CJEU Google/AEPD: Google is a data controller and data subjects have the right to be forgotten


On 13 May 2014, the CJEU issued an important decision regarding data protection law and internet search engines. The CJEU ruled that an internet search engine operator such as Google is responsible for the processing that it carries out of personal data that appears on web pages published by third parties. The data subject may request from Google that personal information is no longer made available to the general public by its inclusion in a list of results. The data subject’s fundamental rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information.