Spain Sends Google Right to Forget Requests to USA

 

Google's Spanish affilliate, Google Spain, S.L., isn't subject to “right to be forgotten” data handling regulations because it isn't a data handler but an advertising service, the Spanish supreme court ruled.

In a 55-page decision released March 15, the court annulled Spanish Data Protection Agency's (AEPD) resolutions calling on Google Spain to exclude personal information captured by the search engine. The court ruled that Google Inc., not its Spanish affiliate, is the data handler and thus is subject to the data handling regulations.

The court overruled a 2014 ruling by the National Court's Administrative Litigation Division, which had rejected Google Spain's administrative appeal of AEPD resolutions from 2011 that demanded they uphold a data subject's right to removal of personal information appearing in search results.

“The Supreme Court says Google Spain doesn't have that data handling co-responsibility because it offers an advertising service that has nothing to do with the search engine—yet at the same time, data protection regulations and European regulations apply because it provides a service for the entity responsible for the data file established in the United States,” Efrén Santos, a partner at ICEF Consultores in Madrid, told Bloomberg BNA March 15.

The court said that an entity is considered responsible for data processing based on its “effective participation in the determination of the ends and means of processing” and that Google Spain carries out no activities characteristic of a data handler, according to a March 15 Judiciary Authority statement.

“Only Google Inc. is responsible for processing in that it exclusively determines the ends, conditions and means for the data processing in question,” the court stated, declaring “diverse” AEPD resolutions directed at Google Spain null because the national affiliate isn't “subject to the compliance with obligations established in those resolutions.”

‘Right to Be Forgotten' Intact

According to Santos, the ruling brings no major changes to the “right to be forgotten” policy but means that in any data protection case the AEPD will now have to “go up against the parent company.”

The court's ruling doesn't modify the “principles or weighting criteria” established by the European Court of Justice, but rather “clarifies that the recipient of requests must be Google Inc,” according to an AEPD March 15 statement.

The ECJ's landmark 2014 ruling (C-131/12) recognized EU data subjects' right to compel Internet search engines like Google to remove results linking to websites with personal information when their fundamental right to individual privacy outweighs the public's right to know.

Since May 2014, Google Inc. has maintained an online form in Spanish for data subjects to request removal of search results.

If Google Inc. rejects a data subject's request or the citizen disagrees with the company's response, the AEPD said they could continue to call on the Spanish agency to protect their rights as usual.

According to Santos, Spanish and European courts would still be able to hold Google Inc. accountable in administrative procedures without having to go through U.S. courts.

“On this matter of the right to be forgotten, both the Spanish Data Protection Agency and the agencies of EU member countries still have jurisdiction,” said Santos.

Recommended Reading :

* Supreme Court rejects claim to alter digital newspaper archives

* Google and Spain wrestle over EU privacy law