The long awaited decision in the so called “Google Spain” (CJEU case C-131/12) is in, with a smash.

The court, contrary to AG JÄÄSKINEN, considers search engines to be data controllers that process personal data in view of the Data Protection Directive 95/46/EC. As such, they are obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, even when its publication in itself on those pages is lawful, IF the interests of the data subject to have the result removed outweighs public interests of retaining the results. As a rule, the interests of the data subject not only override the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.

This decision provides individuals legal means to have their data removed from search engines. It does not create a blanket order and takedown right (or obligation for search engines to take dawn data) because the search engine will have still have to balance the interests. The interests of Google and the general public, however, have lost weight in this balance.

This is an important win for individuals. All is not lost for privacy.