Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González

Case Name: Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González

Case C-131/12, ECLI:EU:C:2014:317 (Court of Justice of the European Union, Grand Chamber, 13 May 2014)

K. Pranai Deepak Rao

Osmania University Post Graduate College of Law

Record of Law Batch (III), 2-Week Internship

1. Introduction

Google Spain v. AEPD and Costeja González is the landmark decision that gave legal force to the “right to be forgotten” in European Union data-protection jurisprudence. The case reconciled two fundamental rights protected by the EU Charter of Fundamental Rights: the right to privacy and data protection (Article 7) and the freedom of expression and information (Article 11). Its significance lies not only in interpreting Directive 95/46/EC (the Data Protection Directive) but also in establishing a procedural framework that obliges search-engine operators to consider, on a case-by-case basis, requests for removal of links to personal information that is “inadequate, irrelevant, no longer relevant or excessive.” The ruling reshaped the balance between individual privacy and the free flow of information on the internet, prompting subsequent legislative reform through the General Data Protection Regulation (GDPR) and a wave of national case law interpreting the right to be forgotten.

2. Facts of the Case

Mario Costeja González, a Spanish national, discovered in 2010 that a Google search for his name generated a link to a 1998 newspaper article published by the regional daily La Vanguardia. The article referred to a real-estate auction connected with attachment proceedings for the recovery of social security debts owed by Costeja. Although the underlying proceedings had been resolved years earlier and the information was no longer relevant to his present circumstances, the link remained accessible through Google’s search results, effectively reviving old data on the public internet.

Costeja filed a complaint with the Spanish Data Protection Agency (AEPD), invoking Directive 95/46/EC and requesting that Google remove the hyperlink to the newspaper article. The AEPD ruled in Costeja’s favour, ordering Google to delete the link from its index. Google Spain, together with Google Inc., appealed the order before the Spanish National Court (Audiencia Nacional), arguing that the Directive applied only to data controllers who determine the purposes and means of processing personal data, not to search-engine operators that merely index and provide links to third-party content. Google also invoked the primacy of the right to freedom of expression and the public interest in preserving access to lawfully published information.

The Spanish National Court referred several questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling, principally whether a search-engine operator is a “data controller” within the meaning of the Directive, and whether, if so, the Directive imposes an obligation to delink personal data upon request, balanced against the freedom of expression.

3. Legal Issues

1. Whether a search-engine operator qualifies as a “data controller” under Directive 95/46/EC, thereby falling within the scope of EU data-protection law.
2. Whether, assuming the operator is a data controller, the Directive requires the removal of hyperlinks to personal data that is “inadequate, irrelevant, no longer relevant or excessive,” and how this requirement must be balanced against the right to freedom of expression and information (Article 11, EU Charter).

4. Arguments Presented

4.1. Claimant (Costeja and AEPD)

• Scope of the Directive: The claimant maintained that the Directive’s definition of “processing” is broad, covering any operation performed on personal data, including the indexing of URLs and the retrieval of information from a publicly accessible web page. Consequently, Google Spain and Google Inc. qualify as a “data controller” for the purpose of the Directive.
• Balancing of Rights: The claimant argued that the Directive is silent on the precise balance between privacy and freedom of expression, but the EU Charter requires that any limitation on the latter be “provided for by law” and “respect the essence of the right.” The AEPD’s order, being a lawful measure grounded in the Directive, satisfies these requirements.
• Inadequacy of the Link: The newspaper article was more than a decade old, its content no longer reflected Costeja’s present circumstances, and the Google link was the primary means by which the personal data remained discoverable. Accordingly, the information met the threshold of being “inadequate, irrelevant, no longer relevant or excessive” under the Directive’s data-quality principles.

