Case C‑131/12

Google Spain SL

and

Google Inc.

v

Agencia Española de Protección de Datos (AEPD)

and

Mario Costeja González

(Request for a preliminary ruling from the Audiencia Nacional)

‛Personal data — Protection of individuals with regard to the processing of such data — Directive 95/46/EC — Articles 2, 4, 12 and 14 — Material and territorial scope — Internet search engines — Processing of data contained on websites — Searching for, indexing and storage of such data — Responsibility of the operator of the search engine — Establishment on the territory of a Member State — Extent of that operator’s obligations and of the data subject’s rights — Charter of Fundamental Rights of the European Union — Articles 7 and 8’

Summary — Judgment of the Court (Grand Chamber), 13 May 2014

Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to personal data and right to object to the processing thereof — Search made by means of a search engine on the basis of a person’s name — Display of a list of results — Right to request that that information no longer be made available to the general public

Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to personal data and right to object to the processing thereof — Right to request the removal of links to web pages from the list of results — Conditions

Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Article 4 — National law applicable — Processing of data in the context of the activities of the establishment set up on the territory of a Member State by an operator of a search engine — Scope — Promotion and sale by means of that establishment of the advertising space directed at the inhabitants of that Member State which is offered by the engine — Included

Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Observance of fundamental rights — Privacy and the protection of personal data — Fair balance between the right to information and the rights guaranteed by the Charter of Fundamental Rights of the European Union

Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Article 2 — Processing of personal data — Definition — Activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it, storing it and making it available to internet users — Included — Controller — Definition — Operator of a search engine — Included

Article 2(b) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as processing of personal data when that information contains personal data. This interpretation is not affected by the fact that the data have already been published on the internet and are not altered by the search engine. The operations referred to in that provision must also be classified as such processing where they exclusively concern material that has already been published in unaltered form in the media. Furthermore, the operator of a search engine must be regarded as the controller in respect of that processing of personal data, within the meaning of Article 2(d) of Directive 95/46. Inasmuch as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved. (see paras 29, 30, 38, 41, operative part 1)

Processing of personal data carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. That is all the more the case because the internet and search engines render the information contained in such a list of results ubiquitous. In the light of its potential seriousness, that interference cannot be justified by merely the economic interest which the operator of such an engine has in that processing. A fair balance must be sought in particular between the legitimate interest of internet users in access to information and the data subject’s fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. (see paras 36, 38, 80, 81, 97)

Article 4(1)(a) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State. In such circumstances, the activities of the operator of the search engine and those of its establishment situated in a Member State, although separate, are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed. (see paras 51, 55, 56, 60, operative part 2)

Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. Since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, the data processing carried out by the operator of a search engine is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page. (see paras 87, 88, operative part 3)