1.
KHO Powerpoint-pohja

2. THE RIGHT TO BE FORGOTTEN – Google Spain and Google v AEDP and Mario Costeja Gonzáles
EJTN ADMINISTRATIVE LAW PROJECT
JUDICIAL TRAINING ON DATA PROTECTION AND PRIVACY RIGHTS
LISBON, 23 and 24 March 2017
Dr. Niilo Jääskinen
Judge at the Supreme Administrative Court of Finland
Former Advocate General at the CJEU

3. 1. Legal background RBFG – “RIGHT TO BE FORGOTTEN”
Droit à l oublie (Right to oblivion) – personality right recognized in many jurisdictions
Right to erasure or deletion of PD (derived from Art 12 “Right to access” and Article 14 “right to object” of Directive 95/46 on on the protection of individuals with regard to the processing of personal data and on the free movement of such data)
Pre-internet era regulation of Data protection -> preparations of the DP regulation
Safe harbours regulation on On-line Service Providers – eCommerce Directive (Directive 2000/31)
KHO Powerpoint-pohja

4. 2. The Situation of Mr. Costeja
KHO Powerpoint-pohja

5. 3. The Google case at the CJEU
The preliminary reference by the Audienca nacional in February 2012 to the CJEU (Case C-131/12) with three groups of detailed preliminary questions:
1) The territorial scope of application of EU data protection rules. Was EU DP law applicable to Google?
2) The material scope of application with respect to search engine operators.(“processing of personal data”, “controller of the processing”)
3) The right to be forgotten and the issue whether a data subject can request that some or all search results concerning him are no longer accessible through the search engine.
AG Jääskinen’s Opinion on 25 June 2013
Judgment (ECLI:EU:C:2014:317) on 13 May 2014.
KHO Powerpoint-pohja

6. 4. Jurisdictional issue – did EU DP law apply to Google?
Google Inc. is a Californian company, Google Spain a marketing subsidiary with no data processing activities
Google Ireland has co-ordinated the group’s European activities.
Google has data centers at least in Belgium and Finland. The exact location of search engine functions (indexing and cache, crawlers) is not revealed.
The directive fixes applicable law and jurisdiction to the places of processing and equipment.
KHO Powerpoint-pohja

7. 4. Jurisdictional issue – did EU DP law apply to Google? (continued)
 Answer 2: “Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.”
= business model was decisive ►Spain had jurisdiction
KHO Powerpoint-pohja

8. 5. Was Google a data controller (regarding the PD on listed net pages)?
Court held that search engine operators are processing personal data in the sense of the directive.
They are to be considered as data controllers in the sense of the Data Protection Directive.
This also with respect of personal data appearing on the web pages (source pages) that the search engine processes for the purposes of its index.
KHO Powerpoint-pohja

9. 6. Was there a right to de-listing and its conditions?
The right for the data subject to require removal or erasure of his personal data becomes applicable in relation to the search engine operator even if the information remains accessible on the web page where it was published.
The search engine operator must remove from the search results initiated by using the data subject’s name as search term any links to pages if information relating to the data subject there is or has become inaccurate, inadequate, irrelevant or excessive.
KHO Powerpoint-pohja

10. 6. Was there a right to de-listing and its conditions? (continued)
This also applies to information that is truthful, accurate, legal and not prejudicial to the data subject.
The data subject’s rights generally override the Internet users’ right to information. However, in particular cases this latter right may have priority for special reasons such as the role played by the data subject in public life.
Such “right to be forgotten” can be exercised by requesting the search engine operator to remove the links.
If the search engine operator does not grant the request, the matter may be brought before a data protection supervisory authority or judicial authority.
KHO Powerpoint-pohja

11. 7. Google’s reaction Google has created a removal procedure.
The data subject can ask for the removal of links by filling a special form available on Google’s web site.
Removal requests are processed by Google staff in accordance with internal guidelines established by a new Advisory Council, which mostly includes members from outside of Google.
KHO Powerpoint-pohja

12. 7. Google’s reaction (continued)
Since May 2014 Google has
evaluated about URL addresses, i.e. web pages,
on the basis of about requests to remove the link connecting a person’s name to a certain web page. when it started?
(Source: Google’s most recent Transparency report of 1 March 2017)
KHO Powerpoint-pohja

13. 8. WP 29 guidelines
Working Party 29, established pursuant to Article 29 of Directive 95/46; adopted in November 2014 guidelines on the application of the Google judgment (WP /14). Their purpose was to unify the interpretations of the judgment by national data protection authorities.
There were not great divergences between these guidelines and the policy adopted by Google’s advisory committee.
Two major disagreements relate to geographic scope of delisting (European vs. world-wide) and whether the original publisher should be informed by search engine operator of delisting, a policy which Google had adopted.
KHO Powerpoint-pohja

14. 9. Google in EU national Courts
Data subject ►► controller ►► supervising authority and/or judicial authority (Google judgment p. 77)
In most cases the chain is DS ►► DPA ►► administrative court proceedings but can be DS ►► civil court
 It seems that the number of cases where data subjects have turned to DP authorities to overturn a decision by Google or other search engine operator are almost insignificant when compared to the number of cases decided by Google.
According to a net debate by ACA there are some pure delisting cases in Germany.  
In Finland there is an appeal pending at the SAC against a decision by the Helsinki Administrative Court.
The French Conseild d’État has made a preliminary reference on 24 February 2017.
KHO Powerpoint-pohja

15. 10. Was it worth? DucDucGo search engine (15.3.2017)
Link for “costeja + Vanguardia”:
hemeroteca.lavanguardia.com/preview/1998/01/19/pagina-23/ /pdf...
KHO Powerpoint-pohja