Spanish National High Court and “the right to be forgotten”
April 24, 2015
Rubén Cabezas Vázquez
The Spanish National High Court (High Court) has recently made its first ruling based on the criteria set by the Court of Justice of the European Union (CJEU) in the Google Spain case.
Let us remember, briefly, that the CJEU judgment referred to appeals brought by Google Spain and Google Inc. against the decision of the Spanish Data Protection Authority requesting Google to withdraw the claimant’s personal data from the indexes of their search engine.
Based on the High Court’s ruling, the key points are as follows:
Google is a data controller within the meaning of Article 3(d) of the Spanish Data Protection Act (the Act) as Google has an establishment in Spain which processes personal data in the context of its activity as a search engine, meaning that the Act applies.
In relation to the fair balance of interests between the data protection rights, freedom of expression and access to information, according to the ruling, the fundamental rights to privacy prevail over the rights of internet users to have access to the personal information through the search engine when carrying out a search on the basis of the data subject’s name. This is because the original content is lawful and still available on the original website. Further, the data subject does not play a role in public life and is not a public figure.
Despite the fact that the original content was published for journalistic purposes, this alone did not provide a sufficient basis for refusing the data subject’s request in this case since the ruling clearly distinguishes between the legal basis for publication by the media and the legal basis for Google to organise search results based on a person's name. In addition, there was no requirement for the public authority to make the information publicly available or a legal obligation to make the content available on the original website.
The rights of the affected data subject also prevail over the economic interest of Google, in light of the potential seriousness of the impact of this processing on the fundamental rights to privacy and data protection.
It is appropriate to clarify that the webpage is still be accessible using any other search terms as the right only affects the results obtained on searches made when using the name of the data subject. The ruling does not suggest any requirement to completely delete the webpage from the indexes of the search engine.
The High Court also recognised that the data subject can request Google to de-list links to information related to a real-estate auction following proceedings for the recovery of social security debts hosted on a Spanish newspaper website in January and March 1998 because it affected his privacy, from the results of searches made against his name.
The High Court’s view was that the personal data was being made available for longer than is necessary for the purpose of the processing and was not reasonably current and therefore out-of-date and inaccurate.
The availability of the search result was also causing prejudice and had a disproportionately negative impact on the data subject. There was also no wider public interest in the availability of the information.
It follows from the High Court’s ruling that Google –and other generalist search engines- will assess future de-listing requests on a case-by-case basis using the criteria above.
 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos and Mario Costeja González” C-131/12.