Supreme Court, Civil Chamber, An individual v Google Spain, 210/2016

Holding Google Spain SL liable for damages for failing to remove links to personal information after a “right to be forgotten” request by the claimant; damages were awarded following art. 19 of the Spanish Data Protection Law, which implements art. 23 of the Data Protection Directive (95/46) that orders Member States to “provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.”; the court rejected the defendant’s contention that Google Spain – the local subsidiary – is not the data controller and thus lacks standing; however, in other cases, another Chamber of the court concedes Google Spain’s lack of standing to be sued