes use of equipment, automated or otherwise, situated
on the territory of the said Member State, unless such equipment is used
only for purposes of transit through the territory of the Community.
2. In
the circumstances referred to in paragraph 1(c), the controller must
designate a representative established in the territory of that Member
State, without prejudice to legal actions which could be initiated
against the controller himself.’
7 In
Section I (entitled ‘Principles relating to data quality’) of Chapter
II of Directive 95/46, Article 6 is worded as follows:
‘1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected
for specified, explicit and legitimate purposes and not further
processed in a way incompatible with those purposes. Further processing
of data for historical, statistical or scientific purposes shall not be
considered as incompatible provided that Member States provide
appropriate safeguards;
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate
and, where necessary, kept up to date; every reasonable step must be
taken to ensure that data which are inaccurate or incomplete, having
regard to the purposes for which they were collected or for which they
are further processed, are erased or rectified;
(e) kept
in a form which permits identification of data subjects for no longer
than is necessary for the purposes for which the data were collected or
for which they are further processed. Member States shall lay down
appropriate safeguards for personal data stored for longer periods for
historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is complied with.’
8 In
Section II (entitled ‘Criteria for making data processing legitimate’)
of Chapter II of Directive 95/46, Article 7 provides:
‘Member States shall provide that personal data may be processed only if:
...
(f) processing
is necessary for the purposes of the legitimate interests pursued by
the controller or by the third party or parties to whom the data are
disclosed, except where such interests are overridden by the interests
[or] fundamental rights and freedoms of the data subject which require
protection under Article 1(1).’
9 Article 9 of Directive 95/46, entitled ‘Processing of personal data and freedom of expression’, provides:
‘Member
States shall provide for exemptions or derogations from the provisions
of this Chapter, Chapter IV and Chapter VI for the processing of
personal data carried out solely for journalistic purposes or the
purpose of artistic or literary expression only if they are necessary to
reconcile the right to privacy with the rules governing freedom of
expression.’
10 Article 12 of Directive 95/46, entitled ‘Rights of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
...
(b) as
appropriate the rectification, erasure or blocking of data the
processing of which does not comply with the provisions of this
Directive, in particular because of the incomplete or inaccurate nature
of the data;
...’
11 Article 14 of Directive 95/46, entitled ‘The data subject’s right to object’, provides:
‘Member States shall grant the data subject the right:
(a) at
least in the cases referred to in Article 7(e) and (f), to object at
any time on compelling legitimate grounds relating to his particular
situation to the processing of data relating to him, save where
otherwise provided by national legislation. Where there is a justified
objection, the processing instigated by the controller may no longer
involve those data;
...’
12 Article 28 of Directive 95/46, entitled ‘Supervisory authority’, is worded as follows:
‘1. Each
Member State shall provide that one or more public authorities are
responsible for monitoring the application within its territory of the
provisions adopted by the Member States pursuant to this Directive.
...
3. Each authority shall in particular be endowed with:
– investigative
powers, such as powers of access to data forming the subject-matter of
processing operations and powers to collect all the information
necessary for the performance of its supervisory duties,
– effective
powers of intervention, such as, for example, that … of ordering the
blocking, erasure or destruction of data, of imposing a temporary or
definitive ban on processing …
– ...
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
4. Each
supervisory authority shall hear claims lodged by any person, or by an
association representing that person, concerning the protection of his
rights and freedoms in regard to the processing of personal data. The
person concerned shall be informed of the outcome of the claim.
...
6. Each
supervisory authority is competent, whatever the national law
applicable to the processing in question, to exercise, on the territory
of its own Member State, the powers conferred on it in accordance with
paragraph 3. Each authority may be requested to exercise its powers by
an authority of another Member State.
The
supervisory authorities shall cooperate with one another to the extent
necessary for the performance of their duties, in particular by
exchanging all useful information.
...’
Spanish law
13 Directive
95/46 was transposed into Spanish Law by Organic Law No 15/1999 of
13 December 1999 on the protection of personal data (BOE No 298 of
14 December 1999, p. 43088).
The dispute in the main proceedings and the questions referred for a preliminary ruling
14 On
5 March 2010, Mr Costeja González, a Spanish national resident in
Spain, lodged with the AEPD a complaint against La Vanguardia Ediciones
SL, which publishes a daily newspaper with a large circulation, in
particular in Catalonia (Spain) (‘La Vanguardia’), and against Google
Spain and Google Inc. The complaint was based on the fact that, when an
internet user entered Mr Costeja González’s name in the search engine of
the Google group (‘Google Search’), he would obtain links to two pages
of La Vanguardia’s newspaper, of 19 January and 9 March 1998
respectively, on which an announcement mentioning Mr Costeja González’s
name appeared for a real-estate auction connected with attachment
proceedings for the recovery of social security debts.
15 By
that complaint, Mr Costeja González requested, first, that La
Vanguardia be required either to remove or alter those pages so that the
personal data relating to him no longer appeared or to use certain
tools made available by search engines in order to protect the data.
Second, he requested that Google Spain or Google Inc. be required to
remove or conceal the personal data relating to him so that they ceased
to be included in the search results and no longer appeared in the links
to La Vanguardia. Mr Costeja González stated in this context that the
attachment proceedings concerning him had been fully resolved for a
number of years and that reference to them was now entirely irrelevant.
16 By
decision of 30 July 2010, the AEPD rejected the complaint in so far as
it related to La Vanguardia, taking the view that the publication by it
of the information in question was legally justified as it took place
upon order of the Ministry of Labour and Social Affairs and was intended
to give maximum publicity to the auction in order to secure as many
bidders as possible.
17 On
the other hand, the complaint was upheld in so far as it was directed
against Google Spain and Google Inc. The AEPD considered in this regard
that operators of search engines are subject to data protection
legislation given that they carry out data processing for which they are
responsible and act as intermediaries in the information society. The
AEPD took the view that it has the power to require the withdrawal of
data and the prohibition of access to certain data by the operators of
search engines when it considers that the locating and dissemination of
the data are liable to compromise the fundamental right to data
protection and the dignity of persons in the broad sense, and this would
also encompass the mere wish of the person concerned that such data not
be known to third parties. The AEPD considered that that obligation may
be owed directly by operators of search engines, without it being
necessary to erase the data or information from the website where they
appear, including when retention of the information on that site is
justified by a statutory provision.
