ECJ i.S. Google Spain: “Right to be Forgotten” (13.5.2014, Case C‑131/12):
On the material scope of the Directive
28 By automatically, continuously and systematically scanning the Internet for the information published there, the search engine operator thus “collects” personal datawhich it then “reads out” with its indexing programs, “stores” and “organizes”, “stores” on its servers and, if necessary, “passes on” to its users in the form of lists of results and “makes available” to them. These operations are expressly and without limitation referred to in Article 2(b) of Directive 95/46, so that they must be classified as “processing” within the meaning of that provision, without it being relevant whether the search engine operator performs the same operations on other types of information and whether it distinguishes between that information and personal data.
38 The activity of a search engine may thus significantly affect the fundamental rights to respect for private life and protection of personal data, in addition to the activity of the publishers of websites; as the person who decides on the purposes and means of this activity, the search engine operator must therefore ensure, within the scope of its powers and possibilities, that the activity complies with the requirements of Directive 95/46, so that the guarantees provided for therein can be fully effective and effective and comprehensive protection of the data subjects, in particular their right to respect for their private life, can be effectively realized.
41 Consequently, the answer to Question 2(a) and (b) must be that Article 2(b) and (d) of Directive 95/46 must be interpreted as meaning that the activity of a search engine, which consists in finding information placed on the internet by third parties or published on the internet, automatically indexes that information, stores it temporarily and, finally, makes it available to internet users in a particular order of priority, provided that the information contains personal data, is to be classified as “processing of personal data” within the meaning of Art. 2 letter b of Directive 95/46 and that the operator of this search engine is to be considered as the “controller” of this processing within the meaning of Art. 2 letter d of Directive 95/46.
On the territorial scope of the Directive
52 As argued in particular by the Spanish government and the Commission, However, Art. 4(1)(a) of Directive 95/46 does not require that the processing of personal data at issue be “by” the branch concerned itself is executedbut only that hshe is carried out “within the framework of the activities” of the branch.
55 In the light of that objective of Directive 95/46 and the wording of Article 4(1)(a) thereof, it must be held that the processing of personal data carried out for the service of a search engine, such as Google Search, operated by an undertaking which is established in a non-member country but which has an establishment in a Member State, “carried out in the course of the activities” of that establishment, where the establishment has the task of promoting in the Member State the sale of the advertising space offered by the search engine with a view to making the service of the search engine profitable, and of ensuring that sale itself.
56 In such circumstances, the activities of the search engine operator and those of its establishment in the Member State concerned are in fact inextricably linkedsince the activities concerning the advertising spaces are the means to make the search engine in question economically viable and the search engine is, at the same time, the means that enables these activities to be carried out.
On the scope of the search engine operator’s responsibility
62 By Question 2(c) and (d), the referring court asks c and d, the referring court asks whether Articles 12(b) and 14(1)(a) of Directive 95/46 must be interpreted as meaning that, in order to safeguard the rights provided for in those provisions, the search engine operator is required to remove from the list of results displayed following a search carried out on the basis of a person’s name links to internet pages published by third parties and containing information relating to that person, even if the name or information on those internet pages is not deleted beforehand or at the same time and, where appropriate, even if their publication on the internet pages is lawful as such.
74 According to this provision, the Processing of personal data permissiblewhen they for the realization of the legitimate interestThe data controller or the third party or parties to whom the data are disclosed shall be required to carry out the processing, unless the interest or the fundamental rights and freedoms of the data subject are at stake., in particular, outweigh their right to privacy in the processing of personal data protected under Article 1(1) of the Directive. The application of Art. 7(f) of Directive 95/46 therefore requires a Weighing up the respective conflicting rights and interests, in the context of which the importance of the rights of the data subject deriving from Articles 7 and 8 of the Charter must be taken into account (see ASNEF and FECEMD, EU:C:2011:777, paras. 38 and 40).
80 As already stated in paragraphs 36 to 38 of the present judgment, processing of personal data carried out by a search engine operator, such as that at issue in the main proceedings, may significantly affect the fundamental rights to respect for private life and protection of personal datawhen the search is carried out with this search engine on the basis of the name of a natural person, since this processing allows any Internet user to obtain, with the list of results, a structured overview of the information to be found on the Internet about the person concerned, which potentially concerns numerous aspects of his or her private life and which, without the search engine in question, would not have been linked, or would have been linked only with great difficulty, and thus to create a more or less detailed profile of the person. Moreover, the effect of the interference with the aforementioned rights of the data subject is further increased by the significant role of the Internet and search engines in modern society increased, which give ubiquity to the information contained in a list of results (see in this sense judgment eDate Advertising and others, C‑509/09 and C‑161/10, EU:C:2011:685, para. 45).
81 Because of its potential severity, such interference cannot be justified solely on the basis of the search engine operator’s economic interest in processing the data. However, since the removal of links from the list of results may have an impact on the legitimate interest of Internet users potentially interested in accessing the information, depending on the information at issue, an appropriate balance must be struck in situations such as that in the main proceedings between, inter alia, that interest and the fundamental rights of the data subject under Articles 7 and 8 of the Charter. While the rights of the data subject protected by these articles generally outweigh the interest of the Internet user in; however, the balance may depend, in particular cases, on the nature of the information in question, its sensitivity to the private life of the person concerned, and the public’s interest in having access to the information, which may vary depending, among other things, on the role the person plays in public life.
