Europeans have the right to disappear from a search engine’s results under certain conditions. Directive 46/1995 as interpreted by Google Spain judgment (Case C-131/12) and GDPR Article 17. This is the so called “right to be forgotten” or right of erasure (also known as de-referencing or de-listing). The Court of Justice of the European Union (“ECJ”) has recently issued a landmark decision on this topic, ruling that currently when Google grants a request for de-referencing, it does not have to apply the “delisting” globally. Google vs. CNIL, Case C‑507/17.
A complete victory for Google? Not so fast.
Google’s violation that originated the case was under Directive 46/1995, but the decision is also effective under GDPR Article 17.[i]The ECJ held that Articles 12(b) and 14(1)(a) of the Directive and GDPR Article 17(1) must be construed to mean that
where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
Why not a complete vindication of Google then? Because of qualifications to the holding of the opinion and a caveat that the ECJ inserted immediately before the conclusion that opens the possibility for a different result.
Let’s see the decision in details.
FACTS: Google received a penalty of EUR 100 000 imposed by the CNIL (French DPA) because Google – when granting a de-referencing request – failed to apply it to all its search engine’s domain name extensions. The position of Google was that it could just remove the links from the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States. The CNIL did not find it sufficient and it did not find sufficient the geo-blocking’ proposal Google suggested, either.[ii] Google sought annulment of the CNIL’s adjudication with the Conseil d’État (Council of State, France). Google Inc. v Commission nationale de l’informatique et des libertés (CNIL). [iii]
The Conseil d’Etat ascertained that all of Google’s search engine domain names could be accessed from French territory and that even if, in principle, the search engine redirects the searcher to the domain name corresponding to the State from which that search is made based on the user’s IP address, searchers remain free to conduct their searches using the search engine’s other domain names. Opinion at 36 and 37.[iv]
The Conseil d’Etat raised three interpretative issues to the ECJ regarding the scope of the de-listing with reference to the Directive and the GDPR.[v]
OPINION:
First, the ECJfound that there was no doubt that Google carries out processing “within the framework of Google’s establishment in French territory” and was therefore subject to the GDPR. Opinion at 52.[vi]
Second, the ECJ notes that “de-referencing carried out on all the versions of a search engine would meetthe objective of guaranteeing a high level of protection of personal data throughout the European Union (Recitals recitals 10, 11 and 13GDPR) in full. Emphasis added. Opinion at 55. But there are countervailing considerations. First, while the internet is a “a global network“without borders” and search engines make the results “ubiquitous” so that the EU would have a point in requesting the de-listing on all the versions of the search engines (Opinion at 56-58),many third countries do not recognize the right to de-referencing or have a different approach to it. Id. at 59.
In addition, the right of protection of personal data “is not an absolute right” but must be balanced “in relation to its function in society” and “against other fundamental rights, in accordance with the principle of proportionality,” those rights being first of all the freedom of information of internet users; the balance between the two “is likely to vary significantly around the world.” Id. at 60.
Third, while GDPR Article 17(3)(a) struck a balance between the right of protection of personal data and freedom of information “so far as the Union is concerned,”the EU data protection law “has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.” Id. at 61. In particular, the ECJ finds nothing in Article 12(b) and 14(1)(a) of the Directive or GDPR Article 17, that clearly shows that EU law in order to ensure an high level of protection of personal data throughout the EU would choose to confer to the right of being forgotten “a scope … which would go beyond the territory of the Member States” and to “to impose on an operator . . . like Google … a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.” Id. at 62.
Another reason why the scope should not go beyond the EU is that while the GDPR provides mechanisms of cooperation among the European DPAs (which,where appropriate, can come to a joint decisionbalancing a data subject’s right to privacy and public access to information in the several Member States; see Articles 56 and 60-66), such mechanisms do not exist outside the EU. Id. at 63.
As a consequence, the ECJ finds that there is no obligation under current EU law for a search engine operator who grants a request for de-referencing (either following a data subject’s request or a DPA’s or judicial authority’s injunction) “to carry out such a de-referencing on all the versions of its search engine.” (Id. at 64) and “a search engine operator cannot be required” under the Directive or the Regulation “to carry out a de-referencing on all the versions of its search engine.” Id. at 65.