18 Google
Spain and Google Inc. brought separate actions against that decision
before the Audiencia Nacional (National High Court). The Audiencia
Nacional joined the actions.
19 That
court states in the order for reference that the actions raise the
question of what obligations are owed by operators of search engines to
protect personal data of persons concerned who do not wish that certain
information, which is published on third parties’ websites and contains
personal data relating to them that enable that information to be linked
to them, be located, indexed and made available to internet users
indefinitely. The answer to that question depends on the way in which
Directive 95/46 must be interpreted in the context of these
technologies, which appeared after the directive’s publication.
20 In
those circumstances, the Audiencia Nacional decided to stay the
proceedings and to refer the following questions to the Court for a
preliminary ruling:
1. With
regard to the territorial application of Directive [95/46] and,
consequently, of the Spanish data protection legislation:
(a) must
it be considered that an “establishment”, within the meaning of
Article 4(1)(a) of Directive 95/46, exists when any one or more of the
following circumstances arise:
– when
the undertaking providing the search engine sets up in a Member State
an office or subsidiary for the purpose of promoting and selling
advertising space on the search engine, which orientates its activity
towards the inhabitants of that State,
or
– when
the parent company designates a subsidiary located in that Member State
as its representative and controller for two specific filing systems
which relate to the data of customers who have contracted for
advertising with that undertaking,
or
– when
the office or subsidiary established in a Member State forwards to the
parent company, located outside the European Union, requests and
requirements addressed to it both by data subjects and by the
authorities with responsibility for ensuring observation of the right to
data protection, even where such collaboration is engaged in
voluntarily?
(b) Must
Article 4(1)(c) of Directive 95/46 be interpreted as meaning that there
is “use of equipment … situated on the territory of the said Member
State”:
– when a search
engine uses crawlers or robots to locate and index information contained
in web pages located on servers in that Member State,
or
– when
it uses a domain name pertaining to a Member State and arranges for
searches and the results thereof to be based on the language of that
Member State?
(c) Is it possible
to regard as a use of equipment, in the terms of Article 4(1)(c) of
Directive 95/46, the temporary storage of the information indexed by
internet search engines? If the answer to that question is affirmative,
can it be considered that that connecting factor is present when the
undertaking refuses to disclose the place where it stores those indexes,
invoking reasons of competition?
(d) Regardless
of the answers to the foregoing questions and particularly in the event
that the Court … considers that the connecting factors referred to in
Article 4 of [Directive 95/46] are not present:
must
Directive 95/46 … be applied, in the light of Article 8 of the
[Charter], in the Member State where the centre of gravity of the
conflict is located and more effective protection of the rights of …
Union citizens is possible?
2. As regards the activity of search engines as providers of content in relation to Directive 95/46 …:
(a) in
relation to the activity of [Google Search], as a provider of content,
consisting in locating information published or included on the net by
third parties, indexing it automatically, storing it temporarily and
finally making it available to internet users according to a particular
order of preference, when that information contains personal data of
third parties: must an activity like the one described be interpreted as
falling within the concept of “processing of … data” used in
Article 2(b) of Directive 95/46?
(b) If
the answer to the foregoing question is affirmative, and once again in
relation to an activity like the one described:
must
Article 2(d) of Directive 95/46 be interpreted as meaning that the
undertaking managing [Google Search] is to be regarded as the
“controller” of the personal data contained in the web pages that it
indexes?
(c) In the event that the answer to the foregoing question is affirmative:
may
the [AEPD], protecting the rights embodied in [Article] 12(b) and
[subparagraph (a) of the first paragraph of Article 14] of Directive
95/46, directly impose on [Google Search] a requirement that it withdraw
from its indexes an item of information published by third parties,
without addressing itself in advance or simultaneously to the owner of
the web page on which that information is located?
(d) In the event that the answer to the foregoing question is affirmative:
would
the obligation of search engines to protect those rights be excluded
when the information that contains the personal data has been lawfully
published by third parties and is kept on the web page from which it
originates?
3. Regarding the
scope of the right of erasure and/or the right to object, in relation to
the “derecho al olvido” (the “right to be forgotten”), the following
question is asked:
must it be considered that
the rights to erasure and blocking of data, provided for in
Article 12(b), and the right to object, provided for by [subparagraph
(a) of the first paragraph of Article 14] of Directive 95/46, extend to
enabling the data subject to address himself to search engines in order
to prevent indexing of the information relating to him personally,
published on third parties’ web pages, invoking his wish that such
information should not be known to internet users when he considers that
it might be prejudicial to him or he wishes it to be consigned to
oblivion, even though the information in question has been lawfully
published by third parties?’
Consideration of the questions referred
Question 2(a) and (b), concerning the material scope of Directive 95/46
21 By
Question 2(a) and (b), which it is appropriate to examine first, the
referring court asks, in essence, whether Article 2(b) of Directive
95/46 is to be interpreted as meaning that the activity of a search
engine as a provider of content which consists in finding information
published or placed on the internet by third parties, indexing it
automatically, storing it temporarily and, finally, making it available
to internet users according to a particular order of preference must be
classified as ‘processing of personal data’ within the meaning of that
provision when that information contains personal data. If the answer is
in the affirmative, the referring court seeks to ascertain furthermore
whether Article 2(d) of Directive 95/46 is to be interpreted as meaning
that the operator of a search engine must be regarded as the
‘controller’ in respect of that processing of the personal data, within
the meaning of that provision.
22 According
to Google Spain and Google Inc., the activity of search engines cannot
be regarded as processing of the data which appear on third parties’ web
pages displayed in the list of search results, given that search
engines process all the information available on the internet without
effecting a selection between personal data and other information.
Furthermore, even if that activity must be classified as ‘data
processing’, the operator of a search engine cannot be regarded as a
‘controller’ in respect of that processing since it has no knowledge of
those data and does not exercise control over the data.
23 On
the other hand, Mr Costeja González, the Spanish, Italian, Austrian and
Polish Governments and the European Commission consider that that
activity quite clearly involves ‘data processing’ within the meaning of
Directive 95/46, which is distinct from the data processing by the
publishers of websites and pursues different objectives from such
processing. The operator of a search engine is the ‘controller’ in
respect of the data processing carried out by it since it is the
operator that determines the purposes and means of that processing.
