27th May 2022


Nine lines that changed history - at least on the internet

  • Around 800,000 search results have been deleted so far - a number that is growing by 1,500 to 2,000 per day, according to the latest figures on Google's own website (Photo: Runner1928)

"I was desperate," explains Mario Costeja Gonzalez.

The Spaniard, who speaks quickly and with a distinctively hoarse voice, is today known throughout the world as the central figure in one of the most controversial internet privacy cases of all time.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

  • Spanish lawyer Joaquin Munoz, who took the case that was dubbed the "right to be forgotten". (Photo: Joaquín Muñoz)

In 2009, he was a virtually unknown company financial adviser. If anyone wants to know more about a person, a good starting point is to google them. This was Costeja Gonzalez's problem.

When googling his name, it was revealed that his house was sold at a foreclosure auction in 1998 to repay a debt to the state.

"Clearly, when this was one of the first things that showed up on Google, it was damaging to my career as a financial adviser," explains Costeja Gonzalez.

Nine lines in La Vanguardia

The case revolved around just four lines from page 23 of the 19 January 1998 edition of the Spanish newspaper, La Vanguardia, and five lines from page 13 of the 9 March 1998 edition of the same newspaper.

These nine lines appeared in official announcements published by the state in the newspaper. These included local authority lists of foreclosure auctions, and provided the names of the owners of the properties.

Costeja Gonzalez's house was sold, the debt repaid, and the case was closed and forgotten. But when La Vanguardia digitalised its archive of printed editions, the two 1998 newspaper pages were made available on the internet. Googling "Mario Costeja Gonzalez" quickly brought up links to the two old editions of the paper.

One day, a client suggested that he might want to try googling himself. The client himself was quite relaxed about the situation - however, according to Costeja Gonzalez, it was not existing customers but potential clients that were the problem.

He contacted a lawyer, who refused to take the case.

"I got one refusal after another. It was as though I was trying to convince them of the existence of aliens. They didn't see the point," explains Costeja Gonzalez.

The months passed, and he became increasingly desperate. At one point he decided to spell his name incorrectly on his business cards so that the search results would not show up when potential customers googled him. Instead of "Costeja" he wrote "Costeza" - the names are both pronounced the same in Spanish.

Removing information from Google

Not far away, lawyer Joaquin Munoz had just founded a legal firm. The firm specialised in company law, but Munoz had written an entry on his private blog about privacy online.

Under the heading "Deleting personal information from Google", he described why search engines were legally obliged to remove links to damaging information - and not only when the information was false, but also when it was incomplete or outdated.

"I received a lot of enquiries as a result of that blog from people who wanted to hire me to remove information from Google," recalls Munoz. "I turned them down, primarily because the majority of them had done something illegal or unethical and wanted the details about this to be deleted."

But then Mario came along.

"Mario had a genuine problem, and I thought he deserved help. Also, his case contained three elements that led me to believe that we could win: the information was clearly out of date, it damaged his professional career, and it had been digitalised long after it had ceased to be relevant," explains Munoz.

The right to be forgotten

So the lawyer took the case.

The pair first contacted the newspaper and asked the editors to remove the relevant pages from search engine results. The paper refused, explaining that it was obliged by the authorities to provide the information at the time, and that the information was not wrong. La Vanguardia did not answer requests for an interview about this.

Next, Munoz and Costeja contacted Google in Spain and asked them to remove the search result. Google rejected this request.

In light of these two rejections, Munoz and Costeja turned to the Spanish Data Protection Agency, which decided that the newspaper was without blame, but that Google should remove the search results.

A search for "Mario Costeja Gonzalez" should no longer bring up the two search results. Google disagreed with this decision, so the company appealed it, and it was then referred to the Spanish courts.

However, the court could not reach a decision because the EU's rules on the protection of personal data were unclear, and instead referred the case to the European Court of Justice (ECJ) to clarify a number of questions. The heart of the matter was: Does an EU citizen have the right to be forgotten?

When you brought the case, did you actually believe that you could defeat Google?

"In all honesty, no. I hoped we could, but I knew it would be very difficult," says Costeja Gonzalez.

So why did you bring the case?

"I did it not just for myself, but also for the sake of my children and the next generation. There would have been no recourse for them in the future if they found themselves in the same situation as me."