4.2. Respondent (Google Spain and Google Inc.)

• Narrow Interpretation of “Processing”: Google contested that the Directive applies only to controllers who determine the purposes and means of processing. Google’s role, it argued, is purely technical — cataloguing publicly available URLs at the request of users — making it a mere conduit rather than a data controller.
• Freedom of Expression: Google argued that the Directive must be interpreted consistently with the fundamental right to freedom of expression, which includes the public’s right to access information. A blanket obligation to delink, Google contended, would amount to a disproportionate restriction on that right.
• Jurisdictional Limits: Google Inc. is headquartered in the United States; imposing a duty to delink for EU users, it argued, would constitute an extraterritorial extension of EU law, raising concerns about territoriality.

5. Court’s Reasoning and Analysis

5.1. Google as a Data Controller

The Court examined the definition of “processing” in Article 2(b) and “controller” in Article 2(d) of Directive 95/46/EC. It held that the activity of a search engine — locating information published on the internet by third parties, indexing it automatically, and making it available to internet users according to a particular order of preference — must be classified as “processing of personal data” where that information contains personal data, and that the search-engine operator is the “controller” in respect of that processing. The Court rejected Google’s narrow “purely technical intermediary” argument, emphasising that the Directive’s aim is to ensure effective and complete protection of data subjects, regardless of whether the controller also processes the same data as part of the original publication.

5.2. Scope of the Right to Erasure under the Directive

The Court held that Articles 12(b) and 14(a) of the Directive, read in light of Articles 7 and 8 of the EU Charter, entitle a data subject to request that a search engine delink results relating to them where the underlying data is inadequate, irrelevant, no longer relevant, or excessive in relation to the purposes of the processing — even where the original publication of that data was itself lawful. The Court stressed that this right is not absolute: it must be weighed against the legitimate interest of internet users in having access to the information, and the balance may tip differently depending on factors such as the sensitivity of the data, the role played by the data subject in public life, and the passage of time.

The Court underscored that delinking does not erase the underlying information from the internet; it merely removes the link from search results generated on a search for the data subject’s name, thereby reducing the information’s visibility while leaving the original source unaffected — a proportionate limitation on freedom of expression rather than a form of censorship.

5.3. The Role of National Supervisory Authorities

The Court affirmed that national data-protection authorities and courts are competent to assess, on a case-by-case basis, whether a delinking request should be granted, and to order a search-engine operator to comply where the criteria are met, without requiring the data subject to first approach the original publisher of the information.

5.4. Territorial Scope

The Court held that the Directive applies where a search engine operator, though established outside the EU, has a subsidiary or establishment in a Member State that promotes and sells advertising space directed at residents of that state — as was the case with Google Spain’s relationship to Google Inc. On that basis, the processing carried out by the search engine was found to be carried out “in the context of the activities” of the EU establishment.

(The question of how far a delinking order can reach geographically — whether it must extend worldwide or only to EU domains — was not resolved in this judgment. It was addressed five years later by the Court in Google LLC v. Commission Nationale de l’Informatique et des Libertés (CNIL), Case C-507/17, ECLI:EU:C:2019:772 (24 September 2019), which held that EU law does not require global de-referencing, only de-referencing across the versions of the search engine corresponding to EU Member States.)

6. Judgment and Ratio Decidendi

The Court held that:

1. The operator of a search engine is a “controller” in respect of the processing of personal data that it carries out, within the meaning of Directive 95/46/EC.
2. Data subjects may, under Articles 12(b) and 14(a) of the Directive, request that such links be removed from the list of results displayed following a search on their name, where the linked information is inadequate, irrelevant, no longer relevant, or excessive — even absent any inaccuracy and even where the original publication was itself lawful.
3. This right must be balanced, on a case-by-case basis, against the legitimate interest of internet users and the general public in access to information, giving due weight to the data subject’s role in public life.

Ratio decidendi: Where a search engine, acting as a data controller established or operating within the EU, indexes personal data that has become inadequate, irrelevant, no longer relevant, or excessive, the data subject may require the operator to delink the corresponding search results, subject to a proportionality assessment weighing the data subject’s rights under Articles 7 and 8 of the EU Charter against the public’s right to information under Article 11.

