1. THE ORIGINS AND IMPORTANCE OF THE RIGHT TO BE FORGOTTEN The Spanish experience Dr. Artemi Rallo Lombarte Constitucional Law Professor Jaume I University at Castellón (Spain) Former Director of the Data Protection Spanish Agency Centre for Socio-Legal Studies University of Oxford June 12th 2012 1

2. Communication of the European Commission on “A comprehensive approach on personal data protection in the European Union” (4/11/2010) 2.1.3. Enhancing control over one's own data The example of online social networking particularly presents significant challenges to the individual's effective control over his/her personal data. The Commission has received various queries from individuals who have not always been able to retrieve personal data from online service providers, such as their pictures, and who have therefore been impeded in exercising their rights of access, rectification and deletion. Such rights should therefore be made more explicit, clarified and possibly strengthened. The Commission will therefore examine ways of: - clarifying the so-called ‘right to be forgotten’, i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person's consent and when he or she withdraws consent or when the storage period has expired. 2

3. Article 17 Draft of General Data Protection Regulation (EU, 25/1/2012): The right to be forgotten and to erasure (I) 1. Data subject shall have the right to ERASURE personal data AND to obtain the ABSTENTION FROM FURTHER DISSEMINATION of such data - especially in relation to personal data which are made available by the data subject while he or she was a child -, where one of the following grounds applies: (a) the data are no longer necessary in relation to the purposes for which they were collected; (b) the data subject withdraws consent or the storage period consented has expired, or there is not other legal ground; (c) the data subject objects to the data processing; (d) The data processing does not comply with the Regulation for other reasons. 2. Where the controller has made the personal data public, it shall take all reasonable steps, including technical measures, in relation to data for the publication of which the controller is responsible, to inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that personal data. Where the controller has authorised a third party publication of personal data, the controller shall be considered responsible for that publication. 3

4. Article 17 Draft of General Data Protection Regulation (EU): The right to be forgotten and to erasure (II) 3. The controller shall erasure data without delay, EXCEPT if retention is necessary: (a) for exercising freedom of expression; (b) in the area of public health; (c) for historical, statistical and scientific research; (d) because of a legal obligation to retain data laid down by Union or Member States: for an objective of public interest, respecting the essence of data protection right and being proportionated to the legitimate aim pursued; 4. Instead of erasure, the controller shall restrict processing of personal data where: (a) their accuracy is contested by the data subject, for a period to verify the accuracy of data; (b) the controller no longer needs data but he has to maintain them for purposes of proof; (c) processing is unlawful and data subject opposes their erasure and requests the restriction of their use instead; (d) data subject requests to transmit the personal data into another automated processing system in accordance with Article 18(2): portability 4

5. Article 17 Draft of General Data Protection Regulation (EU): The right to be forgotten and to erasure (III) 5. Personal data referred to in paragraph 4 (legal blockage, portability, objection, rectification) may only be processed: -for purposes of proof, -or with the data subject's consent, -or for the protection of the rights of another natural or legal person -or for an objective of public interest. 6. Where processing of personal data is restricted pursuant to paragraph 4, controller shall inform the data subject before lifting the restriction on processing. 7. The controller shall implement mechanisms to ensure that the time limits established for the erasure of personal data and/or for a periodic review of the need for the storage of the data are observed. 8. Where the erasure is carried out, the controller shall not otherwise process such personal data. 5

6. Article 17 Draft of General Data Protection Regulation (EU): The right to be forgotten and to erasure (IV) 9. The Commission shall adopt delegated acts for the purpose of further specifying: (a)the criteria and requirements to erasure in specific sectors and situations; (b) the conditions for deleting links, copies or replications of data from publicly available communication services; (c) the criteria and conditions for restricting the processing of personal data referred to in paragraph 4 (legal blockage, portability, objection, rectification). 6

7. Spanish experience: right to erase data on the Internet YOUTUBE: IMAGES (a)Recording and dissemination on the Internet of images of prostitutes in Montera Street (MADRID). Residents of the Montera Street recorded images of prostitutes in a downtown Madrid Street and put them on YOUTUBE. The AEPD sanctioned with a fine of 1000 Euros. (b) Recording and dissemination of images of disabled person in YOUTUBE. It was the second penalty (1500 Euros) imposed by the AEPD for recording and disseminating images without consent on YouTube. The images showed several young people making fun of a mentally disabled person. WEBSITES, BLOGS, CHATs, SOCIAL NETWORKS (FACEBOOK,...) 2007-2008, 20 cases; in 2010, 150 complaints; and, in 2011, over 250 7

8. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (I) 1.- JUDGMENT OF THE CONSTITUTIONAL COURT PUBLISHED IN OFFICIAL GAZETTE: TD/569/2008: AEPD 9/25/2008 XXX requested to erase in the google search index data contained in a 2005 constitutional court judgement and linked to an offence and punishment of 500,001 pesetas. The literal from the GOOGLE index induced error as XXX seemed to have been punished when he appeared related to a different judgement in which the sanction had been cancelled: in fact, XXX was refered as an example of non- infringement. AEPD accepted the claim and "urged Google to take the necessary steps to remove data from the search engine index and to avoid the future access to them". The Spanish Constitution obliges to publish in the Official Gazette the Constitutional Court Judgments but the Constitutional Court decided to anonymise in its WEB data from XXX because "the data subject was not part of the case and the inclusion of his name lacks significance in the case, so it is coming to adopt the agreement of replacement of their surnames by the corresponding initials" 8

9. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (II) 2) HARASSMENT AGAINST A WOMEN VICTIM OF VIOLENCE OF GENRE: TD/172/2009. AEPD 7/20/2009 Woman victim of violence of genre objected her data and her children data processing by Google search engine by safety reasons. She did not consent photos and other publications of her children in school and extracurricular activities, to avoid locating them via the Internet, but: (a) two sons participated in sports competition of the city of residence and their names appeared on the lists of participants. (b) a daughter appeared on the website of the high school with the school marks. High school corrected the mistake and her daughter disappeared from the website but it was possible to access from Google. (c) daughter data appeared in Google by the award of a scholarship at the University. (d) daughter data appeared in her university lists. (e) a son appeared in Google for participating in a football activity. XXX requested a general measure to avoid Google access to their present and future data to avoid danger to their physical integrity in case of being traced by the father of her children (a judgement had forbidden the father visits to the children). AEPD accepted the right of objection on data that appeared currently in google but not on future data (due to technical difficulties). 9

10. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (III) 3) PARDON PUBLISHED IN OFFICIAL GAZETTE: TD/989/2009. AEPD 1/19/2010 Royal Decree of 1999 pardoned a crime against public health (drug trafficking) and it was published in Official Gazette (as it is mandatory by Spanish Pardon Act). In the Pardon Decree was published: (a) who was sentenced in 1994 to two years in prison and a fine of 1,000,000 pesetas. (b) and that the pardon was conditioned to follow and not abandon medical treatment drug addiction rehabilitation. The AEPD accepted the claim and: (1´) urged Google to take the necessary measures to remove data from its index and avoid future access to them; (2´) obliged the Official Gazette to take the necessary measures to avoid future data indexing by Google (the BOE took steps to avoid indexing). 10

11. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (IV) 4) NEWS IN DIGITAL MEDIA "ELMUNDO.ES": TD/1435/2009: AEPD 2/17/2010. News in El Mundo.es on November 20, 2007 on crimes of fraud and misappropriation.. XXX argues that news is false and affect seriously his honor, image, reputation and dignity, privacy, causing him serious consequences in professional and personal level.. AEPD rejected the claim because the right of objection demands: 1´) existence of a legitimate and founded reason; 2´) and this reason has to be linked to a specific personal situation.. AEPD did not appreciate founded and legitimate reason to justify the right of objection, because of the news public relevance and without having credited that data and information are inaccurate or have become obsolete. 11

12. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (V) 5) NEWS IN DIGITIZED NEWSPAPERS ("EL PAIS"): TD/1436/1437/2009: AEPD 3/24/2010 Two sisters objected to EL PAIS, SL and Google, by a news on 27 February 1985 ("the brother of the Mayor of Barcelona, arrested for alleged drug trafficking, entered a hospital") where they appeared as "imprisoned" and "suffering drugs withdrawal syndrome". The two sisters argued: (a) that the relevance of the news was the brother of the Mayor of Barcelona; (b) and that, although news was accurate, it does not correspond with the final resolution of the judicial procedure following arrests or with their current health situation. 12

13. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (VI) 6) DECISION OF THE OFFICE OF THE UNITED NATIONS HIGH COMMISSIONER FOR THE HUMAN RIGHTS: TD/1486/2009. AEPD 3/12/2010 Objection against Google by several links on Decision of the Office of the High Commissioner for Human Rights of United Nations rejecting of the claim lodged by XXX on eviction his family home by implementing an urban plan in Cartagena (Spain) in 1989. The claimant justified objetion because it causes a severe prejudice to his personal and professional reputation as a digital communication Manager: public dissemination is disproportionated and it cannot be considered a news. AEPD accepted the complaint ordering Google to take the necessary steps to remove data from its index and avoid future access to them. 13

14. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (VII) 7) NEWS IN DIGITIZED NEWSPAPER ("LA VANGUARDIA"): TD/1887/2009. AEPD 5/24/2010 The claimant exercised the right of objection to the processing of his data against Google and “La Vanguardia” by news of July 14, 1989 with following data: 1´) that he suffered from paranoid schizophrenia and he had been acquitted of the crime of parricide charged by the public prosecutor by suffocating his 4 years-old child (by pressing a pillow against his face while sleeping in October 1987); (2´) the absolution estimated a complete defence of mental illness and ordered the internment of the claimant in a psychiatric centre. In favor of the objection: a) the long time since the facts, (b) and that the memory of the events, according to his psychiatrist, undermined the medical recovery. AEPD accepted the complaint and: 1´) urged Google to take the necessary measures to remove data from its index and avoid future access to them. 2´) and, related to La Vanguardia, a´) it considered freedom of expression prevailed; (b´) but the AEPD "recalled that media should use technical measures, in the event that comes legitimate interest of a private individual and the relevance of the fact has ceased to exist, to avoid indexing of the news by the Internet search engines from its webmaster". 14

15. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (VIII) 8) NEWS IN DIGITIZED NEWSPAPER ("ABC"): TD 30/2010. AEPD 5/24/2010 Objection against Google and ABC by news in 1975 concerning the arrest of 32 activists of the terrorist group FRAP by linking XXX to terrorist acts such as the murder of two civil guards. The claimant argued: 1) he was 20 years old in 1975; (2) judicial proceedings were filed; (3) the facts of the news were false; (4) facts are part of his privacy and past; (5) by his name in the newspaper let to becoming a victim of telephone death threats and had to change his home and hide his phone number. AEPD accepted the claim against Google, urging such entity to take steps to withdraw its index data and make impossible the future access to them. About ABC, AEPD considered that “freedom of expression prevailed” but: "media should use technical measures, in the event that comes legitimate private interest and the relevance of the fact has ceased to exist, to avoid indexing of the news by Internet search engines from its webmaster". 15

16. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (IX) 9) DATA ON GOOGLE BLOGS. TD/92/2010. AEPD 6/18/2010 Doctor in a Malaga School objects against Google for blogs that Google supports, with links to websites that disseminate personal data, mail addresses, places of work and photographs, accusing him of arrest in 2008 for crimes of child Internet pornography and sexual abuse of children. XXX argues personal, family, labor, economic and moral damage because of disseminating these data and it charged crimes that led to his arrest by an anonymous complaint, but to a subsequent judicial file. AEPD: 1´) urged Google to avoid indexing and delete personal data from these GOOGLE blogs; (2) on the blogs of those who is not responsible for Google, urged measures that prevent indexing of data. 16

17. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (X) 10 NEWS IN DIGITIZED NEWSPAPER ("ABC"): TD/487/2010. AEPD 6/18/2010 Objection against ABC by news of 1974 and February 7, 1975 with the title: "more than 20 youths arrested in Madrid as involved in the consumption and trafficking of drugs“. Arguments for objection: 1) XXX was arrested in 1974, when he was student and legally minor (19 years); (2) the trial was acquitted; (3) today he is a prestigious professional and his public (morale, professional and social) image is being damaged. AEPD did not accept the objection because freedom of expression prevails when the information is truthful and it has public interest. But the ABC newspaper said it would try to avoid the possibility of search. 17

18. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (XI) 11) PUBLICATION IN OFFICIAL GAZETTE ON JUDICIAL FREEZING ORDER. In 1996, a court ordered freezing property because of a crime and this was published in the Official Gazette.. Years later, XXX is pardoned and pardon is published in the Official Gazette.. AEPD accepted the objection and urged Google not to host the judicial freezing order notice of seizured of property, published in the Official Gazette. 12) NEWS IN DIGITIZED NEWSPAPER ("EL PAIS") ON PLASTIC SURGEON. In 1991, EL PAIS informed of a crime by a plastic surgeon who, after trial, was acquitted.. Newspaper published nothing about the acquittal and Google only indexed news on the first news.. AEPD accepted the opposition. 18

19. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (XII) 13) PRISONS CIVIL SERVANT DISCIPLINARY SANCTION PUBLISHED IN OFFICIAL GAZETTE. A disciplinary sanction is imposed to a prison officer in the 90s. The Spanish Act stipulates that this sanction must be published in the Official Gazette.. The prison officer may be target of terrorist acts (ETA). AEPD accepted the objection. 14) AEPD FIRST CASE: FINE NOTIFIED AND PUBLISHED IN OFFICIAL GAZETTE. Sanctioned with a fine in the 1980s by a local police for “urinating in public street".. Not being able to notify the fine at the postal address, the Spanish Administrative Procedure Act provides for notification of administrative acts in Official Gazette.. Currently, XXX is Professor and Director of a High School where students access to Google every year to know about the fine published in the digitized Official Gazette.. AEPD accepted objection and ordered google to erase links and avoid future access. 19

20. SPANISH EXPERIENCE AND GOOGLE SEARCH ENGINE CASES: RIGHT TO OBJECT (XIII) 15) PRELIMINARY RULING LODGE INTO THE COURT OF JUSTICE OF THE EUROPEAN UNION BY THE SPANISH NATIONAL COURT ON 2/27/2012: AEPD VERSUS GOOGLE: ADMINISTRATIVE EDICT PUBLISHED IN DIGITAL MEDIA: AEPD 7/30/2010 XXX exercises the right of objection against "La Vanguardia" by a website with data related to an auction of real estate caused by a freezing order derived from debts to Social Security. The publication was carried out by order of the Social Security in Barcelone The published information no longer had any "public interest". The AEPD accepted the claim and: ( a) urged Google Inc "to take the necessary steps to remove data from its index and avoid future access"; ( b) but considered that LA VANGUARDIA had reasons to deny the requested cancellation ''attending that the publication had legal justification and the main goal was giving the widest publicity to auctions to get the greatest competition of bidders". 20

21. AEPD RESOLUTIONS: GROUNDS (I) RIGHTS _ RIGHT TO ERASE: Article 12 Directive 95/46: "Member States shall guarantee every data subject the right to obtain from the controller:..." (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or and/or inaccurate nature of the data; (c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort to. _ RIGHT TO OBJECT Article 14 Directive 95/46: "The data subject's right to object". Member States shall grant the data subject the right: (a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data…; (45) Explanatory Note of Directive 95/46 on the right to object: "Whereas, in cases where data might lawfully be processed on grounds of public interest, official authority or the legitimate interests of natural or legal person, any data subject should nevertheless be entitled, on legitimate and compelling grounds relating to his particular situation, to object to the processing of any data relating to himself". 21

22. AEPD RESOLUTIONS: GROUNDS (II) KEY IDEAS No Constitution or law obliges citizens to appear in Google links nor in memory cache. Google should implement measures to remove data from its index and make impossible for future access. Today, the informative effects of the Internet search engines disclose universal and eternally anonymous people data. "any citizen without being celebrity or part of a public news must resign themselves and suffer their personal data travelling on the Internet without being able to react or prevent this illegitimate processing" (AEPD 266/2007) “Requiring the individual consent of the citizens to include their personal data on the Internet or require technical mechanisms that leaked these data would be an unbearable barrier to freedom of speech and information by way of prior censorship. But it is also legitimate that the citizens without public interest can exercise their right of erasure to avoid the secular and universal maintenance of their data on the Internet¨ (AEPD). 22

23. AEPD RESOLUTIONS: GROUNDS (III) APPLICABLE LAW: EUROPEAN DIRECTIVE AND SPANISH LAW Article 4 of Directive 95/46/EC:. "National law applicable 1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where: (a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State;... (c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State…“ Explanatory Note of the Directive 95/46 on article 4: (18) Whereas, in order to ensure that individuals are not deprived of the protection to which they are entitled under this Directive, any processing of personal data in the Community must be carried out in accordance with the law of one of the Member States…; (19) Whereas establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements; whereas the legal form of such an establishment, whether simply branch or a subsidiary with a legal personality, is not the determining factor in this respect…; (20) Whereas the fact that the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive; whereas in these cases, the processing should be governed by the law of the Member State in which the means used are located; 23

