Google Spain: The “Right to Be Forgotten”—While the Past Remains Online

Case C-131/12 | Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González | Court of Justice of the European Union | Grand Chamber | 13 May 2014

Practice Takeaways: ① Search engines process personal data and act as controllers when they collect, index, organize, store, and display information about individuals. ② Lawful publication does not make every subsequent use lawful: search-engine processing is separate from the publisher’s processing and requires its own justification. ③ The “right to be forgotten” generally means delisting, not deletion: the source may remain online even when links must be removed from results generated by a search for the person’s name. ④ Accurate and initially lawful information may become inadequate, irrelevant or no longer relevant, or excessive over time. ⑤ A person seeking delisting does not need to prove specific harm, but personal preference alone does not require removal. ⑥ Delisting requires a case-specific balance that considers the information’s nature and sensitivity, the time elapsed, the individual’s role in public life, and the public’s interest in access. ⑦ Local commercial activities may bring related processing within EU law where the local establishment’s activities and the processing are inextricably linked.

Few data-protection decisions are as famous—or as frequently misunderstood—as Google Spain.

The case is commonly described as creating a “right to be forgotten.” But the Court of Justice of the European Union did not give individuals a general right to erase truthful information from the internet. The newspaper article at issue remained lawfully available in its online archive.

What the Court recognized was narrower and, in some respects, more consequential: a person may require a search engine to stop linking particular information to that person’s name when the continued association has become incompatible with data-protection law.

That distinction matters. Search engines do more than point toward information already online. By organizing material around a person’s name, they can assemble scattered publications into an accessible profile. The Court therefore treated the search engine’s indexing and presentation of personal data as a separate processing operation—one for which the search engine operator was responsible as a controller.

The result transformed the relationship between privacy, search, and public information. Information may remain lawfully published at its source while disappearing from the results generated by a name-based search.

The dispute behind the “right to be forgotten”

In 1998, the Spanish newspaper La Vanguardia published announcements concerning the forced sale of property arising from social-security debts. The announcements identified Mario Costeja González and were later included in the newspaper’s online archive.

More than a decade later, a Google search for Costeja González’s name continued to produce links to those announcements. He argued that the proceedings had long since been resolved and that the search results no longer accurately reflected his present circumstances.

Costeja González asked the newspaper to remove or alter the pages. He also asked Google Spain to remove the links from search results associated with his name. When those requests were unsuccessful, he complained to the Spanish Data Protection Agency—the Agencia Española de Protección de Datos, or AEPD.

The AEPD rejected the complaint against the newspaper because the original publication had been legally justified. But it upheld the complaint against Google and ordered Google Spain and Google Inc. to remove the links from results generated by searches for Costeja González’s name.

Google challenged that decision before Spain’s Audiencia Nacional, which referred a series of questions to the CJEU. Those questions concerned three foundational issues:

• whether a search engine processes personal data and acts as a controller;
• whether EU data-protection law applied to Google’s search activities; and
• whether an individual could require the removal of links to truthful and lawfully published information.

Key holdings

• The Court held that a search engine operator processes personal data when it finds information published online, indexes and stores that information, and presents it to users in an ordered list of results. Because the operator determines the purposes and means of that activity, it acts as a controller for that processing. (Judgment, paras. 25–41.)
• EU data-protection law applied because Google Spain was an establishment through which Google promoted and sold advertising in Spain. The search engine and advertising activities were “inextricably linked”: the advertising made the search engine economically profitable, while the search engine created the audience for the advertising. The processing was therefore carried out “in the context of the activities” of the Spanish establishment even though Google Inc. operated the search engine from outside Spain. (Judgment, paras. 42–60.)
• Finally, the Court held that a search engine may be required to remove links from results generated by a search for a person’s name where the continued association is incompatible with data-protection requirements. This may occur when the information has become inadequate, irrelevant or no longer relevant, or excessive in light of the purposes of the processing and the time that has elapsed. The information need not be false, unlawfully published, or demonstrably harmful. (Judgment, paras. 88–99.)

The Court’s analysis

1. Search engines process personal data

Google argued that its search engine processed information indiscriminately and did not distinguish personal data from other online content. It also emphasized that the information had already been published by third parties and was not altered by Google.

The Court found neither point decisive.

• A search engine systematically explores the internet, collects information, retrieves it, records and organizes it through indexing programs, stores it on servers, and makes it available to users in lists of results. Each of those activities falls within the broad definition of processing under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46/EC.) (Judgment, paras. 25–31.)
• The fact that the same operations are also performed on nonpersonal information does not place personal data outside the Directive. Nor does processing require the data to be changed. Collecting, organizing, storing, retrieving, and disclosing existing information remain processing even when the underlying material is reproduced without alteration. (Judgment, paras. 28–31.)

