On 14th March 2016, the Third Chamber of the Supreme Court (“SC”) dismissed the judgement dated 29th December 2014 of the Contentious – Administrative Chamber of the National Court. The SC, resolving various procedures of protection of rights (“right to be forgotten”), regarding which Google Spain should have proceeded with the exclusion of information regarding the declarants, thus impeding such information from being captured by the Google search engine, and pronouncing that Google Spain is not responsible for the “right to be forgotten”, and that only Google Inc. has the exclusive responsibility for determining the purposes, conditions and the means of processing the data at issue.
The Contentious – Administrative Chamber of the National Court rejected the objection to the resolutions from the Spanish Data Protection Agency (“AEPD”) by Google Spain, whereby the AEPD called upon said company, as representative in Spain of the American company operating the website www.blogspot.com, to adopt and carry out the “necessary procedures in accordance with the exclusion of the interested party’s personal data contained in the blogs subject of the current protection of rights.”
In this respect, in the judgement on 13th May 2014, the Lower Chamber of the Court of Justice of the European Unións (CJEU) rejected the argument of there being a lack of position as defendant on the part of Google Spain in the administrative procedure for the following two reasons:
(i) Google Spain has a shared responsiblity for the processing of personal data carried out within the framework of the internet search service offered by Google Inc. in respect of the business unit made up by both companies.
(ii) Google Spain has been acting as if it was responsible for data processing, both in the protection of rights proceedings followed before the AEPD and in other interventions before the Spanish Court.
Nonetheless, the Supreme Court considers that whoever is responsible for processing personal data should “guarantee that the data processing conforms with the principles and conditions of the regulatory policy and undertakes the relevant obligations before the interested party.”
As a consequence, the Supreme Court has declared the nullity of the decision made by the AEPD, under the argument that the manager of the search engine – in this case Google Inc.- should determine the purposes and the means of such activity and, thus, is responsible for the data processing.
Mika Otomo
Vilá Abogados
For more information, please contact:
8th April 2016
