HURBAIN v. BELGIUM JUDGMENT relating to him no longer appeared, or to use certain tools made available by search engines in order to protect his data. He had also requested Google to remove or conceal the personal data relating to him so that they ceased to be included in the search results and in the links to the newspaper. While the Spanish agency had rejected the complaint against the newspaper – finding that the publication by the newspaper of the information in question was legally justified as it had taken place on the orders of a Ministry – it had upheld the complaint against Google, which brought an action before the Spanish courts. It was in the context of this judicial dispute that the case was referred to the CJEU for a preliminary ruling. 72. The CJEU held that the operations carried out by the operator of a search engine should be classified as “data processing”, of which it was the “controller” (Article 2(b) and (d) of Directive 95/46/EC), regardless of the fact that the data in question had already been published on the Internet and had not been altered by the search engine. It stated that, in so far as the activity of a search engine could be distinguished from and was additional to that carried out by publishers of websites and also affected the fundamental rights of the data subject, the operator of the search engine had to ensure in particular that the guarantees laid down by the directive could have full effect. Moreover, given the ease with which information published on a website could be replicated on other sites, effective and complete protection of data users, and particularly of their right to privacy, could not be achieved if they had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites. The CJEU concluded that the operator of a search engine was obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in cases where the name or information had not been erased beforehand or simultaneously from those web pages and even, as the case might be, when its publication on those pages was in itself lawful. 73. The CJEU added that even initially lawful processing of accurate data could, in the course of time, become incompatible with the directive where those data were no longer necessary in the light of the purposes for which they had been collected or processed. That was so in particular where they appeared to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that had elapsed. The CJEU concluded that if, under Articles 7 and 8 of the European Union’s Charter of Fundamental Rights guaranteeing, respectively, the right to respect for private life and the right to the protection of personal data, the data subjects had a right to ensure that the information in question relating to them personally should no longer be linked to their name by a list of results – although this did not presuppose that the inclusion of the information in question caused prejudice to the data subject – and if they were thus entitled to request that the information in question no longer be made available to the 28

Select target paragraph3