On the other hand, Munoz, the lawyer, was hopeful.

"I was quite convinced we would win. But I also had the sense that the case might also get turned on its head in an instant. We were up against one of the world's biggest companies with an army of expensive lawyers and strong lobby connections to people in power," he says.

Greece with Google

It turned out that Munoz and Costeja Gonzalez would not be fighting alone. Any EU country can choose to send an opinion when the ECJ processes a case. And five countries - Spain, Italy, Austria, Poland and Greece - did so in Mario Costeja Conzalez vs Google Spain.

Costeja Gonzalez's own country, Spain, entered into the case firmly on his side: the position of the Spanish government was that Google was subject to EU law, even though the company was headquartered in the US, and, in Costeja Gonzalez's specific situation, the damage to him outweighed the interests of either the search engine or other citizens in revealing the information. Italy supported this view.

The Austrian and Polish governments took the view that Google could in principle be legally compelled to remove search results - and that the search engine is responsible for results that show up. But, in this specific case, their position was that the information should not be removed.

Greece was the only country that entered the case leaning towards Google's side. The Greek government took the view that Google could not be regarded as being accountable for the data because the search engine is no more than an intermediary - the accountable party must be the website to which Google provided the link.

On this point, Greece and Google were in agreement.

Finnish lawyer

At the start of 2013, the "Mario Costeja Gonzalez v. Google Spain" case landed on the desk of Niilo Jaaskinen. At that time, this prominent Finnish lawyer was working for the ECJ.

For complex matters, the ECJ takes advice from its advocate general, who reviews the case and provides an opinion to the judges. In most cases, the ECJ rules in accordance with the advocate general's recommendations. The eyes of the world were therefore on Jaaskinen and his team of experts.

Jaaskinen occupied the post of advocate general until October 2015. Today, he serves as a judge in Finland's Supreme Administrative Court.

He now says, "This was the most interesting case I encountered during my six years as advocate general. The case touched upon a completely new question, which my panel examined in great detail."

In order to reach a conclusion, the most important task for Jaaskinen was to decide how an outdated law should be interpreted.

"The problem was that the law was written before the internet was an issue. The relevant law regarding data protection came into force in 1995, and, as such, it no longer fit with the real world. Therefore, I attempted to apply an updated version of the principles behind the law in my interpretation," he recalls.

He recognised that five countries and the European Commission had taken a position on the case.

"I was surprised that so few EU member states were involved in the case. It seemed as though the positions of most countries had been determined by their respective data regulatory authorities and they had a rather simple position, with the exception of Greece," he says.

He believes that the contradictory positions of member states reflect the fundamentally different political cultures that exist between countries - even within the EU.

"I am from a culture in which we place very high value upon freedom of information. It may be that I represent a minority view. It has gradually become apparent that only the US still holds the position that information that is legal should not be removed from the internet," he says.

National differences

George Brock is the author of the book 'The Right to Be Forgotten' (2016), in which he describes the Google case and its consequences. Brock, a former head of journalism at City University in London and now lecturer at the same institution, also acknowledges the national differences within the EU.

When it comes to the balance between freedom of information and the right to privacy, countries such as Germany, Spain and France tend to lean towards privacy, while countries such as Sweden and Britain favour freedom of information. In the US, freedom of information is more or less sacrosanct.

In his book, Brock explains that the First Amendment of the US Constitution, which protects free speech, and along with a lack of specific protection for privacy in the Constitution, it makes it difficult to regulate the access to information and protection of privacy in the US.

According to Jaaskinen, although European countries are divided, EU law generally tends to favour data protection.

So if we look at the EU's legal framework, is data protection stronger than freedom of information?

"If you compare the two, then yes. Personal data and the right to privacy are strongly protected in the EU Charter of Fundamental Rights," says Jaaskinen in summary.

Advocate general's opinion

The advocate general spent two months researching the case before delivering his opinion on 25 June 2013.

In it, he supported Costeja Gonzalez's view that EU law is indeed applicable to Google, even though the company is headquartered in the US. But Jaaskinen rejected the claim that Google can be held responsible for the content of search results.

As the advocate general put it: "The internet search engine service provider merely supplying an information location tool does not exercise control over personal data included on third-party web pages."