24 In
the Greek Government’s submission, the activity in question constitutes
such ‘processing’, but inasmuch as search engines serve merely as
intermediaries, the undertakings which operate them cannot be regarded
as ‘controllers’, except where they store data in an ‘intermediate
memory’ or ‘cache memory’ for a period which exceeds that which is
technically necessary.
25 Article 2(b)
of Directive 95/46 defines ‘processing of personal data’ as ‘any
operation or set of operations which is performed upon personal data,
whether or not by automatic means, such as collection, recording,
organisation, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, blocking, erasure
or destruction’.
26 As
regards in particular the internet, the Court has already had occasion
to state that the operation of loading personal data on an internet page
must be considered to be such ‘processing’ within the meaning of
Article 2(b) of Directive 95/46 (see Case C‑101/01 Lindqvist EU:C:2003:596, paragraph 25).
27 So
far as concerns the activity at issue in the main proceedings, it is
not contested that the data found, indexed and stored by search engines
and made available to their users include information relating to
identified or identifiable natural persons and thus ‘personal data’
within the meaning of Article 2(a) of that directive.
28 Therefore,
it must be found that, in exploring the internet automatically,
constantly and systematically in search of the information which is
published there, the operator of a search engine ‘collects’ such data
which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the
framework of its indexing programmes, ‘stores’ on its servers and, as
the case may be, ‘discloses’ and ‘makes available’ to its users in the
form of lists of search results. As those operations are referred to
expressly and unconditionally in Article 2(b) of Directive 95/46, they
must be classified as ‘processing’ within the meaning of that provision,
regardless of the fact that the operator of the search engine also
carries out the same operations in respect of other types of information
and does not distinguish between the latter and the personal data.
29 Nor
is the foregoing finding affected by the fact that those data have
already been published on the internet and are not altered by the search
engine.
30 The
Court has already held that the operations referred to in Article 2(b)
of Directive 95/46 must also be classified as such processing where they
exclusively concern material that has already been published in
unaltered form in the media. It has indeed observed in that regard that a
general derogation from the application of Directive 95/46 in such a
case would largely deprive the directive of its effect (see, to this
effect, Case C‑73/07 Satakunnan Markkinapörssi and Satamedia EU:C:2008:727, paragraphs 48 and 49).
31 Furthermore,
it follows from the definition contained in Article 2(b) of Directive
95/46 that, whilst the alteration of personal data indeed constitutes
processing within the meaning of the directive, the other operations
which are mentioned there do not, on the other hand, in any way require
that the personal data be altered.
32 As
to the question whether the operator of a search engine must be
regarded as the ‘controller’ in respect of the processing of personal
data that is carried out by that engine in the context of an activity
such as that at issue in the main proceedings, it should be recalled
that Article 2(d) of Directive 95/46 defines ‘controller’ as ‘the
natural or legal person, public authority, agency or any other body
which alone or jointly with others determines the purposes and means of
the processing of personal data’.
33 It
is the search engine operator which determines the purposes and means
of that activity and thus of the processing of personal data that it
itself carries out within the framework of that activity and which must,
consequently, be regarded as the ‘controller’ in respect of that
processing pursuant to Article 2(d).
34 Furthermore,
it would be contrary not only to the clear wording of that provision
but also to its objective — which is to ensure, through a broad
definition of the concept of ‘controller’, effective and complete
protection of data subjects — to exclude the operator of a search engine
from that definition on the ground that it does not exercise control
over the personal data published on the web pages of third parties.
35 In
this connection, it should be pointed out that the processing of
personal data carried out in the context of the activity of a search
engine can be distinguished from and is additional to that carried out
by publishers of websites, consisting in loading those data on an
internet page.
36 Moreover,
it is undisputed that that activity of search engines plays a decisive
role in the overall dissemination of those data in that it renders the
latter accessible to any internet user making a search on the basis of
the data subject’s name, including to internet users who otherwise would
not have found the web page on which those data are published.
37 Also,
the organisation and aggregation of information published on the
internet that are effected by search engines with the aim of
facilitating their users’ access to that information may, when users
carry out their search on the basis of an individual’s name, result in
them obtaining through the list of results a structured overview of the
information relating to that individual that can be found on the
internet enabling them to establish a more or less detailed profile of
the data subject.
38 Inasmuch
as the activity of a search engine is therefore liable to affect
significantly, and additionally compared with that of the publishers of
websites, the fundamental rights to privacy and to the protection of
personal data, the operator of the search engine as the person
determining the purposes and means of that activity must ensure, within
the framework of its responsibilities, powers and capabilities, that the
activity meets the requirements of Directive 95/46 in order that the
guarantees laid down by the directive may have full effect and that
effective and complete protection of data subjects, in particular of
their right to privacy, may actually be achieved.
39 Finally,
the fact that publishers of websites have the option of indicating to
operators of search engines, by means in particular of exclusion
protocols such as ‘robot.txt’ or codes such as ‘noindex’ or ‘noarchive’,
that they wish specific information published on their site to be
wholly or partially excluded from the search engines’ automatic indexes
does not mean that, if publishers of websites do not so indicate, the
operator of a search engine is released from its responsibility for the
processing of personal data that it carries out in the context of the
engine’s activity.
40 That
fact does not alter the position that the purposes and means of that
processing are determined by the operator of the search engine.
Furthermore, even if that option for publishers of websites were to mean
that they determine the means of that processing jointly with that
operator, this finding would not remove any of the latter’s
responsibility as Article 2(d) of Directive 95/46 expressly provides
that that determination may be made ‘alone or jointly with others’.
41 It
follows from all the foregoing considerations that the answer to
Question 2(a) and (b) is that Article 2(b) and (d) of Directive 95/46
are to be interpreted as meaning that, first, the activity of a search
engine consisting in finding information published or placed on the
internet by third parties, indexing it automatically, storing it
temporarily and, finally, making it available to internet users
according to a particular order of preference must be classified as
‘processing of personal data’ within the meaning of Article 2(b) when
that information contains personal data and, second, the operator of the
search engine must be regarded as the ‘controller’ in respect of that
processing, within the meaning of Article 2(d).
