Right to be forgotten requests in Spain shall be directed to Google Inc.
In Spain citizens may claim before the Spanish Data Protection Agency if requests to exercise their data protection rights (right to access, cancel, erasure and objection) have not been correctly complied by data controllers. Following these claims, the Spanish DPA would analyse if such rights were correctly observed in a specific procedure ("procedimiento de tutela de derechos").
Right to be be forgotten
In the context such specific procedures, the Spanish DPA considered that Google Spain S.L. shall honour complains based on the right to be forgotten raised by Spanish citizens and remove the information related to complainers from search results.
In its rule of 14th March 2016 the Spanish Supreme Court has adopted a contrary approach and has nullified the mentioned resolutions issued by the Spanish DPA, arguing the following:
- The obligation to guarantee that processing operations comply with data protection principles and rights of data subjects are protected relies on data controllers.
- The role of the data controller, as opposed to other third parties, is defined by the effective participation in the definition of the purposes and means of processing.
- In this particular case, indexing search results is a processing operation and the purposes and means of such operations are established by the search engine manager, Google Inc.
- Further to the Supreme Court, when the European Court of Justice considered in its Judgement of 13th May 2014 that the search engine processing operations are carried out in the context of Google Spain S.L.'s establishment it is only with the aim of attracting the application of EU law to the processing operations performed by Google Inc. The Court believes unnecessary that the processing operations are carried out "by" Google Spain S.L..
- In conclusion, only Google Inc. is considered data controller of the personal data processed as a consequence of the operation of the search engine and therefore Google Spain is not obliged to address requests based on the right to be forgotten that shall be directed to Google Inc.