84 In this respect, it should be noted that, since information published on a website can easily be reproduced on other websites and the persons responsible for the publication are not always subject to Union law, effective and comprehensive protection of the data subjects could not be achieved if they had to obtain the deletion of the information concerning them from the publishers of the websites beforehand or at the same time.
85 Moreover, processing carried out by the publisher of a website in the form of publication of information relating to a natural person may, where appropriate, be carried out “solely for journalistic … purposes”, so that it is subject to exemptions from the requirements of the Directive under Article 9 of Directive 95/46, whereas this is not the case for processing carried out by the operator of a search engine. Consequently, it cannot be ruled out that, in certain circumstances, the data subject may invoke the rights under Articles 12(b) and 14(1)(a) of Directive 95/46 against the search engine operator, but not against the publisher of the website.
86 Finally, it should be noted that the ground for admissibility under Article 7 of Directive 95/46 is not necessarily the same for the publication of personal data on a website as it is for the activities of search engines; even if that is the case, the assessment to be made under Article 7(f) and Article 14(1)(a) of the Directive may be The balance of interests will differ depending on whether the processing is carried out by the search engine operator or by the publisher of the website, since both the legitimate interests justifying the processing operations may be different and the consequences that the processing operations have for the data subject, in particular for his or her private life, are not necessarily the same.
87 The inclusion of an Internet site and the information it contains about a person in the list of results of a search conducted on the basis of the name of the person in question Namely, can significantly facilitate the accessibility of information for Internet users conducting a search on the person and play a decisive role in the dissemination of the information. It may therefore constitute a stronger encroachment on the fundamental right to respect for the private life of the person concerned than publication by the publisher of the website.
88 The answer to Question 2(c) and (d) must therefore be that Articles 12(b) and 14(1)(a) (c) and (d), the answer must be that Article 12(b) and Article 14(1)(a) of Directive 95/46 must be interpreted to that effect, that, in order to preserve the rights provided for in these provisions, if their conditions are met, the search engine operator is obliged to remove from the list of results displayed following a search performed on the basis of a person’s name links to websites published by third parties containing information on that person, even if the name or information on these Internet pages is not deleted before or at the same time and, if applicable, even if their publication on the Internet pages is lawful as such.
On the scope of the rights of the data subject
94 Thus, if, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, it is established that the inclusion of links to internet pages lawfully published by third parties and containing truthful information about him or her in the list of results displayed following a search carried out on the basis of his or her name, at the present time is not compatible with Art. 6 para. 1 lit. c to e of the Directivebecause it turns out that, in view of all the circumstances of the individual case, the information does not correspond to the purposes of the processing in question by the search engine operator, is not or no longer relevant for them, or goes beyond them, the relevant information and links of the result list must be deleted.
97 Since, in view of his fundamental rights under Articles 7 and 8 of the Charter, the data subject may request that the information concerned no longer be made available to the public at large by inclusion in such a list of results, it must be assumed, as is apparent in particular from paragraph 81 of the present judgment, that, in principle, these rights prevail not only over the economic interest of the search engine operator, but also over the interest of the general public in finding the information in a search conducted on the basis of the name of the data subject. However, this would not be the case if it were to be shown for special reasons – such as the role of the person concerned in public life – that the interference with the fundamental rights of that person is justified by the overriding interest of the public at large in having access to the information concerned through inclusion in such a list of results.
98 In a situation such as that at issue in the main proceedings, in which the list of results obtained by the internet user when he carries out a search using Google Search on the basis of the name of the person concerned includes links to pages of the online archive of a daily newspaper containing advertisements, which, mentioning the name of the data subject, refer to the auctioning of a property in connection with a seizure made for social security claims, it must be assumed that the data subject, because of the sensitivity of the information contained in these advertisements to his or her private life and because the original publication of the advertisements dates back 16 years, has a right to have this information no longer linked to his or her name by such a results list. Since, in the present case, there do not appear to be any special reasons justifying an overriding interest on the part of the public in having access to the information referred to in the context of a search based on the name of the person concerned – which, however, is a matter for the referring court to verify – the person may, under Articles 12(b) and 14(1)(a) of Directive 95/46, request that the links be removed from the list of results.
99 The answer to Question 3 must therefore be that Article 12(b) and Article 14(1)(a) of Directive 95/46 must be interpreted as meaning that, in the context of the assessment of the conditions for the application of those provisions, inter alia it must be examined whether the data subject has a right to have information about him or her no longer associated with his or her name at the present time by a list of results displayed following a search carried out on the basis of his or her name, it being understood that the establishment of such a right does not presuppose that the data subject suffers damage as a result of the inclusion of the information in question in the list of results. Since the data subject, in view of his or her fundamental rights under Articles 7 and 8 of the Charter, may request that the information in question no longer be made available to the public at large by inclusion in such a list of results, these rights are in principle outweighed not only by the economic interest of the search engine operator, but also by the interest of the public at large in having access to the information in a search carried out on the basis of the data subject’s name. However, this would not be the case if it were to be shown for special reasons – such as the role of the person concerned in public life – that the interference with the fundamental rights of this person is justified by the overriding interest of the general public in having access to the information concerned through inclusion in such a list of results.