## Facts

- In 1998, a Spanish newspaper published legally mandated notices concerning attachment and real-estate auction proceedings connected to Mario Costeja González’s social security debts.
- Years later, a search for Costeja’s name on Google returned results linking to the 1998 notices.
- Costeja asked the Spanish Data Protection Agency (AEPD) to require (1) the newspaper to remove or alter the pages and (2) Google to remove or conceal the links from name-based search results, asserting the information was resolved and no longer relevant.
- The AEPD rejected the complaint against the newspaper as legally justified but upheld the complaint against Google, treating the search engine as subject to data-protection obligations.
- Google Spain and Google Inc. challenged the AEPD decision in Spain’s Audiencia Nacional, which referred questions to the Court of Justice of the European Union concerning the EU Data Protection Directive’s scope, whether a search engine is a “controller,” and whether de-indexing can be required.

## Issues

1. Whether EU data-protection law applied to Google’s processing where the search engine operator was established outside the EU but had an EU subsidiary selling advertising linked to the search service.
2. Whether a search engine’s indexing and display of third-party web pages containing personal data constitutes “processing of personal data,” and whether the operator is a “controller” of that processing.
3. Whether a data subject may require a search engine to remove links shown in results for searches on the person’s name, even when the underlying web page lawfully publishes the information.
4. How to balance the data subject’s privacy and data-protection rights against the public’s interest in access to information and the search engine operator’s business interests.

## Decision

- The court held that EU data-protection law applied because the search engine processing was carried out in the context of activities of the operator’s establishment in the Member State; the local advertising activity was inextricably linked to the search service.
- The court held that a search engine’s crawling, indexing, temporary storage, and presentation of results is “processing of personal data” when the material contains personal data.
- The court held the search engine operator is a “controller” because it determines the purposes and means of that processing, even though it does not control the content on third-party websites.
- The court held that, under certain conditions, a data subject can require the search engine to remove links from name-based search results where the information is inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of processing, including in light of time elapsed.
- The court held that, as a rule, the data subject’s fundamental rights to privacy and data protection prevail over the operator’s economic interests and over the general public’s interest in name-based access, unless the person’s role in public life or other factors create a preponderant public interest in access.
- The court distinguished between the publisher and the search engine: lawful publication by the source site need not be erased, yet the search engine may still have to de-index links to that content.

## Legal Principles

- Territorial scope can be satisfied where non-EU processing is inseparably connected to the activities of an EU establishment that markets or sells advertising for the service to users in the Member State.
- Search engines “process” personal data by locating, indexing, storing, and making information available in an ordered results list.
- A search engine operator is a data “controller” for search-result processing because it determines the purposes and means of indexing and display.
- Data subjects may seek removal of links from name-based results when the linked information is inadequate, irrelevant or no longer relevant, or excessive relative to processing purposes, even if the source publication is lawful.
- De-indexing requires a rights balance that generally favors privacy and data protection, rebutted where a strong public interest justifies continued name-based accessibility, including where the data subject plays a role in public life.
- De-indexing affects discoverability through the search engine without necessarily requiring deletion of the underlying lawful publication.

## Conclusion

The court interpreted EU data-protection law to treat search engines as controllers subject to EU obligations, to extend the law’s reach where EU advertising activities are closely connected to search processing, and to permit data subjects to obtain de-indexing of certain name-based results when continued linkage is no longer justified, subject to a public-interest assessment.


Google Spain SL v. Agencia Española de Protección de Datos (AEPD), Case C-131/12, ECLI:EU:C:2014:317 (C.J.E.U. 2014)