Jaaskinen also rejected the view that there is a legal basis for introducing what later came to be known as a "right to be forgotten". The advocate general's assessment was that there should be compelling legitimate grounds for removing information about oneself from the internet - which Costeja Gonzalez did not have.

"A subjective preference alone does not amount to a compelling legitimate ground," the opinion finds.

In summary: Jaaskinen advised the ECJ to reject Costeja Gonzalez's case.

"I must admit that I was worried when the advocate general gave his opinion. I started to think that we may actually lose the case. After all, in the overwhelming majority of cases, the judges follow the recommendations of the advocate general," says Joaquin Munoz.

Yet the advocate general's opinion was followed by silence. An unusually long silence. The judges spent almost a year discussing and deliberating before issuing their ruling.

The long-awaited result

The ruling was handed down on 13 May 2014.

"We couldn't afford for me to go to Luxembourg in person, so when the judgment was handed down, I was sitting in my office at home, repeatedly clicking 'refresh' on the court's website. Then the phone rang," recalls Joaquin Munoz.

It was a Spanish radio journalist, calling from the court in Luxembourg, says Joaquin Munoz.

"You've won," the journalist said. "We've won what?" asked the lawyer, given that the judgment was to address a number of different points.

"All of it!" exclaimed the journalist.

Five years after the case had begun in a the small legal office in Spain, it was now settled. Google had lost on all the key points.

The ECJ had determined that EU citizens have what quickly became dubbed the "right to be forgotten", unless there are "special grounds" for this right not to apply.

"Those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject's name," the ECJ states, adding that this rule can be overruled by other concerns, "such as the role played by the data subject in public life" or if "the interference with his fundamental rights is justified by the preponderant interest of the general public".

A wave of phone calls

"Everything went as expected," laughs Joaquin Munoz today.

That day he received 175 phone calls from journalists.

"Journalists called from countries I'd never heard of," adds Costeja Gonzalez, who lost count of the number of people he spoke to on the phone that day.

"I remember being overwhelmed with joy. It felt like a milestone, a life goal, that I had reached. I felt that I had opened the door for lots of other people," he says.

Jaaskinen stresses that he understands the ECJ's judgment, even though it contradicted his own position.

Were you surprised when the ruling was handed down?

"Well. If the ruling had been issued soon after I had given my opinion, I would have been surprised. But it took an unusually long time, so I had a feeling it might go this way."

When Jaaskinen reflects on the ECJ's decision today, he acknowledges the thorough work of the judges.

"Actually, I think that the judgement was more thought through than my opinion. Given what we know today about surveillance and data protection on the internet, the ECJ finding has established a good foundation for debate and new legislation. But I believe that the case has also led to a lack of clarity. National courts find it difficult to balance different rights, and they come to different conclusions. We need the ECJ to address a range of similar cases in order to clarify the legal interpretation."

You described it as "the most interesting case" you ever worked on during your whole time as advocate general. Why?

"Because the ruling has such serious consequences. Following the judgment, Google has become the most important data controller. This is a significant development because Google now makes decisions without either the content provider or the users, who no longer have access to the information, having a say in the matter," says Jaaskinen.

"It is a significant ruling in a more general context, too. It has established the principle that it should be possible to remove legitimate information from the internet. This makes service providers such as Google vulnerable to similar requests from other systems of government, like Russia or Turkey. The EU can no longer say to other governments that it is wrong to suppress legitimate information on the internet - because the EU itself already does precisely that."

"Google has responded to the ruling with respect. The company quickly and efficiently established guidelines and an internal system for dealing with inquiries. The problem is that there is very little transparency around the way in which cases are assessed and resolved. Hundreds of thousands of juridical decisions are made without anyone on the outside knowing how, and without these decisions coming before a court or another authority. Google themselves say that they are inclined not to remove information. We know very little about their procedure, but the result is that over 40 per cent of requests end with Google removing the search results."

Did you already have these principles in mind when you gave your opinion?

"Yes, certainly. That was why it was such a complicated process," says Jaaskinen.

Google as data controller

Google was prepared for the court's ruling, whatever the outcome. This explains why the ruling was received with diplomatic calm and understanding, even though the search engine giant made it clear in the media that it disagreed with the judges' interpretation of the law.