Question 1(a) to (d), concerning the territorial scope of Directive 95/46
42 By
Question 1(a) to (d), the referring court seeks to establish whether it
is possible to apply the national legislation transposing Directive
95/46 in circumstances such as those at issue in the main proceedings.
43 In this respect, the referring court has established the following facts:
– Google
Search is offered worldwide through the website ‘www.google.com’. In
numerous States, a local version adapted to the national language
exists. The version of Google Search in Spanish is offered through the
website ‘www.google.es’, which has been registered since 16 September
2003. Google Search is one of the most used search engines in Spain.
– Google
Search is operated by Google Inc., which is the parent company of the
Google Group and has its seat in the United States.
– Google
Search indexes websites throughout the world, including websites
located in Spain. The information indexed by its ‘web crawlers’ or
robots, that is to say, computer programmes used to locate and sweep up
the content of web pages methodically and automatically, is stored
temporarily on servers whose State of location is unknown, that being
kept secret for reasons of competition.
– Google
Search does not merely give access to content hosted on the indexed
websites, but takes advantage of that activity and includes, in return
for payment, advertising associated with the internet users’ search
terms, for undertakings which wish to use that tool in order to offer
their goods or services to the internet users.
– The
Google group has recourse to its subsidiary Google Spain for promoting
the sale of advertising space generated on the website ‘www.google.com’.
Google Spain, which was established on 3 September 2003 and possesses
separate legal personality, has its seat in Madrid (Spain). Its
activities are targeted essentially at undertakings based in Spain,
acting as a commercial agent for the Google group in that Member State.
Its objects are to promote, facilitate and effect the sale of on-line
advertising products and services to third parties and the marketing of
that advertising.
– Google Inc.
designated Google Spain as the controller, in Spain, in respect of two
filing systems registered by Google Inc. with the AEPD; those filing
systems were intended to contain the personal data of the customers who
had concluded contracts for advertising services with Google Inc.
44 Specifically,
the main issues raised by the referring court concern the notion of
‘establishment’, within the meaning of Article 4(1)(a) of Directive
95/46, and of ‘use of equipment situated on the territory of the said
Member State’, within the meaning of Article 4(1)(c).
Question 1(a)
45 By
Question 1(a), the referring court asks, in essence, whether
Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that
processing of personal data is carried out in the context of the
activities of an establishment of the controller on the territory of a
Member State, within the meaning of that provision, when one or more of
the following three conditions are met:
– the
operator of a search engine sets up in a Member State a branch or
subsidiary which is intended to promote and sell advertising space
offered by that engine and which orientates its activity towards the
inhabitants of that Member State, or
– the
parent company designates a subsidiary located in that Member State as
its representative and controller for two specific filing systems which
relate to the data of customers who have contracted for advertising with
that undertaking, or
– the branch or
subsidiary established in a Member State forwards to the parent company,
located outside the European Union, requests and requirements addressed
to it both by data subjects and by the authorities with responsibility
for ensuring observation of the right to protection of personal data,
even where such collaboration is engaged in voluntarily.
46 So
far as concerns the first of those three conditions, the referring
court states that Google Search is operated and managed by Google Inc.
and that it has not been established that Google Spain carries out in
Spain an activity directly linked to the indexing or storage of
information or data contained on third parties’ websites. Nevertheless,
according to the referring court, the promotion and sale of advertising
space, which Google Spain attends to in respect of Spain, constitutes
the bulk of the Google group’s commercial activity and may be regarded
as closely linked to Google Search.
47 Mr
Costeja González, the Spanish, Italian, Austrian and Polish Governments
and the Commission submit that, in the light of the inextricable link
between the activity of the search engine operated by Google Inc. and
the activity of Google Spain, the latter must be regarded as an
establishment of the former and the processing of personal data is
carried out in context of the activities of that establishment. On the
other hand, according to Google Spain, Google Inc. and the Greek
Government, Article 4(1)(a) of Directive 95/46 is not applicable in the
case of the first of the three conditions listed by the referring court.
48 In
this regard, it is to be noted first of all that recital 19 in the
preamble to Directive 95/46 states that ‘establishment on the territory
of a Member State implies the effective and real exercise of activity
through stable arrangements’ and that ‘the legal form of such an
establishment, whether simply [a] branch or a subsidiary with a legal
personality, is not the determining factor’.
49 It
is not disputed that Google Spain engages in the effective and real
exercise of activity through stable arrangements in Spain. As it
moreover has separate legal personality, it constitutes a subsidiary of
Google Inc. on Spanish territory and, therefore, an ‘establishment’
within the meaning of Article 4(1)(a) of Directive 95/46.
50 In
order to satisfy the criterion laid down in that provision, it is also
necessary that the processing of personal data by the controller be
‘carried out in the context of the activities’ of an establishment of
the controller on the territory of a Member State.
51 Google
Spain and Google Inc. dispute that this is the case since the
processing of personal data at issue in the main proceedings is carried
out exclusively by Google Inc., which operates Google Search without any
intervention on the part of Google Spain; the latter’s activity is
limited to providing support to the Google group’s advertising activity
which is separate from its search engine service.
52 Nevertheless,
as the Spanish Government and the Commission in particular have pointed
out, Article 4(1)(a) of Directive 95/46 does not require the processing
of personal data in question to be carried out ‘by’ the establishment
concerned itself, but only that it be carried out ‘in the context of the
activities’ of the establishment.
53 Furthermore,
in the light of the objective of Directive 95/46 of ensuring effective
and complete protection of the fundamental rights and freedoms of
natural persons, and in particular their right to privacy, with respect
to the processing of personal data, those words cannot be interpreted
restrictively (see, by analogy, Case C‑324/09 L'Oréal and Others EU:C:2011:474, paragraphs 62 and 63).
54 It
is to be noted in this context that it is clear in particular from
recitals 18 to 20 in the preamble to Directive 95/46 and Article 4
thereof that the European Union legislature sought to prevent
individuals from being deprived of the protection guaranteed by the
directive and that protection from being circumvented, by prescribing a
particularly broad territorial scope.