The Court also distinguished Google’s processing from the newspaper’s publication. The newspaper placed the information online. Google subsequently collected, indexed, organized, and presented that information through its search engine. Those were separate processing operations, serving different purposes and creating different consequences for the individual. (Judgment, paras. 35–38.)

Practice Tip: Republishing is not the only form of processing. A service may process personal data by collecting, organizing, indexing, ranking, combining, or making existing information easier to retrieve—even if it did not create or alter the underlying content.

2. The search engine operator is a controller

The Court next considered whether Google was a controller of the personal data appearing in its search results.

• A controller is the person or entity that determines the purposes and means of processing. The Court concluded that the search engine operator determines the purposes and means of the search activity and, therefore, of the personal-data processing performed through that activity. (Judgment, paras. 32–34.)
• Google did not escape that responsibility merely because it lacked control over what third-party publishers originally placed online. Its responsibility arose from the separate processing it performed through the search engine. Excluding search engines from the controller definition would have undermined the Directive’s objective of ensuring effective and complete protection of data subjects. (Judgment, paras. 33–41.)
• The Court focused particularly on the practical effect of name-based searches. Search engines collect and organize information that might otherwise remain dispersed across numerous sources. A search for a person’s name can produce a structured overview of that person’s activities and enable users to construct a detailed profile. Search engines therefore play a decisive role in disseminating personal data and can interfere with privacy more significantly than the original publication itself. (Judgment, paras. 35–38.)

Practice Tip: Control is assessed at the level of the relevant processing operation. An organization does not need to control the original collection or publication of information to be a controller of the distinct processing it performs using that information.

3. Google’s Spanish advertising subsidiary brought the processing within EU law

Google Search was operated by Google Inc., a company established in the United States. Google Spain did not operate the search engine or perform the indexing at issue. Its principal role was to promote and sell advertising associated with Google’s services in Spain.

• The Court nevertheless held that Google Spain was an establishment within the meaning of Article 4(1)(a) of Directive 95/46. It engaged in the effective and real exercise of activity through stable arrangements in Spain. The fact that it was a separately incorporated subsidiary did not prevent it from constituting an establishment of Google Inc. (Judgment, paras. 45–49.)

The more difficult question was whether Google Inc.’s processing was carried out “in the context of the activities” of that establishment.

• The Court emphasized that the Directive did not require the establishment itself to perform the processing. It was sufficient that the processing occurred in the context of the establishment’s activities. That language could not be interpreted restrictively where doing so would undermine the effective protection of fundamental rights. (Judgment, paras. 50–55.)
• Google Spain’s advertising activities and Google Inc.’s search engine were inextricably linked. Advertising supplied the revenue that made the search engine economically profitable, and the search engine supplied the audience and platform through which the advertising business operated. The processing was therefore carried out in the context of Google Spain’s activities, bringing it within the territorial scope of EU data-protection law. (Judgment, paras. 55–60.)

Practice Tip: Processing need not occur inside the local establishment. Under the Directive’s establishment test, the relevant question was whether the processing occurred in the context of the establishment’s activities—not whether the local entity technically performed the processing.

4. Search-engine processing is different from the original publication

A central insight of Google Spain is that the lawfulness of the original publication does not automatically determine the lawfulness of a search engine’s continued association of that publication with an individual’s name.

The Court identified several reasons for treating the two processing operations separately.

• First, the publisher and search engine may rely on different legitimate interests.
• Second, the original publication may qualify for protections or derogations applicable to journalism that do not apply in the same way to the search engine.
• Third, the effect on the individual is different. A name-based search makes information appreciably easier to find, connects it with other information, and can dramatically increase its dissemination

(Judgment, paras. 82–87.)

For those reasons, a supervisory authority or court may order a search engine to remove a link without first requiring the publisher to delete or modify the underlying webpage. The information can remain legally available in the newspaper’s archive while no longer appearing in results produced by a search for the individual’s name. (Judgment, paras. 82–88.)

This is not deletion from the internet. It is delisting from a particular pathway to the information.

Practice Tip: Analyze each processing activity separately. The fact that personal data may lawfully remain in a source document does not necessarily justify every subsequent use, aggregation, ranking, or method of distribution.

5. Lawful and accurate information can become incompatible with data-protection law over time

The Court then considered whether Costeja González could request delisting even though the newspaper announcements were accurate and had been lawfully published.