"Having said that, we will of course respect the authority of the court and do our best to comply with the ruling quickly and responsibly," stated Google in a blog post on 11 June 2014.

Google established a council of experts, who set out the guidelines that the company has subsequently used as the basis for its actions when citizens request that search results be removed. The company assesses each case, and if the search result is deleted, the company informs the website to which the result is linked. No information is provided about what exactly is removed, why or who has complained.

If Google refuses to delete a search result, the complainant may take the case to the local data protection authority.

And many deletion requests have been made. At the time of writing, around 800,000 search results have been deleted, a number that is growing by 1,500 to 2,000 per day according to the latest figures on Google's own website.

Munoz praises the US tech giant for accepting defeat and acknowledging the judgment of the court.

"Google has been quick yet thorough in adapting its search results following the court ruling. They have established a system that ensures a reasonable balance between freedom of information and the right to privacy. I know of several cases in which, for example, terrorists and paedophiles have had their appeals for the deletion of results denied because the information about them was in the public interest."

Google did not want to be interviewed about "the right to be forgotten", its international spokesman Al Verney tells.

Privatising censorship

The "right to be forgotten" addresses one of the most important basic debates about privacy since the advent of the internet, believes Vibeke Borberg, a professor in media law at the Danish School of Media and Journalism. She argues that the ECJ ruling was comprehensive and thorough, and recently wrote a legal article about the consequences of the case.

"The court had the difficult problem of trying to balance freedom of information and data protection. It solved this problem in a smart way. The court has established a kind of differentiated responsibility for personal data: an article can be legal on a website, while it has to be removed from search results when searching for a persons's name," she explains.

But the "right to be forgotten" has many critics. One of the most prominent is the US-based international organisation for press freedom, the Committee to Protect Journalists (CPJ).

"We are at the frontline in the fight about freedom of information on the internet," says Courtney Radsch, head of advocacy for the organisation.

The CPJ criticises the European "right to be forgotten" on the grounds that it damages freedom of speech and information around the world.

"It was obvious that the ECJ ruling was problematic as soon as it was made. There was no clear definition of what the 'right to be forgotten' is, or how it should be interpreted. The ruling also established a completely new human right that is not mentioned in any charter, any treaty or any convention," says Radsch.

The CPJ believes that the judgment hands far too much power to private companies such as Google, now that the company has become judge and jury in hundreds of thousands of cases, which balance the right to privacy against freedom of information. Unless the complainant is dissatisfied and takes the case to the authorities, any complaint will be dealt with behind closed doors in accordance with Google's own procedures.

"This way of privatising censorship is a dangerous tendency. The right to interpret rules and make decisions with serious consequences for democracy is handed over to a private company without transparency or any form of public scrutiny."

According to Radsch, the CPJ has recorded a range of cases in which non-democratic countries attempt to abuse the "right to be forgotten".

"Unfortunately, we have seen cases in Latin America and the Middle East where powerful people attempt to misuse the "right to be forgotten" to conceal their past. The EU has established a dangerous precedent with its ruling because the way in which this new right should be interpreted is so loosely defined," she says.

The next big battle

Since the EU ruling, a number of cases touching upon the fundamental principles underlying the right to be forgotten have come before national courts in various EU countries. There have been significant differences in the ways in which they have interpreted the rules.

However, right now, the eyes of the world have been drawn to one particular case in France. The case may be the next big battle about the "right to be forgotten", as the it may settle the question: Can you limit the "right to be forgotten" to Europe, or will it have to cover the whole world?

In France, Google was slapped with a €100,000 fine by the French Data Protection Agency because the company had only removed search results in the EU, while continuing to make them available for the rest of the world. As such, according to the French authorities, the company was not complying properly with the "right to be forgotten".

Google takes the opposite view: it is a question for each country to determine for itself what its citizens can and cannot find when they carry out a Google search.

"For the last 18 months, we've been defending the idea that each country should be able to balance freedom of expression and privacy in the way that it chooses, not in the way that another country chooses," wrote Google's global privacy counsel, Peter Fleischer, in an email.

The case has been referred to the ECJ - once again leaving the decision in the hands of the Luxembourg-based judges.