55 In
the light of that objective of Directive 95/46 and of the wording of
Article 4(1)(a), it must be held that the processing of personal data
for the purposes of the service of a search engine such as Google
Search, which is operated by an undertaking that has its seat in a third
State but has an establishment in a Member State, is carried out ‘in
the context of the activities’ of that establishment if the latter is
intended to promote and sell, in that Member State, advertising space
offered by the search engine which serves to make the service offered by
that engine profitable.
56 In
such circumstances, the activities of the operator of the search engine
and those of its establishment situated in the Member State concerned
are inextricably linked since the activities relating to the advertising
space constitute the means of rendering the search engine at issue
economically profitable and that engine is, at the same time, the means
enabling those activities to be performed.
57 As
has been stated in paragraphs 26 to 28 of the present judgment, the
very display of personal data on a search results page constitutes
processing of such data. Since that display of results is accompanied,
on the same page, by the display of advertising linked to the search
terms, it is clear that the processing of personal data in question is
carried out in the context of the commercial and advertising activity of
the controller’s establishment on the territory of a Member State, in
this instance Spanish territory.
58 That
being so, it cannot be accepted that the processing of personal data
carried out for the purposes of the operation of the search engine
should escape the obligations and guarantees laid down by Directive
95/46, which would compromise the directive’s effectiveness and the
effective and complete protection of the fundamental rights and freedoms
of natural persons which the directive seeks to ensure (see, by
analogy, L'Oréal and Others EU:C:2011:474, paragraphs 62 and 63),
in particular their right to privacy, with respect to the processing of
personal data, a right to which the directive accords special
importance as is confirmed in particular by Article 1(1) thereof and
recitals 2 and 10 in its preamble (see, to this effect, Joined Cases
C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 70; Case C‑553/07 Rijkeboer EU:C:2009:293, paragraph 47; and Case C‑473/12 IPI EU:C:2013:715, paragraph 28 and the case-law cited).
59 Since
the first of the three conditions listed by the referring court
suffices by itself for it to be concluded that an establishment such as
Google Spain satisfies the criterion laid down in Article 4(1)(a) of
Directive 95/46, it is unnecessary to examine the other two conditions.
60 It
follows from the foregoing that the answer to Question 1(a) is that
Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that
processing of personal data is carried out in the context of the
activities of an establishment of the controller on the territory of a
Member State, within the meaning of that provision, when the operator of
a search engine sets up in a Member State a branch or subsidiary which
is intended to promote and sell advertising space offered by that engine
and which orientates its activity towards the inhabitants of that
Member State.
Question 1(b) to (d)
61 In view of the answer given to Question 1(a), there is no need to answer Question 1(b) to (d).
Question 2(c) and (d), concerning the extent of the responsibility of the operator of a search engine under Directive 95/46
62 By
Question 2(c) and (d), the referring court asks, in essence, whether
Article 12(b) and subparagraph (a) of the first paragraph of Article 14
of Directive 95/46 are to be interpreted as meaning that, in order to
comply with the rights laid down in those provisions, the operator of a
search engine is obliged to remove from the list of results displayed
following a search made on the basis of a person’s name links to web
pages, published by third parties and containing information relating to
that person, also in a case where that name or information is not
erased beforehand or simultaneously from those web pages, and even, as
the case may be, when its publication in itself on those pages is
lawful.
63 Google
Spain and Google Inc. submit that, by virtue of the principle of
proportionality, any request seeking the removal of information must be
addressed to the publisher of the website concerned because it is he who
takes the responsibility for making the information public, who is in a
position to appraise the lawfulness of that publication and who has
available to him the most effective and least restrictive means of
making the information inaccessible. Furthermore, to require the
operator of a search engine to withdraw information published on the
internet from its indexes would take insufficient account of the
fundamental rights of publishers of websites, of other internet users
and of that operator itself.
64 According
to the Austrian Government, a national supervisory authority may order
such an operator to erase information published by third parties from
its filing systems only if the data in question have been found
previously to be unlawful or incorrect or if the data subject has made a
successful objection to the publisher of the website on which that
information was published.
65 Mr
Costeja González, the Spanish, Italian and Polish Governments and the
Commission submit that the national authority may directly order the
operator of a search engine to withdraw from its indexes and
intermediate memory information containing personal data that has been
published by third parties, without having to approach beforehand or
simultaneously the publisher of the web page on which that information
appears. Furthermore, according to Mr Costeja González, the Spanish and
Italian Governments and the Commission, the fact that the information
has been published lawfully and that it still appears on the original
web page has no effect on the obligations of that operator under
Directive 95/46. On the other hand, according to the Polish Government
that fact is such as to release the operator from its obligations.
66 First
of all, it should be remembered that, as is apparent from Article 1 and
recital 10 in the preamble, Directive 95/46 seeks to ensure a high
level of protection of the fundamental rights and freedoms of natural
persons, in particular their right to privacy, with respect to the
processing of personal data (see, to this effect, IPI EU:C:2013:715, paragraph 28).
67 According
to recital 25 in the preamble to Directive 95/46, the principles of
protection laid down by the directive are reflected, on the one hand, in
the obligations imposed on persons responsible for processing, in
particular regarding data quality, technical security, notification to
the supervisory authority and the circumstances under which processing
can be carried out, and, on the other hand, in the rights conferred on
individuals whose data are the subject of processing to be informed that
processing is taking place, to consult the data, to request corrections
and even to object to processing in certain circumstances.
68 The
Court has already held that the provisions of Directive 95/46, in so
far as they govern the processing of personal data liable to infringe
fundamental freedoms, in particular the right to privacy, must
necessarily be interpreted in the light of fundamental rights, which,
according to settled case-law, form an integral part of the general
principles of law whose observance the Court ensures and which are now
set out in the Charter (see, in particular, Case C‑274/99 P Connolly v Commission EU:C:2001:127, paragraph 37, and Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 68).
69 Article 7
of the Charter guarantees the right to respect for private life, whilst
Article 8 of the Charter expressly proclaims the right to the
protection of personal data. Article 8(2) and (3) specify that such data
must be processed fairly for specified purposes and on the basis of the
consent of the person concerned or some other legitimate basis laid
down by law, that everyone has the right of access to data which have
been collected concerning him or her and the right to have the data
rectified, and that compliance with these rules is to be subject to
control by an independent authority. Those requirements are implemented
inter alia by Articles 6, 7, 12, 14 and 28 of Directive 95/46.
