Google Spain SL v Agencia Espanola de Proteccion de Datos

Case C-131/122014Information Technology Law

Rule established

Individuals have a 'right to be forgotten': search engines must delist outdated or irrelevant personal information upon request (CJEU).

Facts

Mario Costeja González, a Spanish national, found that a Google search of his name returned links to a 1998 newspaper article about a real-estate auction connected to social security debt recovery proceedings
The debt had been fully resolved years earlier
He requested the newspaper (La Vanguardia) to remove the page and Google Spain to delist the results
The Spanish Data Protection Agency (AEPD) rejected the claim against the newspaper (lawful publication) but upheld it against Google
Google Spain and Google Inc appealed to the Audiencia Nacional, which referred questions to the CJEU

Issues

Whether Google's activity of indexing and displaying search results constitutes "processing of personal data" under Directive 95/46/EC
Whether Google qualifies as a "controller" of such data
Whether an individual can require a search engine to remove links to lawful but outdated or irrelevant personal information

Held

A search engine systematically collecting, indexing, storing, and making available personal data is "processing" under Article 2(b) of the Directive
Google is a "data controller" within the meaning of Article 2(d)
Data subjects have the right to request delisting where the information is inadequate, irrelevant, no longer relevant, or excessive in relation to the purpose
This right is not absolute; it must be balanced against the public interest (e.g., the data subject's role in public life)
The right operates against the search engine independently of whether the source publication itself is lawful

Ratio Decidendi

Search engines amplify the accessibility of personal data beyond what the original publication achieves. This amplification creates an independent processing activity with its own controller responsibility. The passage of time may render once-relevant data irrelevant, engaging the data subject's right to have links delisted. The balancing exercise weighs privacy against information access on a case-by-case basis.

How to use it in an exam

Foundational authority on the "right to be forgotten" in data protection law
Cite in IT Law questions on data controller liability, search engine regulation, and privacy vs. freedom of expression
Indian context: compare with KS Puttaswamy v. Union of India (2017) which recognized informational privacy as a fundamental right
Relevant for discussions on the GDPR's Article 17 (which codified this ruling)
Contrast with US First Amendment approach where delisting would face strict scrutiny

Source

Source: Case C-131/12

This is an educational summary, not the judgment itself. Cite the reported version in professional or academic work.

Cited in study notes

it-lawViolation of Privacy and Data ProtectionIndividuals have a 'right to be forgotten': search engines must delist outdated