Search engines and the right to be forgotten
Search engines process IP addresses, cookies, user log files and third-party webpages (which they crawl and index). In Google Spain, the CJEU held a search engine is a controller of personal data on the third-party pages it indexes, and that Google Inc.'s processing was caught by EU law because it was 'inextricably linked' to Google Spain's ad-selling activities. The case established the right to be forgotten - now on a statutory footing under Article 17 of the GDPR.
If a search engine is established in the EEA, Article 3(1) applies. If headquartered outside but offering services to EEA individuals, Article 3(2)(a) applies, and building user log files is monitoring under Article 3(2)(b). After Google Spain, a non-EEA engine is also caught for its crawling if it has an EU establishment economically linked to its core activities.
(1) A search engine is a controller of the personal data on third-party pages it crawls, because it plays a decisive role in disseminating that data. (2) Google Inc.'s US processing was within EU law because Google Spain's ad-selling made the search engine economically viable - the two were inextricably linked. (3) Individuals gained a right to be forgotten to delist results.
- Retention must follow proportionality; delete or anonymise when grounds end
- Correlating data across services (e.g. webmail + search) generally needs the user's informed consent (WP29)
- Rights apply to registered AND unregistered users (identified via IP/cookies)
- The right to be forgotten is now in Article 17