70 Article 12(b)
of Directive 95/46 provides that Member States are to guarantee every
data subject the right to obtain from the controller, as appropriate,
the rectification, erasure or blocking of data the processing of which
does not comply with the provisions of Directive 95/46, in particular
because of the incomplete or inaccurate nature of the data. As this
final point relating to the case where certain requirements referred to
in Article 6(1)(d) of Directive 95/46 are not observed is stated by way
of example and is not exhaustive, it follows that non-compliant nature
of the processing, which is capable of conferring upon the data subject
the right guaranteed in Article 12(b) of the directive, may also arise
from non-observance of the other conditions of lawfulness that are
imposed by the directive upon the processing of personal data.
71 In
this connection, it should be noted that, subject to the exceptions
permitted under Article 13 of Directive 95/46, all processing of
personal data must comply, first, with the principles relating to data
quality set out in Article 6 of the directive and, secondly, with one of
the criteria for making data processing legitimate listed in Article 7
of the directive (see Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 65; Joined Cases C‑468/10 and C‑469/10 ASNEF and FECEMD EU:C:2011:777, paragraph 26; and Case C‑342/12 Worten EU:C:2013:355, paragraph 33).
72 Under
Article 6 of Directive 95/46 and without prejudice to specific
provisions that the Member States may lay down in respect of processing
for historical, statistical or scientific purposes, the controller has
the task of ensuring that personal data are processed ‘fairly and
lawfully’, that they are ‘collected for specified, explicit and
legitimate purposes and not further processed in a way incompatible with
those purposes’, that they are ‘adequate, relevant and not excessive in
relation to the purposes for which they are collected and/or further
processed’, that they are ‘accurate and, where necessary, kept up to
date’ and, finally, that they are ‘kept in a form which permits
identification of data subjects for no longer than is necessary for the
purposes for which the data were collected or for which they are further
processed’. In this context, the controller must take every reasonable
step to ensure that data which do not meet the requirements of that
provision are erased or rectified.
73 As
regards legitimation, under Article 7 of Directive 95/46, of processing
such as that at issue in the main proceedings carried out by the
operator of a search engine, that processing is capable of being covered
by the ground in Article 7(f).
74 This
provision permits the processing of personal data where it is necessary
for the purposes of the legitimate interests pursued by the controller
or by the third party or parties to whom the data are disclosed, except
where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject — in particular his right to
privacy with respect to the processing of personal data — which require
protection under Article 1(1) of the directive. Application of
Article 7(f) thus necessitates a balancing of the opposing rights and
interests concerned, in the context of which account must be taken of
the significance of the data subject’s rights arising from Articles 7
and 8 of the Charter (see ASNEF and FECEMD, EU:C:2011:777, paragraphs 38 and 40).
75 Whilst
the question whether the processing complies with Articles 6 and 7(f)
of Directive 95/46 may be determined in the context of a request as
provided for in Article 12(b) of the directive, the data subject may, in
addition, rely in certain conditions on the right to object laid down
in subparagraph (a) of the first paragraph of Article 14 of the
directive.
76 Under
subparagraph (a) of the first paragraph of Article 14 of Directive
95/46, Member States are to grant the data subject the right, at least
in the cases referred to in Article 7(e) and (f) of the directive, to
object at any time on compelling legitimate grounds relating to his
particular situation to the processing of data relating to him, save
where otherwise provided by national legislation. The balancing to be
carried out under subparagraph (a) of the first paragraph of Article 14
thus enables account to be taken in a more specific manner of all the
circumstances surrounding the data subject’s particular situation. Where
there is a justified objection, the processing instigated by the
controller may no longer involve those data.
77 Requests
under Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46 may be addressed by the data subject
directly to the controller who must then duly examine their merits and,
as the case may be, end processing of the data in question. Where the
controller does not grant the request, the data subject may bring the
matter before the supervisory authority or the judicial authority so
that it carries out the necessary checks and orders the controller to
take specific measures accordingly.
78 In
this connection, it is to be noted that it is clear from Article 28(3)
and (4) of Directive 95/46 that each supervisory authority is to hear
claims lodged by any person concerning the protection of his rights and
freedoms in regard to the processing of personal data and that it has
investigative powers and effective powers of intervention enabling it to
order in particular the blocking, erasure or destruction of data or to
impose a temporary or definitive ban on such processing.
79 It
is in the light of those considerations that it is necessary to
interpret and apply the provisions of Directive 95/46 governing the data
subject’s rights when he lodges with the supervisory authority or
judicial authority a request such as that at issue in the main
proceedings.
80 It
must be pointed out at the outset that, as has been found in
paragraphs 36 to 38 of the present judgment, processing of personal
data, such as that at issue in the main proceedings, carried out by the
operator of a search engine is liable to affect significantly the
fundamental rights to privacy and to the protection of personal data
when the search by means of that engine is carried out on the basis of
an individual’s name, since that processing enables any internet user to
obtain through the list of results a structured overview of the
information relating to that individual that can be found on the
internet — information which potentially concerns a vast number of
aspects of his private life and which, without the search engine, could
not have been interconnected or could have been only with great
difficulty — and thereby to establish a more or less detailed profile of
him. Furthermore, the effect of the interference with those rights of
the data subject is heightened on account of the important role played
by the internet and search engines in modern society, which render the
information contained in such a list of results ubiquitous (see, to this
effect, Joined Cases C‑509/09 and C‑161/10 eDate Advertising and Others EU:C:2011:685, paragraph 45).
81 In
the light of the potential seriousness of that interference, it is
clear that it cannot be justified by merely the economic interest which
the operator of such an engine has in that processing. However, inasmuch
as the removal of links from the list of results could, depending on
the information at issue, have effects upon the legitimate interest of
internet users potentially interested in having access to that
information, in situations such as that at issue in the main proceedings
a fair balance should be sought in particular between that interest and
the data subject’s fundamental rights under Articles 7 and 8 of the
Charter. Whilst it is true that the data subject’s rights protected by
those articles also override, as a general rule, that interest of
internet users, that balance may however depend, in specific cases, on
the nature of the information in question and its sensitivity for the
data subject’s private life and on the interest of the public in having
that information, an interest which may vary, in particular, according
to the role played by the data subject in public life.