• Under Article 6 of Directive 95/46, personal data had to remain adequate, relevant, and not excessive in relation to the purposes for which they were processed. They also could not be retained longer than necessary for those purposes.
• The Court explained that processing which was initially lawful may become incompatible with those requirements over time. Accurate information may eventually become inadequate, irrelevant or no longer relevant, or excessive in light of the purpose of the processing and the period that has elapsed. (Judgment, paras. 92–94.)

The question was therefore not limited to whether the announcements had been true in 1998. It was whether, at the time of Costeja González’s request, Google could continue linking that information to his name in a manner consistent with the Directive.

• The Court concluded that the sensitivity of the information, combined with the 16 years that had elapsed since its publication, supported delisting. No particular reason appeared to establish an overriding public interest in continuing to make the announcements readily accessible through a search for Costeja González’s name. (Judgment, para. 98.)

6. The data subject did not have to prove prejudice

The Court also rejected the view that delisting required proof that the search results had caused the individual specific harm.

• A person could seek removal where the continued name-based association no longer complied with data-protection requirements. It was not necessary to establish that inclusion of the information in the results caused prejudice. (Judgment, paras. 96–99.)

That does not mean personal preference alone determines the outcome. A person cannot demand delisting merely because information is embarrassing or inconvenient. The request requires an assessment of the processing under the applicable data-protection principles and a balance among the competing rights and interests.

But demonstrable injury is not a threshold requirement.

7. The required balancing of rights

The Court recognized that delisting affects more than the search engine’s commercial interests. It also affects the interests of internet users in accessing information.

• Search results generated from a person’s name can interfere seriously with the rights to privacy and protection of personal data under Articles 7 and 8 of the Charter. The search engine’s economic interest alone cannot justify that interference. At the same time, removing links may affect the public’s legitimate interest in receiving information. A fair balance must therefore be struck. (Judgment, paras. 80–81.)

The data subject’s rights generally prevail over the search engine’s economic interest but they may not prevail against the public’s interest in finding information through a name-based search. The balance may shift where the public has a particularly strong interest in access—for example, because of the individual’s role in public life. Relevant considerations include:

• the nature of the information;
• its sensitivity for the individual’s private life;
• the time that has elapsed;
• the purposes served by continued name-based accessibility; and
• the individual’s role in public life.

(Judgment, paras. 81, 96–99.)

The decision established neither automatic delisting nor automatic preservation. It required a contextual assessment of the particular information, individual, and public interest involved.

Practice Tip: Delisting requests require a documented, case-specific assessment. Relevant factors include the accuracy and sensitivity of the information, its current relevance, the time elapsed, the data subject’s public role, and the public’s continuing interest in finding the information through a name-based search.

The Advocate General would have reached a different result

Advocate General Niilo Jääskinen agreed with the Court on territorial scope and on one important point of material scope: a search engine processes personal data when it retrieves, indexes, stores, and presents information appearing on third-party webpages. (Opinion, paras. 60–75, 138(1)–(2).)

• On territorial scope, the Advocate General’s position supported the AEPD’s ability to proceed in Spain rather than refer the matter to Ireland—but he did not specifically discuss imposing a fine. He concluded that Spanish data-protection law applied because Google Spain was an “establishment” through which Google promoted and sold advertising connected to the search engine in the Spanish market. The advertising activity financed the search service, so the Spanish establishment acted as a bridge between the search engine and the local advertising market. It did not matter that the technical processing occurred elsewhere or that Google’s European operations were partly coordinated through Ireland. Opinion, paras. 60–68 and conclusion 138(1).

But he disagreed sharply on controller status and the asserted right to delisting.

• The Advocate General viewed the search engine primarily as an intermediary. Because it did not determine the content placed on third-party webpages and could not realistically comply with all the obligations imposed on controllers with respect to that content, he concluded that it should not generally be treated as the controller of the personal data found on those pages. He would have recognized more limited responsibility where the search engine exercised actual control over its index—for example, by disregarding a publisher’s exclusion instructions or refusing to update cached content. (Opinion, paras. 76–100.)
• He also concluded that Articles 12(b) and 14(a) of Directive 95/46 did not create a general right to be forgotten. In his view, an individual’s subjective desire that truthful, lawfully published information no longer be found could not, by itself, constitute a compelling legitimate ground for suppressing the information. (Opinion, paras. 101–111.)
• The Advocate General was particularly concerned about requiring private search engine operators to balance privacy against freedom of expression and access to information on a case-by-case basis. He warned that such a system could lead either to automatic removal of disputed links or to an unmanageable volume of requests. It could also result in private censorship without adequate participation by the original publisher. (Opinion, paras. 120–137.)

The Court did not follow that approach. It treated the search engine’s organization and presentation of information as a distinct processing operation, classified the operator as the controller of that processing, and required individual balancing when a person requests delisting.

