03/02/2020
CURIA - Documents
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Article 2(b) and (d), Article 4(1)(a)
and (c), Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of
the European Parliament and of the Council of 24 October 1995 on the protection of individuals with
regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)
and of Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
2 The request has been made in proceedings between, on the one hand, Google Spain SL (‘Google
Spain’) and Google Inc. and, on the other, the Agencia Española de Protección de Datos (Spanish Data
Protection Agency; ‘the AEPD’) and Mr Costeja González concerning a decision by the AEPD
upholding the complaint lodged by Mr Costeja González against those two companies and ordering
Google Inc. to adopt the measures necessary to withdraw personal data relating to Mr Costeja González
from its index and to prevent access to the data in the future.
Legal context
European Union law
3 Directive 95/46 which, according to Article 1, has the object of protecting the fundamental rights and
freedoms of natural persons, and in particular their right to privacy with respect to the processing of
personal data, and of removing obstacles to the free flow of such data, states in recitals 2, 10, 18 to 20
and 25 in its preamble:
‘(2) … data-processing systems are designed to serve man; … they must, whatever the nationality or
residence of natural persons, respect their fundamental rights and freedoms, notably the right to
privacy, and contribute to … the well-being of individuals;
...
(10) … the object of the national laws on the processing of personal data is to protect fundamental
rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the
European Convention for the Protection of Human Rights and Fundamental Freedoms [, signed in
Rome on 4 November 1950,] and in the general principles of Community law; … for that reason,
the approximation of those laws must not result in any lessening of the protection they afford but
must, on the contrary, seek to ensure a high level of protection in the Community;
...
(18) … in order to ensure that individuals are not deprived of the protection to which they are
entitled under this Directive, any processing of personal data in the Community must be carried
out in accordance with the law of one of the Member States; … in this connection, processing
carried out under the responsibility of a controller who is established in a Member State should be
governed by the law of that State;
(19) … establishment on the territory of a Member State implies the effective and real exercise of
activity through stable arrangements; … the legal form of such an establishment, whether simply
[a] branch or a subsidiary with a legal personality, is not the determining factor in this respect; …
when a single controller is established on the territory of several Member States, particularly by
means of subsidiaries, he must ensure, in order to avoid any circumvention of national rules, that
each of the establishments fulfils the obligations imposed by the national law applicable to its
activities;
(20) … the fact that the processing of data is carried out by a person established in a third country
must not stand in the way of the protection of individuals provided for in this Directive; … in
curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=DOC&docid=152065&occ=first&dir=&cid=667631
2/19