The Court of Justice of the European Union ruled in Google Spain v AEPD and Mario Costeja González that search engines are responsible for their processing of personal data. Individuals can ask them to remove links to information that is inadequate, irrelevant, or no longer relevant.
What happened
- The case was brought by a Spanish man who wanted search results about an old property auction linked to social security debts removed.
- The court held that Google’s search activity was subject to EU data protection law, even though the processing took place outside Spain.
- Search engines must balance the individual’s privacy rights against the public interest in the information.
- Google launched an online removal request form weeks later and reported receiving around 12,000 requests on the first day.
Why it mattered
The ruling created what became known as the ‘right to be forgotten’, forcing search engines to handle large numbers of delisting requests and sparking a global debate about privacy versus freedom of information.
Lessons for organisations
Organisations that publish or index personal data should have a clear process for handling erasure and objection requests, and should apply retention limits so outdated personal information is not kept or published longer than needed.
Sources: Court of Justice of the EU, ABC News
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
