Judgment
The Court of Justice of the European Union ruled that an Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties, upholding a right of erasure.[2][12]
The court considered the material scope of the Directive first. The court rejected Google's submission, supported by the Advocate General, that it could not be regarded as a data controller within the scope of the Data Protection Directive, adopting a literal interpretation of article 2(b), giving definitions and relying on Lindqvist.[13]
Regarding the territorial scope of the Directive, the court observed that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an 'establishment' within the meaning of the directive. The court rejected Google Inc.'s argument that it was not carrying out its data processing in Spain, holding that the promotion and selling of advertising space by its subsidiary Google Spain was sufficient to constitute processing within the meaning of the directive. To have ruled otherwise would have been to undermine the effectiveness of the directive and the fundamental rights and freedoms of individuals that the directive seeks to ensure. The court thus endorsed the Advocate General's view that Google Inc. and Google Spain should be treated as a single economic unit.[11]
Concerning the obligations and duties of the operator of a search engine, the court held that in the present case Article 7(f) of the directive, relating to legitimacy of processing, requires a balancing of the opposing rights and interests of the data subject (González) and the data controller (Google), taking into account the data subject's rights deriving from articles 7 (respect for private and family life) and 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union. Article 14(a) of the Directive, relating to the data subject's rights, allows the data subject, at least in the cases covered by articles 7(e) and 7(f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Article 12(b) of the directive, relating to the data subject's right of access to the data, allows the data subject to request erasure of the data. Such request may be made directly of the controller, who must then duly examine the merits of the request. If the request is not granted, the data subject may then direct the request to a supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.[14]
Regarding the question relating to the so-called right to be forgotten, the court noted that Google Spain, Google Inc., the Greek, Austrian and Polish governments and the European Commission considered that this question should be answered in the negative.[14] The court held, however, that the processing of data which is "inadequate, irrelevant or excessive" (i.e. not merely inaccurate) might also be incompatible with the directive.[14] In such cases, where the data is incompatible with the provisions of article 6(1)(e) to (f) of the directive, relating to data quality, the information and links in the list of the results must be erased.[14] It is not necessary that the information is prejudicial to the data subject.[14]
