Directive 95/46/EC is a forerunner to the GDPR. It contained some very important provisions pertaining to Right to be Forgotten which we spoke about in the previous article. It would be an injustice to speak about the Right to be Forgotten without mentioning the landmark judgment of Google Spain, SL v AEPD, Mario Costeja Gonzalez which was decided citing the provisions of Directive 95/46/EC by the Court of Justice of the European Union
Let us start by having a look at the background of the case:
An individual Mr. Mario Costeja Gonzalez filed a complaint with the Spanish Data Protection Agency namely the AEPD (Agencia Española de Protección de Datos) because there were reports related to him in a daily newspaper which would appear on Google search about an auction sale for the recovery of some debts.
Mr. Gonzalez objected to the appearance of his name linked to the auction since the debts had been cleared many years ago and were no longer relevant to him. He filed a complaint with the AEPD citing these very reasons requesting that the newspaper and Google remove these objectionable links.
Judgment:
It can be understood from the previous articles mentioned that all the privacy laws have been enacted keeping in mind the freedom of the data subjects and their right to exercise their fundamental rights. In this case too, the data subject i.e. Mr. Gonzalez won the case because after reviewing all the contents of Directive 95/46/EC it was held that the links to Mr. Gonzalez’s past must be removed from Google although the newspaper reports cannot be erased since they were in the form of a notice and were published for the knowledge of the public at large.
However, what makes this judgment so important? Many questions were answered in the judgment which are very integral to the Directive and gave clarity as to the way forward in terms of privacy.
Some of these questions were as follows:
- Whether Google Spain can be considered an establishment under the meaning of the Directive especially when it is focussed towards selling or advertising in the Member State?
- Can the activity of Google be considered as processing?
- Are search engines supposed to protect the rights of data subjects?
The court ruling made it amply clear that the activities of Google are considered as processing of personal data and shall also be a controller within the meaning of the Directive irrespective of Google Spain being a subsidiary established mainly for advertising purposes. Also, if a data subject puts in a request to remove his information from a search engine, it must be complied with since he/she has a right even under the Charter of the Fundamental Rights of the European Union under Article 8 to protect his/her personal data.
At the end of the day the rights of the data subject must override the economic interests of the data controller which was the situation in this case. The information pertaining to Mr. Gonzalez that was available on Google was not even important for the public to know. Hence, the CJEU once again upheld the dignity and privacy of the individual and made a large entity like Google to comply with its orders.
This case has found its rightful place in the GDPR in the form of the Right to be Forgotten.
Reference:
-https://curia.europa.eu
-https://ec.europa.eu
-https://gdpr-eu.com