white_paper_on_data_protection_in_india_171127_final_v2

emove data for ―the processing of personal data for journalistic purposes, or for the purposes
of academic, artistic or literary expression.‖ 643
However, the exact scope and contours of such a right to be forgotten will only be clearly
visible after the EU GDPR comes into force in 2018.
(ii)
Compliance of Third Parties
While formulating a right to be forgotten, it is essential to outline whether third party
providers of information—eg: search engines—can be held accountable for failing to comply
with erasure requests.
This issue was addressed in the Google Spain Case. 644 In this case, the issue before the Court
of Justice of the EU (CJEU) concerned an order from Spain‘s highest court,
AudienciaNacional, to Google requiring it to delete information concerning a Spanish
citizen‘s financial problems from its search engine results. In this case, the argument that
processing of data by Google Inc. (based in the US) for operating Google Search was not
subject to EU law was rejected by the CJEU. The Court held that this processing was in the
context of the activities of Google Spain, an establishment in the Union, despite the fact that
it was only operating in the area of advertising. On this basis, the CJEU found that the Data
Protection Directive was applicable to that particular case and held that search engines were
indeed data controllers that needed to remove personal data that met the criteria for a ‗right to
be forgotten‘.
This judgment essentially invokes long arm jurisdiction to hold the parent entity of a
subsidiary company liable for processing of data related to an EU entity and subject.
However, practical issues of compliance remains as the links to the Spanish article will be
removed from Google Spain (and maybe, all Google subsidiaries in the EU) but it will be
available on other jurisdictions which do not recognise the right to be forgotten such as the
US (in Google US) to people disguising their location using a Virtual Private Network
(popularly known as a VPN). 645
However, this judgment comes with its own repercussions. The decision potentially allowed
individuals to seek erasure of information made available by a number of other providers of
social networking and information services.
10.3 International Practices
European Union
643 Article 85, EU GDPR.
644 Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja
González, Case C131/12, (2014), European Court of Justice.
645 Klint Finley, ‗In Europe you will need a VPN to see real search results‘, Wired (8 March 2016), available at:
https://www.wired.com/2016/03/europe-youll-need-vpn-see-real-google-search-results/, (last accessed 28
October 2017).
139