EU Data Protection law: a 'right to be forgotten'? - European Union Committee Contents


The factual background

7.  In March 2010 a Spanish national, Mr Costeja González, complained to the Spanish National Data Protection Agency (AEPD) that when his name was entered in the Google search engine the entries which first appeared were pages of the Barcelona newspaper La Vanguardia of 19 January and 9 March 1998 with an announcement mentioning a property of which he was joint owner in connection with attachment proceedings for the recovery of social security debts. He requested, first, that La Vanguardia be required either to remove or alter those pages so that the personal data relating to him no longer appeared, and secondly that Google should be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results. He stated that the attachment proceedings had been fully resolved for a number of years and that reference to them was now entirely irrelevant.

8.  This raises a point which we think worth emphasising. If information is inaccurate or incomplete, the data subject has a right to obtain from the data controller its rectification or erasure.[9] If information, though accurate, is on a website in breach of the criminal law—an example might be child pornography—the data controller has an obligation to remove the link to it. The same applies to data on a website which are defamatory or contravene civil rights; search engines constantly receive, and act on, requests to remove data which are allegedly in breach of copyright. In this case there was no suggestion that the information was inaccurate; and far from being illegal, the publication of the information by La Vanguardia took place on the order of the Spanish Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible. This case, and our inquiry, are concerned only with data which are lawfully on a website but which the data subject would prefer not to be easily available through a link to his or her name on a search engine.

9.  The AEPD rejected the complaint in so far as it related to La Vanguardia. However the complaint against Google was upheld. The AEPD considered that operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society. Google took the matter to the Audiencia Nacional (the Spanish High Court), which referred to the Court of Justice three questions on the interpretation of the Directive for preliminary ruling.

First question referred for preliminary ruling: territorial scope of the Directive

10.  The first question asked whether the territorial scope of the Directive extended to the activities of Google in Spain. Advocate General Jääskinen[10] advised that it did, and the Court followed his advice.[11] The reach of EU data protection legislation therefore extends to cover not only organisations in the EU but also those outside the EU which have operations in the EU—even where, as in the case of Google Spain SL, those operations do not include the processing of data. This was described by Morrison & Foerster, a global law firm with one of the largest privacy and data security practices in the world, as "a very broad interpretation of the Directive's territorial reach [which] has little basis in the current wording of Article 4.1".[12] We can see that this may raise problems for a global corporation like Google which operates in many jurisdictions outside the EU as well as within the EU, but it does not seem to us to cause difficulties for United Kingdom data protection law.

Second question: Is a search engine a data controller?

11.  In its second question the Spanish court sought a ruling on whether Google's activities as an internet search engine provider made them a "controller" of personal data on web pages published by third parties. The difficulty here, as the Advocate General pointed out, is that:

"When the Directive was adopted the World Wide Web had barely become a reality, and search engines were at their nascent stage. The provisions of the Directive simply do not take into account the fact that enormous masses of decentrally hosted electronic documents and files are accessible from anywhere on the globe and that their contents can be copied and analysed and disseminated by parties having no relation whatsoever to their authors or those who have uploaded them onto a host server connected to the internet."[13]

12.  A "controller" is defined by Article 2(d) of the Directive as "the natural or legal person … which alone or jointly with others determines the purposes and means of the processing of personal data". The Advocate General and the Court therefore had to decide whether that definition, drafted without any thought being given to search engines, could be stretched to include them. The Advocate General thought not. He argued that:

"the general scheme of the Directive … and the individual obligations it imposes on the controller are based on the idea of responsibility of the controller over the personal data processed in the sense that the controller is aware of the existence of a certain defined category of information amounting to personal data and the controller processes this data with some intention which relates to their processing as personal data."[14]

13.  The Court however differed. The judges thought:

"it would be contrary not only to the clear wording of that provision [Article 2(d)] but also to its objective—which is to ensure, through a broad definition of the concept of 'controller', effective and complete protection of data subjects—to exclude the operator of a search engine from that definition on the ground that it does not exercise control over the personal data published on the web pages of third parties."[15]

The Court therefore ruled that the operator of a search engine must be regarded as the "controller" of the personal data processed by the search engine.[16]

Third question: the right to be forgotten

14.  If the Court had followed the Advocate General's Opinion on the second question, the third question on the right to be forgotten would not have arisen, since the right to obtain rectification or erasure of data is available only as against the data controller.[17] But since the Court decided Google should be treated as a data controller, the third question had to be answered. It was summarised by the Court as asking whether the relevant provisions of the Directive should be interpreted "as enabling the data subject to require the operator of a search engine to remove from the list of results displayed following a search made on the basis of his name links to web pages published lawfully by third parties and containing true information relating to him, on the ground that that information may be prejudicial to him or that he wishes it to be 'forgotten' after a certain time."


15.  The expression 'right to be forgotten' is misleading. Information cannot be deliberately "forgotten". It cannot be "consigned to oblivion" (the expression used by the Spanish court in its request for a preliminary ruling).[18] The pages of La Vanguardia still exist in hard copy, and can immediately be accessed electronically by typing in the name of the co-owner of the property which was being auctioned. The information may have been published in other newspapers. It may well still be in the records of the Spanish courts and the Spanish ministry. It will, in theory, have become more difficult to find since those pages will no longer appear from a Google search for the name of the complainant, Mr Costeja González; in fact it is more prominent than ever since it appears on a large number of reports linked to the Court's judgment which, of course, do appear when his name is entered. It will also be accessible through search engines, like, which are not territorially subject to the Court's judgment. From the point of view of the data subject, the right to be forgotten is at best a right to make information less easily accessible; at worst, it may achieve the opposite of what was desired.