82 Following
the appraisal of the conditions for the application of Article 12(b)
and subparagraph (a) of the first paragraph of Article 14 of Directive
95/46 which is to be carried out when a request such as that at issue in
the main proceedings is lodged with it, the supervisory authority or
judicial authority may order the operator of the search engine to remove
from the list of results displayed following a search made on the basis
of a person’s name links to web pages published by third parties
containing information relating to that person, without an order to that
effect presupposing the previous or simultaneous removal of that name
and information — of the publisher’s own accord or following an order of
one of those authorities — from the web page on which they were
published.
83 As
has been established in paragraphs 35 to 38 of the present judgment,
inasmuch as the data processing carried out in the context of the
activity of a search engine can be distinguished from and is additional
to that carried out by publishers of websites and affects the data
subject’s fundamental rights additionally, the operator of the search
engine as the controller in respect of that processing must ensure,
within the framework of its responsibilities, powers and capabilities,
that that processing meets the requirements of Directive 95/46, in order
that the guarantees laid down by the directive may have full effect.
84 Given
the ease with which information published on a website can be
replicated on other sites and the fact that the persons responsible for
its publication are not always subject to European Union legislation,
effective and complete protection of data users could not be achieved if
the latter had to obtain first or in parallel the erasure of the
information relating to them from the publishers of websites.
85 Furthermore,
the processing by the publisher of a web page consisting in the
publication of information relating to an individual may, in some
circumstances, be carried out ‘solely for journalistic purposes’ and
thus benefit, by virtue of Article 9 of Directive 95/46, from
derogations from the requirements laid down by the directive, whereas
that does not appear to be so in the case of the processing carried out
by the operator of a search engine. It cannot therefore be ruled out
that in certain circumstances the data subject is capable of exercising
the rights referred to in Article 12(b) and subparagraph (a) of the
first paragraph of Article 14 of Directive 95/46 against that operator
but not against the publisher of the web page.
86 Finally,
it must be stated that not only does the ground, under Article 7 of
Directive 95/46, justifying the publication of a piece of personal data
on a website not necessarily coincide with that which is applicable to
the activity of search engines, but also, even where that is the case,
the outcome of the weighing of the interests at issue to be carried out
under Article 7(f) and subparagraph (a) of the first paragraph of
Article 14 of the directive may differ according to whether the
processing carried out by the operator of a search engine or that
carried out by the publisher of the web page is at issue, given that,
first, the legitimate interests justifying the processing may be
different and, second, the consequences of the processing for the data
subject, and in particular for his private life, are not necessarily the
same.
87 Indeed,
since the inclusion in the list of results, displayed following a
search made on the basis of a person’s name, of a web page and of the
information contained on it relating to that person makes access to that
information appreciably easier for any internet user making a search in
respect of the person concerned and may play a decisive role in the
dissemination of that information, it is liable to constitute a more
significant interference with the data subject’s fundamental right to
privacy than the publication on the web page.
88 In
the light of all the foregoing considerations, the answer to Question
2(c) and (d) is that Article 12(b) and subparagraph (a) of the first
paragraph of Article 14 of Directive 95/46 are to be interpreted as
meaning that, in order to comply with the rights laid down in those
provisions and in so far as the conditions laid down by those provisions
are in fact satisfied, the operator of a search engine is obliged to
remove from the list of results displayed following a search made on the
basis of a person’s name links to web pages, published by third parties
and containing information relating to that person, also in a case
where that name or information is not erased beforehand or
simultaneously from those web pages, and even, as the case may be, when
its publication in itself on those pages is lawful.
Question 3, concerning the scope of the data subject’s rights guaranteed by Directive 95/46
89 By
Question 3, the referring court asks, in essence, whether Article 12(b)
and subparagraph (a) of the first paragraph of Article 14 of Directive
95/46 are to be interpreted as enabling the data subject to require the
operator of a search engine to remove from the list of results displayed
following a search made on the basis of his name links to web pages
published lawfully by third parties and containing true information
relating to him, on the ground that that information may be prejudicial
to him or that he wishes it to be ‘forgotten’ after a certain time.
90 Google
Spain, Google Inc., the Greek, Austrian and Polish Governments and the
Commission consider that this question should be answered in the
negative. Google Spain, Google Inc., the Polish Government and the
Commission submit in this regard that Article 12(b) and subparagraph (a)
of the first paragraph of Article 14 of Directive 95/46 confer rights
upon data subjects only if the processing in question is incompatible
with the directive or on compelling legitimate grounds relating to their
particular situation, and not merely because they consider that that
processing may be prejudicial to them or they wish that the data being
processed sink into oblivion. The Greek and Austrian Governments submit
that the data subject must approach the publisher of the website
concerned.
91 According
to Mr Costeja González and the Spanish and Italian Governments, the
data subject may oppose the indexing by a search engine of personal data
relating to him where their dissemination through the search engine is
prejudicial to him and his fundamental rights to the protection of those
data and to privacy — which encompass the ‘right to be forgotten’ —
override the legitimate interests of the operator of the search engine
and the general interest in freedom of information.
92 As
regards Article 12(b) of Directive 95/46, the application of which is
subject to the condition that the processing of personal data be
incompatible with the directive, it should be recalled that, as has been
noted in paragraph 72 of the present judgment, such incompatibility may
result not only from the fact that such data are inaccurate but, in
particular, also from the fact that they are inadequate, irrelevant or
excessive in relation to the purposes of the processing, that they are
not kept up to date, or that they are kept for longer than is necessary
unless they are required to be kept for historical, statistical or
scientific purposes.
93 It
follows from those requirements, laid down in Article 6(1)(c) to (e) of
Directive 95/46, that even initially lawful processing of accurate data
may, in the course of time, become incompatible with the directive
where those data are no longer necessary in the light of the purposes
for which they were collected or processed. That is so in particular
where they appear to be inadequate, irrelevant or no longer relevant, or
excessive in relation to those purposes and in the light of the time
that has elapsed.
