Google Spain v. Gonzáles: Did the Court forget about freedom of expression?

This paper is a legal-analytic commentary on the CJEU’s landmark decision in Case C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos and Mario Costeja González (“Google Spain”). The authors, S. Kulk and Frederik Zuiderveen Borgesius, ask a focused normative question: did the Court “forget about freedom of expression?” They argue that the judgment’s reasoning and doctrinal framing tilt too strongly toward privacy and data protection, while under-engaging the equally fundamental right to freedom of expression (including the public’s right to receive information) and the rights of information providers and search engine operators.

The question matters because Google Spain operationalized what is popularly called the “right to be forgotten” by recognizing, under certain conditions, a data subject’s ability to require delisting of search results tied to their name—even when the underlying third-party web content is lawful and accurate. This has had wide practical effects on online speech, discoverability, and the architecture of networked information. The authors’ concern is not simply that privacy can outweigh expression; rather, it is that the CJEU’s approach establishes a default hierarchy that treats privacy/data protection as overriding “as a rule” the public’s interest in access, thereby shifting the balancing task away from courts and toward private intermediaries.

Methodologically, the paper is not an empirical study. It is a doctrinal and interpretive analysis grounded in the text of the CJEU judgment, the relevant EU Data Protection Directive 95/46/EC, and comparative human-rights doctrine from the European Court of Human Rights (ECtHR). The authors also draw on related institutional materials and implementation evidence: they discuss the Advocate General’s opinion, the Article 29 Working Party’s prior views on search engines, and Google’s reported compliance statistics and transparency practices (e.g., communications to the Working Party and Google’s transparency reporting). The “data” in this paper are therefore legal authorities and documented implementation figures rather than survey or experimental data.

The paper first summarizes the case facts. In 1998, La Vanguardia Ediciones SL published online announcements about a real-estate auction connected to social security debts, naming Mario Costeja González as the real-estate owner. Although the publisher did not remove the information from its website (because the publication was ordered by the Spanish Ministry of Labour and Social Affairs), González sought delisting of search results that surfaced the newspaper pages when users searched for his name. After a complaint to the Spanish data protection authority (DPA), the DPA rejected the complaint as to the publisher (given the legal basis for publication) but upheld it regarding Google Spain and Google Inc., treating the search engine operator as capable of being required to remove links from its index and prevent future access through search.

The CJEU’s reasoning, as presented here, proceeds in several steps. First, it treats the search engine’s activities of indexing, storing, and displaying links as “processing” of personal data, even when the data are already publicly available and even if the operator does not alter the underlying data. Second, it classifies the search engine operator as a “controller” because it determines the purposes and means of the processing. Third, it establishes territorial reach: processing is carried out “in the context of the activities” of an establishment in a Member State when the operator has a branch or subsidiary oriented toward that Member State (here, Google Spain’s advertising activities). Fourth, it interprets the Directive’s rights and balancing provisions to allow delisting where the data subject’s rights under Articles 7 and 8 of the Charter (privacy and data protection) require it. The judgment emphasizes that search results provide a “structured overview” of information about an individual and can enable detailed profiling that would be difficult without search engines. It also states that even initially lawful processing can become incompatible over time when data become inadequate, irrelevant, or excessive.

The paper’s core critique is that the CJEU’s balancing framework insufficiently accounts for freedom of expression. The authors argue that delisting interferes with multiple expressive interests: (1) publishers’ freedom of expression (because delisting makes lawful content harder to find via name searches); (2) search engines’ expressive interests (because search engines curate and provide access to information); and (3) the public’s right to receive information. They stress that ECtHR doctrine treats privacy and expression as deserving “equal respect” and requires nuanced, case-by-case balancing. In contrast, the CJEU is said to declare that privacy/data protection rights “override, as a rule” not only the operator’s economic interest but also the general public’s interest in access. While the CJEU includes caveats (e.g., where the data subject plays a role in public life), the authors view the “as a rule” language as a departure from ECtHR’s equal-weight approach.

The paper also highlights institutional and governance concerns. By treating search engine operators as controllers, the CJEU effectively creates a private ordering system: delisting decisions are made by the operator under legal pressure, with courts and DPAs acting as review bodies. The authors argue that this is problematic in hard cases because search engines may not be the most appropriate party to balance competing fundamental rights. They cite the Advocate General’s warning that such balancing by the operator could lead to an unmanageable number of delisting requests and could incentivize automatic withdrawal of results. They further compare the dynamic to intermediary liability regimes (e.g., notice-and-takedown incentives), where intermediaries remove content expeditiously to reduce legal risk, potentially chilling expression.

On implementation, the paper provides specific figures from Google’s compliance communications. As of 18 July 2014, Google reported receiving 91,000 requests involving more than 300,000 URLs. Google delisted about half of the URLs upon request; for 32% it decided not to delist; and for 15% it asked for more information. These numbers are used to illustrate the scale of private decision-making and the administrative burden on intermediaries and oversight bodies.

The authors also argue that the CJEU’s controller framing creates doctrinal difficulties regarding “special categories of personal data.” Under the Directive, processing of such data (e.g., racial/ethnic origin, political opinions, religious beliefs, health or sex life) generally cannot rely on the balancing provision (Article 7(f)); instead, explicit consent or specific exceptions are required. Because search engines index many pages that may contain special category data, the authors contend that indexing could be partly illegal under the Directive unless exceptions apply. They note that the Advocate General sought to avoid this consequence by not treating the operator as a controller for processing on third-party pages, but the CJEU allegedly ignores the legal-basis gap.

Limitations are inherent in the paper’s design: it is a commentary rather than an empirical evaluation of outcomes. It does not systematically measure changes in speech, access, or chilling effects after the judgment. Instead, it relies on legal reasoning, doctrinal comparisons, and documented implementation statistics. The authors also acknowledge that their focus is primarily freedom of expression; jurisdictional issues are only briefly addressed.

Practically, the paper suggests that policymakers and courts should not solve all conflicts by imposing obligations on search engines. It proposes alternative solutions such as limiting indexing duration for certain outdated information (e.g., real-estate auction notices) or using technical measures like do-not-index directives (e.g., robots.txt) by original publishers. In the most difficult cases, it argues courts should balance privacy and freedom of expression with equal weight.

Who should care? The authors’ critique is aimed at legal practitioners, courts, data protection authorities, and policymakers shaping EU data protection and intermediary governance. It is also relevant to publishers and platform operators because it affects discoverability of lawful content and the legal risk calculus that drives delisting decisions. Ultimately, the paper frames Google Spain as not merely a privacy case but a structural decision about who performs fundamental-rights balancing in the online information environment.