On 15th October 2015 the Spanish Supreme Court handed down its first ruling on the so-called digital “right to be forgotten” in which it states that harmful information affecting individuals without public relevance should not be accessible to Internet search engines when the news has lost relevance over time.
The background of the case
The decision of the Court is based on the following facts: in the 1980s two people were involved in drug-trafficking and consumption. After being arrested, they were finally convicted for drug smuggling and imprisoned. A few years ago, after having served their sentence imposed for these facts and having remade their personal, family and professional life, they found out that by typing their names in the major Internet search engines (particularly, Google and Yahoo!), the news that once was published in a newspaper (El País) now appeared among the first search results, because such newspaper had digitized their library.
These people asked the newspaper to cease the processing of personal data on its website or to replace their names by initials, and to take the necessary technical measures so that the news website could not be indexed by the Internet search engines. The newspaper did not respond to these requests. Therefore, those affected filed a claim about protection of honour, personal privacy and protection of personal data.
It is important to clarify that the subject matter of the claim was not the publication of the news in the paper edition back in the eighties, but the processing of the applicants’ personal data –their full names were included in the source code of the newspaper’s website– which allows its indexing by Internet search engines.
The judgment: main findings
After considering that the action brought against the newspaper had not expired, the judgment states that the editor of a web page in which personal data is included is responsible for the processing of such data and must comply with the requirements of the principle of data quality. This principle requires that personal data subject to automated processing must be accurate, adequate, relevant and not excessive in relation to the scope and purpose for which it has been obtained.
In relation to the veracity of the information, the Court argues that the news is indeed true. Nevertheless, the problem lies in the possibility that such information may not meet the requirement of adequacy. Thus, the processing of personal data must not only comply with the principle of data quality at the time when it is collected and processed initially, but also throughout the time of processing.
Therefore, the judge ponders between the exercise of freedom of information offered by digital newspaper archives, and the respect for the rights to honour, personal privacy and personal data protection of the people affected by the information contained in those archives. In particular, one must take into consideration the potential grievance that the published information could entail for the personality rights and, on the other hand, the public interest resulting from such information being linked to the affected individuals’ personal data.
When public interest concurs and persons of public relevance are concerned –the Court says– it is justified that information linked to personal data and which is harmful for privacy and reputation can be processed automatically, although the facts have happened long time ago, as far as this information is accurate. Furthermore, the processing of personal data can also be considered justified when the concerned facts and its connection with those particular persons have a historic interest.
Finally the Court concludes that the principles of adequacy, relevance and proportionality are not respected in the processing of personal data carried out by the defendant newspaper: a simple query on an Internet search engine introducing the names allows indiscriminate access to information more than twenty years after the events occurred, causing disproportionate damage to those affected.
In short, the so-called digital “right to be forgotten” allows the affected, if they are not considered a public figure, to oppose against the processing of their personal data, when a simple query in a general Internet search engine (using their personal data as key words) makes information regarding events that took place long ago, and that is seriously harmful to their honour or personal privacy, permanently visible and of public knowledge.
Limits to the digital “right to be forgotten”
However, the Court’s decision states that the digital “right to be forgotten” does not allow every individual to build a tailored past, forcing web publishers or search engines managers to eliminate his personal data when it is related to events that are not considered positive. Nor does it justify that those who expose themselves publicly can demand that a curriculum is built to their liking, by deleting negative information from the Internet and positioning the results of Internet searches at their will, so that the most favourable occupy the top positions.
Finally, the judgment states that the right to protection of personal data justifies that those responsible for the newspaper digital archives should adopt technical measures, such as using robots.txt or no-index code instructions, so that the website which includes information of the digital archive in which the outdated and severely damaging information appears, cannot be indexed by Internet search engines. However, the Court refuses the removal of the complete names from the information contained in the archive, or that the personal data contained in the information cannot be indexed by the internal search engine of the archive, considering that these measures represent a disproportionate sacrifice of freedom of information.
Thus, the scope of the right to be forgotten is therefore limited: the information must remain hidden in the massive search engines but it may still be consulted entirely in the digital archive of the newspaper.
This article was co-drafted by Senior Associate Sofía Fontanals and Trainee Samara Schaar.
 Supreme Court Judgment 545/2015, of 15 October.
 Considered by the Court of Justice of the European Union in judgments of November 6th 2003 (Lindqvist case, Case C-101/01, paragraph 25), and May 13th 2014 (Google Spain S.L. against Spanish Data Protection Agency, Case C-131/12, paragraph 26).
 E.g. consultations through Internet search engines which index personal data available in newspaper digital archives.