16.  The Minister described the expression as "an inaccurate and unhelpful gloss on what happened. There is no right to be forgotten."[19] All our other witnesses who addressed the issue agreed.


17.  Since he had concluded that Google were not a data controller, the Advocate General considered the third question otiose. He did however answer it in case the Court differed from him on the second question, as it did. He concluded that neither the Directive itself, nor the data protection guarantees enshrined in Article 8 of the European Convention on Human Rights and Article 7 of the Charter of Fundamental Rights (which is in substance identical), provided the data subject with a 'right to be forgotten'.[20] He added, in our view very pertinently:

"I would also discourage the Court from concluding that these conflicting interests could satisfactorily be balanced in individual cases on a case-by-case basis, with the judgment to be left to the internet search engine service provider. Such 'notice and take down procedures', if required by the Court, are likely either to lead to the automatic withdrawal of links to any objected contents or to an unmanageable number of requests handled by the most popular and important internet search engine service providers. … internet search engine service providers should not be saddled with such an obligation. This would entail an interference with the freedom of expression of the publisher of the web page, who would not enjoy adequate legal protection in such a situation, any unregulated 'notice and take down procedure' being a private matter between the data subject and the search engine service provider. It would amount to the censoring of his published content by a private party."[21]


18.  Article 6 of the Directive sets out the principles governing the collection and processing of data which the data controller must comply with.

Box 1: Article 6 of the Directive
1.  Member States shall provide that personal data must be:

(a)  processed fairly and lawfully

(b)  collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;

(c)  adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;

(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;

(e)  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.

2.  It shall be for the controller to ensure that paragraph 1 is complied with.

19.  Article 12 provides that: "Member States shall guarantee every data subject the right to obtain from the controller … (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data". The words "incomplete or inaccurate" are a reference back to the requirement in Article 6(1)(d) that the data controller should erase or rectify data "which are inaccurate or incomplete". There was no suggestion in the case before the Court that the data were either inaccurate or incomplete. But the Court, fastening on the words "in particular", held that the right to have data erased also extended to data which breached the requirement of Article 6(1)(c) that they should be "adequate, relevant and not excessive".[22] The critical passage reads as follows:

Box 2: Paragraph 94 of the judgment of the Court

Therefore, if it is found, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of the directive because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.


20.  Comments that we have seen suggest that the 'right to be forgotten' is widely thought to depend on a requirement that the information disclosed by the search engine must be prejudicial to the data subject, or at least must be thought by him to be prejudicial. The Spanish court's third question asked the Court of Justice to rule whether it was enough for the data subject to believe "that such information should not be known to internet users when he considers that it might be prejudicial to him".[23] The Court ruled that "it is not necessary in order to find such a right that the inclusion of the information in question in the list of results causes prejudice to the data subject." There is therefore a right to have information erased even if it is not in fact prejudicial to the data subject, nor even thought by him to be prejudicial; it is enough that the information "appears … to be inadequate, irrelevant … or excessive".


21.  The Court held that the right of the data subject to have information erased overrides "as a rule" the economic interest of the operator of the search engine but also the public interest in accessing the information by searching for the data subject's name.[24] The words "as a rule" introduce an important qualification: "However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question."

22.  We quoted in paragraph 17 the Advocate General's view that internet search engine service providers should not be saddled with the obligation of having to assess an unmanageable number of requests on a case by case basis. The consequence of the Court's ruling is that, not only will search engines have to assess such requests as against the requirements of the Directive, they will also, in every case in which they decide that the withdrawal of a link to a page is prima facie justified, have further to assess, against unknown criteria, whether there are "particular reasons, such as the role played by the data subject in public life" why the link should nevertheless not be withdrawn.

9   Directive, Article 6.1(d) Back

10   The Advocate General of the Court of Justice, like those in many Continental judicial systems, is an officer of the same standing as the judges but whose task is to issue to the Court an independent Opinion of his own on the issues, which the Court usually follows, though it not obliged to do so. Back

11   Advocate General's Opinion, paragraph 68; judgment of the Court, paragraph 60. Back

12   Written evidence from Morrison & Foerster (TRF005) Back

13   Opinion, paragraph 78 Back

14   Opinion, paragraph 82. Advocate General's italics Back

15   Judgment, paragraph 34 Back

16   Judgment, paragraph 41 Back

17   Directive, Article 12, opening words Back

18   The reference of course was in Spanish, where the relevant part of the reference reads: "o desea que sea olvidada". The English translation by the Court is perhaps more colourful than accurate. Back

19    Q28 (Simon Hughes MP) Back

20   Opinion, paragraphs 111, 136 Back

21   Opinion, paragraphs 133-134 Back

22   Judgment, paragraph 92 Back

23   Judgment, paragraph 20 Back

24   Judgment, paragraph 97 Back

previous page contents next page

© Parliamentary copyright 2014