Author: Simran Gulati

 1. Case Title, Citation & Bench  

• Case Title: Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos  (AEPD) & Mario Costeja González  

• Citation: Case C-131/12, Court of Justice of the European Union (CJEU), 2014  • Bench: Grand Chamber of the Court of Justice of the European Union  

2. Facts  

Mario Costeja González, a Spanish citizen, filed a complaint against a Spanish newspaper (La  Vanguardia) and Google. The newspaper had published an announcement in 1998 regarding the  auction of his property due to unpaid debts. Although the matter had long been resolved, the article  remained accessible online.  

When González searched his name on Google, links to this old newspaper notice appeared  prominently in the search results. He argued that this outdated information harmed his reputation  and violated his privacy.  

He approached:  

• The newspaper to remove or alter the content  

• Google Spain and Google Inc. to remove the links from search results  

The Spanish Data Protection Authority (AEPD):  

• Rejected the complaint against the newspaper (since publication was lawful)  • Upheld the complaint against Google, ordering it to remove the links  

Google challenged this decision before Spanish courts, which referred key questions to the CJEU. 

3. Issues  

1. Whether Google qualifies as a “data controller” under EU Data Protection Directive (95/46/ EC).  

2. Whether EU data protection law applies to Google’s operations, given that its servers were  outside the EU.  

3. Whether individuals have a right to request removal of search results linking to personal  information (i.e., the “Right to be Forgotten”).  

4. Whether privacy rights override public access to information.  

4. Arguments  

A. Arguments by Google  

• Not a Data Controller: 

Google argued it merely indexes information available on the internet and does not control  the content. Therefore, it should not be treated as a “data controller.”  

• No Obligation to Remove Links: 

It claimed responsibility lies with the original publisher (the newspaper), not the search  engine.  

• Freedom of Information: 

Google contended that removing links would restrict public access to lawful information and  undermine freedom of expression.  

• Jurisdiction Issue: 

Google argued that EU law should not apply because its data processing infrastructure was  located outside the EU. 

B. Arguments by AEPD & González  

• Google as Data Controller: 

They argued Google determines how personal data is collected, indexed, and displayed,  thereby exercising control over processing.  

• Privacy Protection: 

Individuals should have the right to control their personal data, especially when information  is outdated or irrelevant.  

• Harm to Reputation: 

Continued accessibility of obsolete data through search engines can cause disproportionate  harm.  

• Applicability of EU Law: 

Google Spain’s advertising operations created sufficient economic presence in the EU to  trigger jurisdiction.  

5. Judgment  

The Court of Justice of the European Union ruled:  

1. Google is a Data Controller 

Search engines process personal data and determine how it is presented; hence, they fall  within the definition of a data controller.  

2. EU Law Applies 

Even though Google’s servers were outside the EU, its subsidiary (Google Spain) promoted  advertising linked to the search engine, establishing sufficient connection.  

3. Recognition of the Right to be Forgotten 

Individuals have the right to request removal of links from search results if the information  is:  

◦ Inadequate 

◦ Irrelevant  

◦ No longer relevant  

◦ Excessive in relation to the purpose  

4. Balancing Test 

Privacy rights generally override public interest, except where:  

◦ The person is a public figure  

◦ There is a strong public interest in accessing the information  

6. Legal Reasoning & Personal Commentary  

A. Legal Reasoning  

The Court adopted an expansive interpretation of “data controller”, emphasizing functional  control rather than formal ownership of data. By indexing, organizing, and making information  searchable, Google plays an active role in processing personal data.  

The Court also highlighted the transformative power of search engines:  

• Information that is otherwise obscure becomes globally accessible  

• Search engines amplify the impact of personal data  

Thus, even lawful publication can become problematic when easily searchable decades later.  The judgment rests on three core principles:  

1. Data Protection as a Fundamental Right 

The Court recognized privacy under Articles 7 and 8 of the EU Charter of Fundamental  Rights.  

2. Contextual Relevance Over Time 

Information may be lawful at the time of publication but lose relevance over time. 

3. Proportionality and Balance 

The Court introduced a balancing test between:  

◦ Individual privacy rights  

◦ Public interest in access to information  

B. Personal Commentary  

This case is a watershed moment in technology and privacy law, fundamentally reshaping how  digital platforms handle personal data.  

Strengths of the Judgment: 

• It acknowledges the power imbalance between individuals and tech giants • It adapts legal principles to the realities of the digital age  

• It provides individuals with a meaningful remedy against reputational harm  

Concerns and Criticism: 

• The decision places a heavy burden on search engines to adjudicate privacy claims  • It risks over-removal of information, potentially affecting freedom of expression  • The lack of clear standards for “public interest” creates inconsistency  

Global Impact: 

• Inspired the General Data Protection Regulation (GDPR), especially Article 17  • Influenced jurisdictions worldwide, including India, where debates around the Right to be  Forgotten are ongoing (e.g., X v. Registrar General, Delhi High Court) 

Relevance in Today’s Context: 

With increasing digitization, individuals leave permanent digital footprints. This case recognizes  that:  

• People should not be perpetually judged by past actions  

• Technology must respect human dignity and autonomy  

However, the challenge remains in balancing privacy with transparency, especially in democratic  societies.  

Conclusion  

The Google Spain case established the Right to be Forgotten as a cornerstone of modern data  protection law. It marked a shift from viewing the internet as a neutral platform to recognizing the  active role of intermediaries like search engines.  

The judgment underscores a critical legal evolution: technology must operate within the  framework of fundamental rights, not outside it. While implementation challenges persist, the  case remains a foundational precedent in global technology jurisprudence.