1) The activities Google undertakes are covered by the Directive.
a) In compiling its search results Google undertakes activities which are expressly referred to in Art 2(b) of the Directive and are classified as data processing. These include collecting, retrieving, recording, organising, storing, disclosing and making available data. That Google does not alter the data and that it also carries out the same operations on other types on information not distinguishing between personal data and other information does not affect this classification.
b) Google determines the “purposes and means of the processing of personal data” which it carries out in compiling its search results. Thus it falls within the definition of “data controller” under Article 2 (d) of the Directive. The fact that it does not exercise control over the contents of the websites which it indexes does not stop it from being a data controller. The Directive envisages there being joint data controllers, and Google and the operator of the website in question may both be data controllers in relation to certain personal data.
2) The test under Article 4(1)(a) of the Directive is whether the processing is carried out “in the context of the activities of an establishment in the territory of a Member State”. It was not disputed that Google activities in Spain constituted an “establishment”. However, Google argued that the data processing did not take place within the EU. This did not matter, the court ruling that the activities of the search engine and those of its establishment situated in Spain which promotes and sells advertising space, were inextricably linked. The advertising activities rendered the search engine economically viable. Thus the processing took place “in the context of” Google’s establishment in Spain.
3) As it comes within the Directive, Google must comply with the rights laid down in its provisions, which includes the rights of data subjects to request that data which is inaccurate, irrelevant or has become irrelevant be removed by the data controller. This includes the personal data processed by search engines.
In assessing whether to do so, a balancing test must be carried out between the rights of the data subject (privacy, data protection), those of the data controller (economic interests) and the interests of internet users (being able to have access to the information, including the right to receive information under Art 10 ECHR). The processing of data by a search engine enables any internet user to access an array of information about a data subjects private life. The interference with the data subject’s rights may therefore be very serious. The economic interests of the search engine in processing the data will not outweigh the data subject’s rights. As a general rule the data subject’s rights will also outweigh those of the public, however, that balance may depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
The data subject may make the request for removal in the first instance to the data controller, and if not satisfied, may complain to the national data protection supervisory authority.
The obligation on the search engine data controller subsists independently of any obligation on the operator of the website where the information is displayed. As operators of websites may be based elsewhere in the world and not subject to the Directive, or may be able to avail themselves of an exemption (for example the exemption for journalistic purposes) the effective operation of the Directive could not be achieved if there was a need for the data subject to show a parallel obligation on the website operator.
If the personal data has become irrelevant, even if it was relevant and therefore lawful when it was first published the data subject may request its removal in accordance with the Directive. To this extent the data subject may exercise a right to have that information “forgotten”.