Case Summary and Outcome

The French Council of State overturned a public financial penalty imposed on Google by the restricted committee of the CNIL (French data protection authority) for failing to uphold the right to be forgotten. The CNIL had ordered a pecuniary sanction against Google Inc. on the grounds that it refused a delisting request on all the domain names of its search engine. The Council of State noted that European law requires national authorities to balance the individual’s right to data protection and the general freedom of information, and that as the CNIL had not conducted this balancing exercise its judgment was wrong in law.

Facts

On May 21, 2015, the President of the French data protection authority, the CNIL, served formal notice on Google Inc., on behalf of an individual who had sought the removal of certain links leading to web pages from the list of results following a search of his name. The CNIL notice requested that this deletion take place on all Google’s domain name extensions of its search engine. 

On March 10, 2016, the restricted committee of the CNIL issued a deliberation after noting that Google had not, within the time limit, complied with this formal notice, and issued a sanction of 100 000 Euros. The sanction was made public. The CNIL’s restricted committee considered the proposal of “geo-blocking” – which prevents  Internet users located in the same country as the requester from viewing the disputed search results through other domains – as insufficient. By failing to remove the links from all domains of Google, the disputed referenced information remained consultable by any Internet user located outside France and enabled a possible circumvention of the local Google domain.

Google Inc. brought an appeal before the Council of State seeking the cancellation of the sanction imposed on it.

Decision Overview

The French Council of State delivered the judgment. The main issue before the Council was to determine whether the sanction imposed by the CNIL against Google Inc. had legitimate grounds. 

Google Inc. argued that there is no legislative provision requiring that delisting be carried out outside the territory of the Member States of the European Union. It referred to the Court of Justice of the European Union’s (CJEU) judgment in Google LLC v. CNIL  where the CJEU had noted that European Union (EU) law does not provide for an obligation on an operator to carry out delisting on all versions of its engine, nor for instruments or cooperation mechanisms to provide for delisting outside the Union. It had emphasized that EU law did not prohibit supervisory authorities from balancing the data subject’s right to respect for his private life and the protection of his personal data with the right to freedom of information in creating national standards for the protection of fundamental rights to found a request for delisting on all the versions of a search engine. However, it highlighted that the ability granted to the supervisory authorities by the CJEU to order the application of the right to delisting on all versions of the search engine is not absolute and this power of injunction is conditional on the prior realization by the supervisory authority of a balance between the right of the person concerned to respect for his private life and to the protection of personal data and the freedom to information.

In the light of this requirement, the Council of State held that the restricted committee of the CNIL committed an error of law in pronouncing the disputed sanction because it did not carry out the balancing exercise required by the CJEU.