94 Therefore,
if it is found, following a request by the data subject pursuant to
Article 12(b) of Directive 95/46, that the inclusion in the list of
results displayed following a search made on the basis of his name of
the links to web pages published lawfully by third parties and
containing true information relating to him personally is, at this point
in time, incompatible with Article 6(1)(c) to (e) of the directive
because that information appears, having regard to all the circumstances
of the case, to be inadequate, irrelevant or no longer relevant, or
excessive in relation to the purposes of the processing at issue carried
out by the operator of the search engine, the information and links
concerned in the list of results must be erased.
95 So
far as concerns requests as provided for by Article 12(b) of Directive
95/46 founded on alleged non-compliance with the conditions laid down in
Article 7(f) of the directive and requests under subparagraph (a) of
the first paragraph of Article 14 of the directive, it must be pointed
out that in each case the processing of personal data must be authorised
under Article 7 for the entire period during which it is carried out.
96 In
the light of the foregoing, when appraising such requests made in order
to oppose processing such as that at issue in the main proceedings, it
should in particular be examined whether the data subject has a right
that the information relating to him personally should, at this point in
time, no longer be linked to his name by a list of results displayed
following a search made on the basis of his name. In this connection, it
must be pointed out that it is not necessary in order to find such a
right that the inclusion of the information in question in the list of
results causes prejudice to the data subject.
97 As
the data subject may, in the light of his fundamental rights under
Articles 7 and 8 of the Charter, request that the information in
question no longer be made available to the general public by its
inclusion in such a list of results, it should be held, as follows in
particular from paragraph 81 of the present judgment, that those rights
override, as a rule, not only the economic interest of the operator of
the search engine but also the interest of the general public in finding
that information upon a search relating to the data subject’s name.
However, that would not be the case if it appeared, for particular
reasons, such as the role played by the data subject in public life,
that the interference with his fundamental rights is justified by the
preponderant interest of the general public in having, on account of
inclusion in the list of results, access to the information in question.
98 As
regards a situation such as that at issue in the main proceedings,
which concerns the display, in the list of results that the internet
user obtains by making a search by means of Google Search on the basis
of the data subject’s name, of links to pages of the on-line archives of
a daily newspaper that contain announcements mentioning the data
subject’s name and relating to a real-estate auction connected with
attachment proceedings for the recovery of social security debts, it
should be held that, having regard to the sensitivity for the data
subject’s private life of the information contained in those
announcements and to the fact that its initial publication had taken
place 16 years earlier, the data subject establishes a right that that
information should no longer be linked to his name by means of such a
list. Accordingly, since in the case in point there do not appear to be
particular reasons substantiating a preponderant interest of the public
in having, in the context of such a search, access to that information, a
matter which is, however, for the referring court to establish, the
data subject may, by virtue of Article 12(b) and subparagraph (a) of the
first paragraph of Article 14 of Directive 95/46, require those links
to be removed from the list of results.
99 It
follows from the foregoing considerations that the answer to Question 3
is that Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46 are to be interpreted as meaning that,
when appraising the conditions for the application of those provisions,
it should inter alia be examined whether the data subject has a right
that the information in question relating to him personally should, at
this point in time, no longer be linked to his name by a list of results
displayed following a search made on the basis of his name, without it
being necessary in order to find such a right that the inclusion of the
information in question in that list causes prejudice to the data
subject. As the data subject may, in the light of his fundamental rights
under Articles 7 and 8 of the Charter, request that the information in
question no longer be made available to the general public on account of
its inclusion in such a list of results, those rights override, as a
rule, not only the economic interest of the operator of the search
engine but also the interest of the general public in having access to
that information upon a search relating to the data subject’s name.
However, that would not be the case if it appeared, for particular
reasons, such as the role played by the data subject in public life,
that the interference with his fundamental rights is justified by the
preponderant interest of the general public in having, on account of its
inclusion in the list of results, access to the information in
question.
Costs
100 Since
these proceedings are, for the parties to the main proceedings, a step
in the action pending before the referring court, the decision on costs
is a matter for that court. Costs incurred in submitting observations to
the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 2(b)
and (d) of Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of individuals with regard
to the processing of personal data and on the free movement of such data
are to be interpreted as meaning that, first, the activity of a search
engine consisting in finding information published or placed on the
internet by third parties, indexing it automatically, storing it
temporarily and, finally, making it available to internet users
according to a particular order of preference must be classified as
‘processing of personal data’ within the meaning of Article 2(b) when
that information contains personal data and, second, the operator of the
search engine must be regarded as the ‘controller’ in respect of that
processing, within the meaning of Article 2(d).
2. Article 4(1)(a)
of Directive 95/46 is to be interpreted as meaning that processing of
personal data is carried out in the context of the activities of an
establishment of the controller on the territory of a Member State,
within the meaning of that provision, when the operator of a search
engine sets up in a Member State a branch or subsidiary which is
intended to promote and sell advertising space offered by that engine
and which orientates its activity towards the inhabitants of that Member
State.
3. Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive 95/46
are to be interpreted as meaning that, in order to comply with the
rights laid down in those provisions and in so far as the conditions
laid down by those provisions are in fact satisfied, the operator of a
search engine is obliged to remove from the list of results displayed
following a search made on the basis of a person’s name links to web
pages, published by third parties and containing information relating to
that person, also in a case where that name or information is not
erased beforehand or simultaneously from those web pages, and even, as
the case may be, when its publication in itself on those pages is
lawful.
4. Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive 95/46
are to be interpreted as meaning that, when appraising the conditions
for the application of those provisions, it should inter alia be
examined whether the data subject has a right that the information in
question relating to him personally should, at this point in time, no
longer be linked to his name by a list of results displayed following a
search made on the basis of his name, without it being necessary in
order to find such a right that the inclusion of the information in
question in that list causes prejudice to the data subject. As the data
subject may, in the light of his fundamental rights under Articles 7 and
8 of the Charter, request that the information in question no longer be
made available to the general public on account of its inclusion in
such a list of results, those rights override, as a rule, not only the
economic interest of the operator of the search engine but also the
interest of the general public in having access to that information upon
a search relating to the data subject’s name. However, that would not
be the case if it appeared, for particular reasons, such as the role
played by the data subject in public life, that the interference with
his fundamental rights is justified by the preponderant interest of the
general public in having, on account of its inclusion in the list of
results, access to the information in question.
No comments:
Post a Comment