The Court directed that the national courts apply this framework to Costeja’s specific request, upholding the AEPD’s order that Google remove the disputed links.

7. Critical Analysis

7.1. Significance of the Decision

Costeja marks the first judicial articulation of the “right to be forgotten” in EU law. By classifying search-engine operators as data controllers, the Court brought major information intermediaries squarely within the scope of EU data-protection law, regardless of where they are headquartered, so long as they have a relevant EU establishment. The ruling catalysed the GDPR (Regulation (EU) 2016/679), which codified a structured right to erasure in Article 17. It also established proportionality as the central methodological tool for reconciling privacy with freedom of expression in the digital context — a framework subsequent cases have continued to apply and refine.

7.2. Implications and Impact

Legal Impact: The judgment has been cited extensively in subsequent EU and national case law, including Google LLC v. CNIL, C-507/17 (2019), on the territorial scope of delinking, and in the English High Court’s decision in NT1 & NT2 v. Google LLC, [2018] EWHC 799 (QB), which applied and refined the balancing test at the national level. It has shaped the approach of data-protection authorities across Member States and influenced privacy debates well beyond the EU.

Practical Impact: Search-engine providers instituted formal delisting procedures, public-facing request portals, and internal review processes to balance privacy claims against public interest, generating a substantial and ongoing compliance burden.

Policy Impact: Commentators and legislators have grappled with the judgment’s potential “chilling effect” on journalism and historical research. The Court’s insistence on case-by-case proportionality has been praised for avoiding a blanket rule, but critics argue that the absence of a bright-line test creates legal uncertainty.

7.3. Critical Evaluation

Strengths:

• The Court’s reasoning is principled, anchored in the Charter, and avoids a blanket prohibition on either right.
• By empowering national authorities and courts to apply the test contextually, the decision preserves flexibility across differing national legal traditions.
• The proportionality test balances competing rights without categorically privileging one over the other.

Weaknesses:

• The ambiguity surrounding what qualifies as “inadequate,” “irrelevant,” or “excessive” has led to inconsistent outcomes across Member States.
• The framework places the practical burden on individuals to identify and justify removal of specific links, which can be costly and technically demanding.
• Later disputes over territorial reach exposed real tension between EU privacy law and the interests of non-EU jurisdictions in preserving access to lawfully published information.

Potential Alternatives:

• A more clearly codified right, of the kind later introduced via GDPR Article 17, provides somewhat greater predictability than the Directive-era standard.
• A tiered approach distinguishing private individuals from public figures more explicitly could reduce inconsistency in outcomes.
• Clearer procedural guidance on judicial review of delisting refusals could reduce arbitrariness in how requests are handled.

8. Conclusion

Google Spain v. AEPD and Costeja González fundamentally reshaped EU privacy jurisprudence by establishing that search-engine operators are data controllers bound by the Data Protection Directive and, subsequently, the GDPR. The Court’s ratio — that personal data which is inadequate, irrelevant, no longer relevant, or excessive must be delinked upon a lawful, proportionate request — forms the cornerstone of the right to be forgotten. The decision balances the right to privacy against freedom of expression through a flexible, case-by-case framework that has been widely adopted and, in equal measure, contested. While the ruling has driven legislative reform and heightened awareness of digital privacy, its inherent ambiguities continue to occupy courts, regulators, and platforms. Later decisions, including Google v. CNIL on territorial scope, illustrate how litigation continues to refine the boundaries first drawn in this judgment.

Select Reference(S):

Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, Case C-131/12, ECLI:EU:C:2014:317 (13 May 2014).

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, 1995 O.J. (L 281) 31.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), 2016 O.J. (L 119) 1.

Charter of Fundamental Rights of the European Union, arts. 7, 8, 11 (2012).

Google LLC v. Commission Nationale de l’Informatique et des Libertés (CNIL), Case C-507/17, ECLI:EU:C:2019:772 (24 September 2019).

NT1 & NT2 v. Google LLC, [2018] EWHC 799 (QB).