Fourth, to be effective the de-referencing must be carried out “in principle … in respect of all the Member States” and not only “on the version of that search engine corresponding to the Member State of residence of the data subject” because now the EU data protection is in a regulation and that has been done “to ensure a consistent and high level of protection throughout the European Union”(Id. at 66). However, the public’s interest in accessing the information may vary among Member States because the balance between right or privacy/data protection and the interest of the public in accessing information may, be struck differently (especially considering that Member States can provide exemptions and derogations for processing undertaken solely for journalistic purposes or for the purpose of artistic or literary expression). Id. at 67.[vii]
However, the Google’s victory is limited in at least three respects:
First, the ECJ finds that it is for the search engine operator to take “sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights” meaning that those measures must “meet all the legal requirements” and result in “preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name” (Id. at 70) and it is for the referring court (here the Conseil d’Etat) to ascertain whether the measures adopted or proposed by Google meet those requirements.Id. at 71.[viii]
Second, near the end of the opinion the ECJ insert a caveat, indicating that Member States could choose to extend the right of de-referencing:
Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights … a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.Opinion at 72 (emphasis added and internal citations omitted)
Finally, as noted above, the ECJ recognizes the right and ability of the DPAs to coordinate their activities to give broader application to de-referencing.
So, how should the decision be characterized? A total victory for Google – certainly not. A hallow victory for Google – by no means. Perhaps – A Google victory that can be eroded by Member States acting individually or in concert through their DPAs.
Read FULL OPINION
For more information Francesca Giannoni-Crystal
For press regarding the decision, read here and here
____
ENDNOTES
[i]The ECJ clearly states this intention. Opinion at 41
[ii]Opinion at 32:
The CNIL also regarded as insufficient Google’s further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject’s name, no matter which version of the search engine they used.
[iii]Read the story of this case: Update on French Conseil d’Etat’s request for a preliminary ruling on the right to be forgotten; Conseil d’Etat requests preliminary ruling from CJEU on Right to be Forgotten
[iv]“[T]he search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries on its activities. Where the search is conducted from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the State from which that search is deemed to have been made, as identified by the internet user’s IP address. However, regardless of his or her location, the internet user remains free to conduct his or her searches using the search engine’s other domain names. Moreover, although the results may differ depending on the domain name from which the search is conducted on the search engine, it is common ground that the links displayed in response to a search derive from common databases and common indexing.” Opinion at 36.
[v](1) Must the “right to de-referencing”, as established by the [Court] in its judgment of 13 May 2014, [Google Spain and Google (C‑131/12, EU:C:2014:317),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]?
(2) In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States …?
(3) Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46], regardless of the domain name used by the internet user conducting the search?’
[vi] The Court has held that the processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 60).
In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Union are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that search engine is, at the same time, the means enabling those activities to be performed, the display of the list of results being accompanied, on the same page, by the display of advertising linked to the search terms (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraphs 56 and 57).
That being so, the fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establishment of the controller on the territory of a Member State escaping the obligations and guarantees laid down by Directive 95/46 and Regulation 2016/679 (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 58).
In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that, in those circumstances, that act of processing is carried out within the framework of Google’s establishment in French territory. It thus appears that such a situation falls within the territorial scope of Directive 95/46 and Regulation 2016/679. Opinion at 49-52.
[vii]The ECJ specifies that for cross-border processing, the DPAs concerned “must cooperate in order to reach a consensus and a single decision” with which the controller must ensure compliance as regards processing activities in the context of all its establishments in the Union and the DPAs must to provide each other with relevant information and mutual assistance” to implement the GDPR in a consistent way. Id. at 68.
[viii]As toGoogle’s technical solutions to corral the internet search, the ECJ says:
During the proceedings before the Court, Google explained that, following the bringing of the request for a preliminary ruling, it has implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national version of the search engine accessed by that user. Thus, the internet user is now automatically directed to the national version of Google’s search engine that corresponds to the place from where he or she is presumed to be conducting the search, and the results of that search are displayed according to that place, which is determined by Google using a geo-location process. Opinion at 42