Many observers think that the French case could become as significant for the future of the internet as the Spanish one had been.

The former advocate general, Jaaskinen, believes that the French case touches upon "powerful principles that collide with each other".

"I don't hold a view [about the case], and if I did, I wouldn't reveal it. But the French case will be decisive for the future of the internet: can one country decide what the citizens of another country can see online?" he asks.

Meanwhile, Radsch, from the Committee to Protect Journalists, says that the French case demonstrates the fundamental problems raised by the "right to be forgotten".

"What are we going to do when countries that do not have the democratic controls of the same high level as France, demand that Google deletes content in accordance with the principle of the "right to be forgotten"? Should Turkey have the right to decide what French citizens can see on the web?" she asks.

The paradox

So what happens when you google "Mario Costeja Gonzalez" today?

Over 22,000 search results come up, the vast majority of them about the Google case. Most articles and posts mention that fateful foreclosure auction from 1998 that he tried to have the world forget.

Costeja Gonzalez is well aware of the paradox. He has spent five years fighting a case to hide information which is now everywhere.

"When the case came before the ECJ, we were well aware that it would be widely discussed. We sat down, discussed it, and I decided that it was worth it. I brought the case not so much for myself as for the next generation. There is a price to pay, but I think it is worthwhile," he says.

Today, Costeja Gonzalez is no longer a financial adviser. His company went bankrupt in the financial crisis. He has returned to his former line of work, calligraphy, and is also a consultant on digital privacy.

Joaquin Munoz, the lawyer, travelled around the world giving presentations about "the right to be forgotten", but remained with his small legal firm until about a year ago.

Today he works for an international law firm where he is in charge of developing its Latin American digital copyright department.

This article was first published in the Danish magazine 'Journalisten' and has been edited for EUobserver. Translation was done by Dale Pyatt


GDPR does not (yet) give right to global oblivion

The 'right to be forgotten' will become enshrined in EU law on Friday, but it is not yet clear to what extent it will apply. Will the EU's law determine how the internet looks globally?


Stop Eurocentrism, start a universal history of ideas

Eurocentrism in our education and thinking is actually a product of a German-Christian ideology of the 18th century. Instead of admitting guilt we should change the way we study and teach history.


The CPDP conference wants multidisciplinary digital future

During the Computers, Privacy and Data Protection (CPDP) conference, many high-level discussions will touch upon the dynamics of decision-making in the design of new technologies, including the importance of inclusion, diversity, and ethics perspectives within these processes.

EU Commission won't probe 'Pegasus' spyware abuse

The European Commission says people should file their complaints with national authorities in countries whose governments are suspected of using an Israeli-made Pegasus spyware against them.

News in Brief

  1. Dutch journalists sue EU over banned Russia TV channels
  2. EU holding €23bn of Russian bank reserves
  3. Russia speeds up passport process in occupied Ukraine
  4. Palestinian civil society denounce Metsola's Israel visit
  5. Johnson refuses to resign after Downing Street parties report
  6. EU border police has over 2,000 agents deployed
  7. Dutch tax authorities to admit to institutional racism
  8. Rutte calls for EU pension and labour reforms

Stakeholders' Highlights

  1. Nordic Council of MinistersNordic delegation visits Nordic Bridges in Canada
  2. Nordic Council of MinistersClear to proceed - green shipping corridors in the Nordic Region
  3. Nordic Council of MinistersNordic ministers agree on international climate commitments
  4. UNESDA - SOFT DRINKS EUROPEEfficient waste collection schemes, closed-loop recycling and access to recycled content are crucial to transition to a circular economy in Europe
  5. UiPathNo digital future for the EU without Intelligent Automation? Online briefing Link

Latest News

  1. EU summit will be 'unwavering' on arms for Ukraine
  2. Orbán's new state of emergency under fire
  3. EU parliament prevaricates on barring Russian lobbyists
  4. Ukraine lawyer enlists EU watchdog against Russian oil
  5. Right of Reply: Hungarian government
  6. When Reagan met Gorbachev — a history lesson for Putin
  7. Orbán oil veto to deface EU summit on Ukraine
  8. France aims for EU minimum-tax deal in June

Join EUobserver

Support quality EU news

Join us