CJEU, Judgment of 13 May 2014, C-131/12, Google Spain
CJEU decision on the "right to be forgotten": derivation of an obligation to erase from the principles of data processing and proactive obligation to remove data that have lost their relevance.
1 Overview
Mario Costeja González had brought proceedings before the Spanish data protection authority against Google Spain and Google Inc. because a search for his name returned results pointing to a newspaper announcement concerning an attachment sale that had long since been settled. The CJEU held that data subjects may, under certain conditions, request the removal of such search results.
Reference: CJEU, judgment of 13 May 2014, C-131/12, Google Spain
2 Significance for the principles of the GDPR
The judgment shapes the principles laid down in Article 5 GDPR in two respects:
- The CJEU derives the obligation to erase from the principles relating to data processing. Data cease to be lawful where, in the light of their purpose, they are no longer adequate, relevant or necessary (paras. 93 et seq.). This idea underlies what is today the principle of storage limitation (Article 5(1)(e) GDPR).
- The obligation to erase exists proactively; the controller may not wait until the data subject asserts a right to erasure (para. 72).
The decision contributed to the shaping of Article 17 GDPR ("right to be forgotten") and at the same time has an effect on the principle of transparency under Article 5(1)(a) GDPR.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, Judgment of 8 April 2014, C-293/12 and others, Digital Rights Ireland
CJEU decision on the invalidity of the Data Retention Directive: requirements for clear and precise legal bases and for data security.
CJEU, Judgment of 1 October 2015, C-201/14, Bara
CJEU decision on transparency in the case of transmissions of personal data between public authorities and on the data subject's right to information.