Key-words: right to be forgotten - GDPR fine - European Court of Justice

On 10 March 2016, the French data watchdog CNIL had imposed a fine of EUR 100,000 on Google Inc. of their refusal, when accepting an application for de-referencing, to apply this to all the extensions of the domain name of his search engine, limiting to suppressing the links only from the results displayed following research carried out on the declinations of his search engine whose domain name corresponds to a Member State.

Following the watchdog's fine, Google appealed to France's highest court, the Council of State, which in turn referred to the ECJ several questions for a preliminary ruling in order to establish how the rules of EU protection of personal data (now GDPR) must be interpreted. I.e. whether in the sense that, when the operator of a search engine accepts an application for "de-referencing", he is obliged to carry out on all versions of his search engine or, on the contrary, only on those versions corresponding to all the Member States, or only on that corresponding to the Member State of residence of  the de-referencing beneficiary.

ECJ notes that the establishment Google Inc. has on French territory carries out activities, in particular commercial and advertising ones, which are inseparably linked to the processing of personal data carried out for the needs of the search engine and, on the other hand, that the mentioned search engine must be considered – in the light of the existence of bridge applications (gateways) between its different national versions - a subject that carries out a single processing of personal data in the context of the activities of French establishment of Google Inc. This situation therefore falls within the scope of application of the Union legislation on personal data protection.

The Court emphasizes that, in a globalized world, access by Internet users, particularly those located outside the Union, to the referencing of a link, which refers to information concerning a person whose center of interests is in the Union, it can produce immediate and substantial effects on that person within the Union itself, which is why a global operator de-indexation would be suitable to fully achieve the protection objective pursued by EU law. However, it states that many third States do not recognize the right to de-referencing or otherwise adopt a different approach to this right; in the same way, the balance between the right to respect for private life and the protection of personal data, on the one hand, and freedom information of Internet users, on the other hand, can vary greatly around the world.

However, it does not appear from the legal texts that the EU legislature carried out such a balancing with regard to the scope of a de-referencing outside the Union, nor that it chose to give the rights of individuals a scope that goes beyond the territory of the Member states. Moreover, EU law does not provide for cooperation instruments and mechanisms regarding the scope of a de-indexation outside the Union. The Court therefore concludes “currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.

However, EU law requires a search engine operator to carry out such a de-referencing on the versions of its search engine corresponding to all the Member States and to take sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights.” In this sense, such a de-referencing must, if necessary, be accompanied by measures that effectively discourage Internet users who carry out from one of the Member States a search on the basis of a data subject’s name from gaining access, through the list of results displayed following this search through an "extra UE" version of the aforementioned engine, to the links that are the subject of the de-indexing application. Some commentators have not failed to point out that Google has achieved an important victory linked to the segmented application of such a fundamental law on privacy as the "right to be forgotten", which rather would seem to have a difficultly divisible character.

Source: Court of Justice of the European Union, Press release No 112/19, Luxembourg, 24 September 2019.

 Link: https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-09/cp190112en.pdf

 View: document (ECJ, 24 September 2019, Google LLC, C‑507/17 - ECLI:EU:C:2019:772)

To read the PDF click here.