On Tuesday 24 September, the Court of Justice of the European Union (CJEU) delivered two important judgments on the dereferencing of the personal data of a person who invokes their right to be forgotten. The first and most important judgment (C-507/17) states that this practice is limited to the territory of the EU, and not beyond. The second judgment (C-136/17) regulates the right of a search engine operator to refuse to dereference sensitive personal data, such as criminal convictions.
In 2014, the Court of Justice established the "right to dereferencing" which originated in Directive 95/46, which has since been replaced by Regulation 2016/679 (known as ‘the GPDR’). At the time, the judges in Luxembourg ruled that the operator of a search engine was required to remove links to web pages from the list of results displayed following a search made on the basis of the name of the person, even when publication was lawful. However, the Court did not specify the territorial scope for this requirement.
The right to dereferencing limited to Europe
In light of this, in 2015, France’s Commission nationale de l'informatique et des libertés (CNIL) required Google Inc. to apply a dereferencing request from an individual to all its search engine’s domain name extensions. However, Google then challenged this requirement, and risked a €100,000 fine from the CNIL.
The French Council of State referred this case (C-507/17) to the EU Court of Justice, which ruled in Google's favour. In its judgment, the Court notes that, as it stands, European law does not apply to dereferencing on all versions of a search engine, i.e. world-wide. It recognises that such a provision would make it possible to “guarantee a high level of protection of personal data throughout the European Union”, which is the objective of the GDPR. However, it notes that many third countries are either not aware of the right to dereferencing or adopt a different approach to this right. However, it stresses that the authorities of the Member States remain competent, in the light of national standards of protection of fundamental rights, “to weigh up a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other”, and possibly to take further action.
In absolute terms, the Court recommends limiting this requirement to the territory of the EU, even if this means accompanying the requirement with measures to prevent or limit access to the links that are the subject of the dereferencing request, using a version of this “non-EU” search engine. It therefore recommends that the Council of State evaluate the geo-blocking measures that Google has since put in place to ensure that an Internet user only has access to the results located in the country where he or she is carrying out the search. [The judgment can be found at: http://bit.ly/2moTSX0 ]
Special categories of data:
In the meantime, the Court issued a second judgment, concerning special categories of data, after both Google Inc., and then the CNIL, refused the request from four individuals to de-reference various links leading to web pages published by third parties. These web pages involve a satirical photomontage linking the intimate relationship between two politicians and the way in which the career of one of them developed, a newspaper article linking the former head of public relations of the Church of Scientology to the suicide of one of its members, and accounts of two court proceedings, one of which ended in the charges being dismissed.
In its judgment, the Court points out that a search engine operator may refuse to accede to a request for de-referencing if it establishes that the links at issue lead to content comprising personal data whose processing is covered by the exception under Directive 95/46. The operator must first ascertain, having regard to the reasons of substantial public interest referred to in Article 8 of the directive, whether the inclusion of these links in the list of results displayed following a search is “strictly necessary” for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.
However, the Court points out that an operator is required to accede to a request for de-referencing relating to legal proceedings where the information relates to an earlier stage of the legal proceedings and no longer corresponds to the current situation or where it must, at the very least, adjust the list of results in such a way that it reflects the current position. [The judgement can be found at: http://bit.ly/2loBflS ] (Original version in French by Sophie Petitjean)