In its judgements of 24 September 2019, the European Court of Justice (ECJ) ruled that "de-referencing" is limited to just European Union domains and that Google does not have to remove search results simply because they contain sensitive information.
This is not the first time that Google has dealt with the right to be forgotten under Privacy Directive 95/46. In the landmark case Google Spain, it became clear that search engines can be forced to remove links to information about individuals. In the aftermath of the Google Spain case, Google witnessed a high increase in requests to have search results de-listed. Some of these requests caught the eye of the French Data Protection Authority (CNIL), resulting in proceedings before Europe’s highest court, which has now ruled in favour of Google.
Territorial scope: no right to be forgotten outside the EU
In the first case (C-507/17), the ECJ was asked to clarify the territorial scope of the right to be forgotten. The CNIL had ordered Google to apply de-listings to all the domain name extensions of its search engine and not only to the European ones. As Google refused to comply, limiting the scope of the de-listing to searches of its search engine whose domain name corresponds to an EU Member State, the CNIL imposed a fine of EUR 100,000. The ECJ was asked to clarify whether the provisions of Directive 95/46 require de-referencing at national, European or world-wide level.
Following the opinion of the Advocate General, who was not in favour of such “world-wide de-referencing”, the ECJ said that “where a search engine operator grants a request for de-referencing pursuant to those provisions, operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.”
The case is of great importance since the ECJ’s decision prevents Europe from being able to regulate the Internet beyond its borders, which could have been detrimental to the right of freedom of speech and access to information.
Prohibition on processing certain categories of sensitive data: balancing test
In the second case (C-136/17), several people had requested Google to de-reference links to pages published by third parties which involved a satirical photomontage of a politician, an article referring to someone as a public relations officer of the Church of Scientology, the judicial investigation of a politician, and the conviction of someone for sexual assaults against minors. Since Google refused de-referencing, claiming that this personal data, while sensitive, was nevertheless of public interest and should therefore not be de-referenced, the parties brought their case before the French Council of State (Conseil d’Etat). The French Council of State addressed specific questions to the ECJ regarding sensitive personal data and the difficulties arising from the application of Directive 95/46.
The ECJ stated that the prohibition or restrictions relating to the processing of special categories of personal data also apply to operators of search engines. The operator of a search engine is responsible not because the sensitive data appear on a web page published by a third party but because of the display of the link to that web page in the list of results presented to internet users following a search.
Furthermore, the ECJ emphasised that in some circumstances, the internet users’ right to know may override a right to privacy. The balance between these rights must be made in each individual case: “In any event, when the operator of a search engine receives a request for de-referencing, he must ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 or Article 9(2)(g) of Regulation 2016/679 and in compliance with the conditions laid down in those provisions, whether the inclusion of the link to the web page in question in the list displayed following a search on the basis of the data subject’s name is necessary for exercising the right of freedom of information of internet users potentially interested in accessing that web page by means of such a search, a right protected by Article 11 of the Charter. While the data subject’s rights protected by Articles 7 and 8 of the Charter override, as a general rule, the freedom of information of internet users, that balance may, however, depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”
According to the ECJ, search engines such as Google must react to requests to exercise the right to be forgotten relating to a link to a web page on which sensitive data are published, taking into account all the relevant factors of the particular case, the seriousness of the interference with the data subject’s fundamental rights to privacy, and protection of personal data. Furthermore, search engines must only keep the particular link in the list of results displayed following a search on the basis of the data subject’s name when it is strictly necessary for people's freedom of information rights to be preserved. In addition, where the processing relates to information made public by the individual him- or herself, an operator of a search engine may refuse to accede to a request for de-referencing provided that the processing satisfies all the other conditions of lawfulness and unless the data subject has the right to object to that processing on compelling legitimate grounds relating to his or her particular situation.
Finally, regarding information on criminal proceedings, which no longer correspond to the current situation, it is for the operator of the search engine to assess whether the data subject has the right to no longer have his or her name linked to a list of results displayed following a search carried out on the basis of his or her name. Once more, this consists of a balancing test where the search engine must analyse whether in the particular case the data subject’s rights to privacy and data protection override the right to information, taking into account the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by that person in public life, his or her past conduct, the public’s interest at the time of the request, the content and form of the publication, and the consequences of publication for that person.
As the Advocate General stated in his opinion: “reconciling the right to privacy and to the protection of personal data with the right to information and to freedom of expression in the internet era is one of the main challenges of our time.” Since the balancing test described by the ECJ leaves room for interpretation, we assume more cases will follow shortly. To be continued…
Authors:
Bastiaan Bruyndonckx
bastiaan.bruyndonckx@lydian.be
Olivia Santantonio
olivia.santantonio@lydian.be
Liese Kuyken
liese.kuyken@lydian.be
