This morning we woke up to a post on a professional mailing list in the cybersecurity sector that was raising an outcry over the following statement:

Goodbye to the right to be forgotten and multiple news reports in the media backed this up, such as: ABC, Google, El País, Expansión… among others.

Just a few hours later, Ruth Salas, our trusted ICT criminal lawyer with whom we work, helped us catch our breath again:

Note from the AEPD, Spanish Data Protection Agency

News

March 15

Informative note on the exercise of the ‘right to be forgotten’

Regarding the Supreme Court ruling that clarifies to whom ‘right to be forgotten’ requests should be addressed, the AEPD reminds the public that the way in which citizens can exercise this right against Google remains unchanged.

The Third Chamber of the Supreme Court has published a ruling clarifying to whom ‘right to be forgotten’ requests should be addressed.

The way in which citizens can exercise their ‘right to be forgotten’ against Google remains unchanged. Users can continue to contact Google for this purpose, for example, through the form that the company has had available in Spanish since May 30, 2014. Similarly, if Google denies the data subject’s request or if they do not agree with the company’s decision, they may continue to seek protection from the Agency under the same terms as before.

In any case, it is necessary to emphasize that the ruling does not mean that data subjects cannot exercise their rights as provided for in the LOPD, nor that Spanish law ceases to apply. It also does not modify the principles and weighting criteria established by the CJEU in its ruling, but rather clarifies that the recipient of the requests must be Google Inc.

The Agency informs that citizens directly affected by the annulment of the National High Court rulings can guarantee their rights as follows:

– First, by checking if Google has re-indexed the links. If so, by requesting the exercise of their ‘right to be forgotten’ through the form provided by the company.

– If the entity does not respond to the request or if the citizen considers that the response received is inadequate, they can continue to seek protection from the Spanish Data Protection Agency against Google.