The disagreement exposes the central tension in the case: whether search engines merely locate information created by others or themselves create a new and independently significant use of personal data. The Court chose the latter view.

What the Court did—and did not—decide

The Court did hold that search engines process personal data when they collect, index, store, organize, and display information about identifiable individuals.

It did hold that the operator of a search engine is a controller of that distinct processing.

It did hold that lawfully published and accurate information may have to be removed from results generated by a search for a person’s name when continued association with that name has become incompatible with data-protection law.

And it did hold that the individual does not have to secure deletion from the original publisher—or prove specific prejudice—before seeking delisting from the search engine.

But the Court did not require the newspaper to delete or alter its archive.

It did not hold that the underlying information was false or unlawfully published.

It did not require Google to eliminate every route through which users could find the newspaper pages. The ruling concerned links displayed in response to searches conducted using Costeja González’s name.

And it did not establish an unconditional right to conceal accurate information. The individual’s rights must still be balanced against the public’s interest in access, particularly where the person plays a role in public life.

Google Spain Today

Google Spain was decided under the Data Protection Directive, before the GDPR created today’s express framework. Under the GDPR, a comparable request may involve both the right to object and the right to erasure. When processing is based on legitimate interests or a public task, Article 21(1) allows the individual to object based on their particular situation. The controller must then stop the processing unless it demonstrates compelling legitimate grounds that override the individual’s interests, rights and freedoms.

If the objection succeeds, Article 17(1)(c) provides a corresponding right to erasure. In the search-engine context, however, that analysis must still account for freedom of expression and information under Article 17(3)(a). This reflects the central principle of Google Spain: the individual need not prove specific harm, but delisting still requires a case-specific balance between privacy and data-protection rights and the public’s interest in accessing the information.

For more on the modern Article 21 framework, see What Is the “Right to Object” Under the GDPR? and What is the "Right to Erasure" (or "Right to be Forgotten") under the GDPR?

Conclusion

Google Spain did not create a right to rewrite history.

The newspaper’s lawful archive remained intact. What changed was the ease with which an old event could be retrieved, organized, and connected to an individual through a simple search for that person’s name.

That distinction was decisive. The Court recognized that search engines do not merely reproduce the internet as they find it. They transform scattered information into structured, accessible, and potentially permanent profiles. That transformation is itself processing, and the entity that determines how it occurs bears responsibility for it.

Practice Tip: Lawful publication at the source does not make every later use lawful. Organizations must ask not only whether the information was lawfully published, but whether its current processing, purpose, context and method of dissemination remain justified.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.

• Court of Justice of the European Union, Grand Chamber, Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, Judgment of 13 May 2014, ECLI:EU:C:2014:317.
• Opinion of Advocate General Niilo Jääskinen, Case C-131/12, delivered 25 June 2013, ECLI:EU:C:2013:424.

Useful reading from The de la Torre Review

• What Are “Legitimate Interests” Under the GDPR? — Explains the modern framework for balancing a controller’s or third party’s legitimate interests against the rights and interests of the data subject—the type of balancing that lies at the heart of Google Spain. Read the Article.
• What Is the “Right to Erasure” (or “Right to Be Forgotten”) Under the GDPR? — Explains the modern Article 17 framework for requesting deletion of personal data, including the grounds for erasure and the exceptions to the right. Read the Article.
• What Is the “Right to Object” Under the GDPR? — Explains when individuals may object to processing under Article 21 and when controllers must demonstrate compelling legitimate grounds to continue—the modern framework most closely related to the balancing required by Google Spain. Read the Article.
• CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List — Examines another dimension of individual control over personal data: what controllers must provide when a person exercises the right of access. Like Google Spain, CRIF emphasizes that data-protection rights must be interpreted so individuals can exercise them effectively, while preserving appropriate limits and the rights of others. Read the Article.
• Lindqvist: When a Personal Website Became a Data-Protection Case — Provides the foundation for the Court’s conclusion that placing personal data online constitutes processing, a principle Google Spain extended to the collection, indexing, storage, and presentation of online information by search engines. Read the Article.
• Satakunnan and Satamedia: Public Data Is Still Personal Data — Explains why information does not lose its status as personal data merely because it has already been published or made publicly available. Read the Article.
• Weltimmo: When One Representative May Create a Local Establishment — Develops the flexible concept of “establishment” applied in Google Spain. While Google Spain found that a Spanish advertising subsidiary connected Google’s search processing to the EU, Weltimmo confirmed that even minimal local activity may constitute an establishment when it reflects real and effective activity through stable arrangements. Read the Article.