Judging the Charter
The Charter in judicial practise with a special focus on the case of protection of refugees and asylum seekers
The case addresses to the so-called right to be forgotten. The CJEU held that a data subject may, in the light of his fundamental rights guaranteed by Article 7 and 8 of the Charter, request removal of certain data.
In 2010, the Spanish national Mario Costeja González lodged a complaint with the Spanish Data Protection Agency (AEPD) against La Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain) and against Google Spain and Google Inc.
Mr Costeja González contended that, when an internet user entered his name in the search engine of the Google group, the list of results would display links to two pages of La Vanguardia’s newspaper of 1998. Those pages contained an announcement for a real-estate auction organised following attachment proceedings for the recovery of social security debts owed by Mr Costeja González.
With that complaint, Mr Costeja González requested: (1) that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longerappeared) or to use certain tools made available by search engines in order to protect the data; and (2) that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia.
The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future.
Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the Court of Justice.
One set of questions referred to the CJEU concerned the right to be forgotten and whether such a right could be drawn from Directive 95/46. (para. 20)
Ruling (para. 99/100 (4)):
With regards to the right to have personal data removed, the CJEU held that the data subject may, in the light of his fundamental rights guaranteed by Article 7 and 8 of the Charter, request removal of the data in question.
Relevant analysis of the CJEU:
The CJEU firstly established that the aim of the directive is to ensure a high level of protection of the fundamental rights and freedoms, in particular so the right to privacy in respect to processing of personal data (para. 66). The CJEU also reiterated the necessity of interpreting the provisions of the directive in the light of fundamental rights, forming an integral part of the general principles of EU law, ensured by the CJEU and contained in the Charter (para. 68).
Article 7 (f) of the directive permits processing of personal data for purposes of the legitimate interests pursued by the controller (i.e. search engine operator), or by the third party or parties to whom the data are disclosed. This does not apply when such interests are overridden by the interests or fundaments rights and freedoms of the data subject, the right to privacy with respect to the processing of personal data in particular, which are protected by Article 1(1) of the directive. According to the Court, the application of Article 7(f) therefore contains a balancing between the opposing rights and interests, in which Article 7 and 8 of the Charter are to be taken into account (para. 74).
In this context, the Court pointed out that processing of personal data carried out by an operator enables any internet user to obtain a structured overview of the information relating to another individual by searching his/her name. The Court observed, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty. Internet users may thereby establish a more or less detailed profile of the person searched against. Furthermore, the effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous (para. 80).
In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing (para. 81)
The Court held that a fair balance should be sought between the interest of the internet user in having access to certain information and the data subject’s right to privacy and the right to protection of personal data. The Court held that, in general, the data subject’s rights override the interest of internet users. However, it also noted that this depends on: the nature of the information in question; its sensitivity for the data subject’s private life; the interest of the public in having that information- an interest which may vary according to the role played by the data subject in public life (para. 81).