24. AEPD RESOLUTIONS: GROUNDS (IV) APPLICABLE LAW: EUROPEAN DIRECTIVE AND SPANISH LAW WP 148, 4/4/2008 of Art.29 WORKING PARTY on SEARCH ENGINES:. Search engine which processes user data including IP addresses and / or permanent cookies that contain a unique identifier is controller because it determines the purposes and means of the processing effectively.. Search engine that processes data (personally identifiable search histories) is controller, regardless of the jurisdiction.. Article 4 of the directive pursues: avoiding gaps and avoiding different laws for the same situation.. When search engine is beyond European Union, European legislation is applied: 1) if it has establishment in Europe; (2) or if the equipment used is located in Europe. Search engine uses equipment in Europe: examples: (a) data servers are located in the territory of a State. (b) use of personal computers, terminals and servers. (c) use of cookies and similar software devices. (d) the user's computer is an equipment in the sense of the article 4 (1) of Directive 95/46/EC: is located in the territory of a State; controller uses this equipment to process data; and produces technical operations without the control of the person concerned. Controller controls the user's computer. Conclusion article 29 WP: Arts. 4 (1) (a) and 4 (1) (c) of the data protection directive apply to the search engines. 24

25. AEPD RESOLUTIONS: GROUNDS (V) APPLICABLE LAW: EUROPEAN DIRECTIVE AND SPANISH LAW SPANISH APLICABLE LAW. GOOGLE uses equipment located in Spanish territory.. GOOGLE is a global service but there are local versions adapted: www.Google.es.. GOOGLE visits web servers within Spain to collect information for Spaniards searches.. Information tracked by GOOGLE in Spaniard servers has data from people who are not necessarily users of the search engine and, then, data subjects.. User may decide that their searches refer to pages of Spain. CONCLUSION: a) GOOGLE needs to use technical equipments located in Spain. B) GOOGLE is aimed at the Spanish territory: 1) The Google. es language is Spanish (also, Catalan, Basque and Galician). (2) The Spanish domain is google.es; (3) Searches are targeting users in Spain; (4) It offers contextualized advertising linked to the Spanish territory. (5) Google Inc. has designated Google Spain as its representative located in Spanish territory. (6) In the AEPD Register, Google Inc. has designated Google Spain, S.L. as the Office where exercise data protection rights. 25

26. AEPD RESOLUTIONS: GROUNDS (VI) LIABILITY: SPANISH LAW IN ADDITION: ELECTRONIC COMMUNICATIONS LAW Spanish information society services Act (8.1. c): "If an information society service breachs personal dignity, competent bodies may stop the service or withdraw illegal data." The LSSI includes search engines like information society services. Search engines will not be responsible until: to) have current knowledge that the activity or information is illegal; (or b) when having knowledge, they do not act with diligence to eliminate the link. The search engine has current knowledge when a competent body has declared that data are illegal, has ordered its withdrawal or to avoid the access. 26

27. AEPD RESOLUTIONS: GOOGLE GROUNDS (VII) GOOGLE SPAIN is not responsible for the searches on the Internet service; GOOGLE SPAIN only represents to GOOGLE INC. to sell advertising. GOOGLE INC. is responsible for rights or complaints. GOOGLE INC. only considers applicable United States Law and not European Directive or Spanish law. GOOGLE INC. considers that the searches are on website of third parties whose access is public and to eliminate results requires the collaboration of the webmaster. 27

28. AEPD RESOLUTIONS: DIGITAL MEDIA (VIII) SPECIFIC CRITERIA (a) NEWS in digital media is freedom of information protected by the Constitution. Freedom of information prevails (preference) on other fundamental rights if news is true and has public interest. Directive 95/46: "(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information”..To reconcile the freedom of expression and data protection must respond to the right of opposition. Directive 95/46/EC: (45)" "Whereas, in cases where data might lawfully be processed on grounds of public interest, official authority or the legitimate interests of a natural or legal person, any data subject should nevertheless be entitled, on legitimate and compelling grounds relating to his particular situation, to object to the processing of any data relating to himself”. 28

29. AEPD RESOLUTIONS: DIGITAL MEDIA (IX) SPECIFIC CRITERIA (b) Law does not impose anyone to be included in the Google links or "cache". Google should implement measures to remove data from its index and to prevent future access. A journalistic news is protected by the Constitution, but the development of the Internet and search engines (GOOGLE) represent a universal and permanent dissemination of the information contained in media. Therefore it would be desirable that, if there is a legitimate interest of an individual but without erasing information (without erasing files or historical records), the webmaster of digital media should prevent indexing of the news by GOOGLE (to avoid an indiscriminate, permanent and harmful dissemination). 29

