Datonomy’s correspondents in Spain report on an important decision in the continuing saga of RTBF actions against Google.
On 14 March 2016, the Spanish Supreme Court (Tribunal Supremo) issued an important ruling in favor of Google Spain on the right to be forgotten. The judgment held that claims concerning the right to be forgotten should be submitted directly to Google Inc in the United States.
The Spanish Supreme Court’s decision
The Supreme Court considered that only Google Inc (headquartered in US) should be considered as a data controller, determining the purposes and means of the processing of personal data for Google Search. The Court considers that Google Spain is not involved in the processing of personal data necessary for the operation of the search engine (for instance, indexing or storing data from third-party websites), and therefore, it should not take over the claims brought by users seeking to exercise the right to be forgotten.
Background and earlier decisions
The dispute arose out of Case 725/2010 before the Spanish National High Court (Audiencia Nacional). In light of the famous 2014 ruling of the ECJ in Case C‑131/12 (often referred to as the Google Spain decision), the National High Court set out the criteria for deciding whether the right to be forgotten came into play. But in addition, the judgment contained also a number of new legal grounds imposing data controller obligations not only to Google Inc, but also on the Spanish establishment of Google.
In that case, Google Spain argued that Google Search is operated and managed by Google Inc only, and Google Spain does not carry out an activity directly linked to the indexing or storage of information or data contained on third parties’ websites. Google Spain activity is limited to the promotion and sale of advertising space, and therefore, cannot be considered as a data controller.
In the Google Spain case (link to full judgment here), the ECJ stated that “activities of the operator of the search engine [Google Inc] and those of its establishment situated in the Member State concerned [Google Spain] are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed”.
On this basis, the National High Court ruled that both Google Spain and Google Inc must be considered as joint controllers, arguing the following reasons:
- According to para. 55 to 57 of the ECJ’s ruling, Google Spain’s responsibilities arise under its business unit with Google Inc and the role of Google Spain (promotion and sale of advertising space) as an indispensable component for the effective operation of the search engine.
- In addition, on the grounds of the principle “venire contra factum proprium non valet”, the National Hight Court notes that Google Spain has been playing the role of data controller before the Spanish Data Protection Agency (AEPD) and the Spanish courts, raising reasonable expectations for third parties to consider Google Spain as a data controller.
In light of the above, and taking into consideration the Article 29 WP Opinion 1/2010 on the concepts of “controller” and “processor”, the National High Court considered that both, Google Inc and Google Spain were joint controllers.
So, where does the Supreme Court’s decision leave claimants?
Now, the Supreme Court rectifies the interpretation of the National High Court in relation to the ECJ’s ruling. In line with other EU Member States, the Supreme Court considers that only Google Inc should be considered as a data controller, rather than the local Google subsidiary.
The Supreme Court states that when the ECJ refers to the provision of search engine services within the framework of the activities of an establishment in a Member State (in this instance, Google Spain), it does so for ensuring the application of the European regulations and, therefore, the Spanish legislation on data protection, even though Google Inc is located outside the European Union. This does not mean that Google Spain carries out in Spain an activity directly linked to the indexing or storage of information or data contained on third parties’ websites, and most importantly, Google Spain does not determine the purposes and means of the processing of personal data for Google Search, a decision which falls to Google Inc.
This being the case, Google Inc is the responsible for taking over the claims brought against Google Spain by data subjects seeking to exercise the right to be forgotten.
In the aftermath of the Supreme Court decision, the Spanish Data Protection Agency (AEPD) has been quick to remind the public that, despite Supreme Court ruling, data subjects can exercise their rights to the same extent as before, but now the exclusive addressee for those claims should be Google Inc. Nevertheless, the judgment of the Supreme Court revokes the Spanish Data Protection Agency Decision of 19 January 2010 on the right to be forgotten and the judgment of the National High Court, raising doubts about many claims pending to be decided by other courts, where Google Spain has been considered to be a data controller. It remains to be seen whether Google Inc rather than local entities, would be regarded as data controller in other contexts, as the decision is restricted to RTBF claims relating to search. Datonomy will be monitoring the evolution of this growing area of data protection litigation.