30. AEPD RESOLUTIONS: OFFICIAL GAZETTES (X) SPECIFIC CRITERIA. Official Gazette is a public body which publishes mandatory by law information.. Official Gazette must maintain authenticity and integrity of the contents without manipulating information already published. But Official Gazette must comply with the Data Protection Act: _ Official Gazettes process data, fully or partially automated. _ Official Gazettes should take the necessary measures to prevent the indiscriminate disclosure of personal data through the Internet search engines. _ Citizen cannot avoid its data being included in the official gazette but he can oppose (if there is a legitimate and founded reason) his data being collected by the Internet search engines. _ Example: after a long time since the publication of an administrative notification and not existing more general interest, protecting the privacy is a legitimate interest. AEPD considers that, in the current state of the technology (technical improvements can be incorporated in the future), the adoption of the Protocol of the industry called "robots.txt" is a valid method to address the rights of erasure or objection to an official gazette, avoiding indexing of already published data. 30

31. PRELIMINARY RULING LODGE INTO THE COURT OF JUSTICE OF THE EUROPEAN UNION BY THE SPANISH NATIONAL COURT ON 2/27/2012: AEPD VERSUS GOOGLE MAIN QUESTIONS (I) 1. Territorial application of Directive 95/46/EC and the Spanish law: 1.1 Can be interpreted that there is a "establishment” (art.4.1.a) of Directive 95/46): when a search engine creates in a State an office for sale of advertising addressed to the residents of that State?, or when a company appoints one subsidiary located in a State as its representative and responsible for two specific files with data from clients who hire advertising? Or when the office in a State voluntarily transfers to the company, located outside the European Union, the requests and requirements of users or data protection authorities? 31

32. PRELIMINARY RULING LODGE INTO THE COURT OF JUSTICE OF THE EUROPEAN UNION BY THE SPANISH NATIONAL COURT ON 2/27/2012: AEPD VERSUS GOOGLE MAIN QUESTIONS (II) 1.2 Can be interpreted article 4.1.c of Directive 95/46 in the sense that there are "equipments located in the territory of that Member State"? when a search engine uses spiders o robots to locate and index information contained in websites located on servers of that State? or when a search engine conducts searches and results depending on the language of that State?. 1.3 Can be considered equipment, under the terms of article 4.1. c of Directive 95/46/EC, the temporary storage of information indexed by search engines on the Internet? 1.4. Irrespective of article 4 of the Directive, Should the Directive 95/46/EC apply on data protection rights, in the light of article 8 of the European Charter of fundamental rights, in the State where the violation of rights is located and where it is possible a more effective protection of the citizens rights? 32

33. PRELIMINARY RULING LODGE INTO THE COURT OF JUSTICE OF THE EUROPEAN UNION BY THE SPANISH NATIONAL COURT ON 2/27/2012: AEPD VERSUS GOOGLE MAIN QUESTIONS (III) 2. Search engines as service providers in relation to Directive 95/46/EC: 2.1. About the Google activity ( to locate information published or included in the network by third parties, index automatically, temporarily store and offer it to users with an order of preference): Is included in the concept of "data processing" (d) article 2(b) of Directive 95/46/EC? 2.2 Google is "controller for the processing" of data from the indexed web pages? 2.3. Can the AEPD require directly to Google to withdraw from its indexes information published by third parties, without approaching prior or simultaneously the webmaster where the information is located?. 2.4. Will the search engines responsibility to protect these rights be excluded when lawfully published by third parties are maintained on the website of origin? 33

34. PRELIMINARY RULING LODGE INTO THE COURT OF JUSTICE OF THE EUROPEAN UNION BY THE SPANISH NATIONAL COURT ON 2/27/2012: AEPD VERSUS GOOGLE MAIN QUESTIONS (IV) 3. The right of erasure and /or objection and the right to be forgotten: 3.1. Do rights of erasure and blockage of the Directive 95/46/EC include that the person concerned can ask for search engines to prevent the indexing of data published on websites of third parties, in order to avoid Internet users access to them when he considers that it can harm him or he simply wants to be forgotten (even if data are lawfully published by third parties data)? 34

35. MAIN CONCLUSIONS RtbF is not censorship: not proactive approach. RtbF is a right based on legitimate interest and individual grounds: reactive approach. RtbF must be reconciled/balanced with freedom of information RtbF should be ensured by media applying available existing technical measures. RtbF must be ensured by search engines on the Internet - they are not media - “taking into consideration available technology” and “investing in new technical tools”. 35