Case Summary and Outcome

The Grand Chamber of the Court of Justice of the European Union held in a Preliminary Ruling that the European Union Directive 95/46, which protects the right to privacy with respect to processing sensitive personal data, applied to search engine operators. Four individuals in France brought complaints before the French Data Protection Authority (CNIL) to de-reference links displayed on Google following searches of their names. This included information about their criminal convictions, judicial enquiries, as well as religious and political views. In 2015 and 2016, the CNIL refused to take up their complaints and the four appealed to France’s Conseil d’État (Council of State) against CNIL’s refusal. The Council of State referred to the Court of Justice of the European Union questions regarding the processing of sensitive personal data and the obligations of search engine operators. The Court of Justice found that the processing of personal data by search engines significantly affected privacy rights of those concerned. Data subjects could request de-referencing of such personal data and when assessing them search engine operators had to strike a balance between privacy rights of data subjects and the rights of Internet users potentially interested in that information.

---

Facts

Four individuals with the initials GC, AF, BH and ED requested Google to de-reference or de-index their names from search results leading to web pages published by third parties.

• GC requested the de-referencing of a link leading to a satirical photo-montage placed online pseudonymously in 2011 depicting her alongside the mayor of a municipality whom she served as head of the cabinet and explicitly referring to the impact of that relationship on her own political career.
• AF requested the de-referencing of an article concerning the suicide of a member of the Church of Scientology in 2006 that mentioned him in his capacity as public relations officer of the Church.
• BH requested the de-referencing of press articles from 2006 concerning a judicial investigation into the funding of a political party in which he was questioned. The proceedings against him were closed in 2010 and the articles did not mention this development.
• ED requested the de-referencing of two articles reporting criminal hearings that sentenced him to 7 years’ imprisonment and an additional penalty of 10 years’ social and judicial supervision for sexual assaults on children under the age of 15. One of the articles mentioned intimate details about ED that were revealed at the hearing.

Google denied each of their requests and the four individuals then appealed the decision with the French Data Protection Authority (CNIL). Between 2015 and 2016, CNIL rejected their requests and the applicants filed a further appeal with France’s Conseil d’État (Council of State). The Council of State found that the applications raised several difficulties of interpretation of the European Union Directive 95/46 and referred those questions to the European Court of Justice, leading to the present case.

Directive 95/46 seeks to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to eliminate obstacles to the free flow of personal data. It prohibits the processing of personal data, meaning any information about an identified or identifiable person, without the data subject’s consent. Specifically, Article 8(1) and (5) provide:

8(1): Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

8(5): Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases shall also be processed under the control of official authority.

The prohibition is not absolute and Member States may process personal data on the ground of public interest.

The questions that the European Court considered were:

1. If the prohibition, and their exceptions, relating to the processing of special categories of personal data, mentioned in Article 8(1) and (5) of Directive 95/46 provisions applied to search engine operators.
2. If the prohibition applied, then
   • If search engine operators were required to grant de-referencing requests in relation to links to web pages containing personal data falling within the special categories referred to in Article 8(1) and (5) of Directive 95/46;
   • If search engine operators may refuse de-referencing requests citing consent (Article 8(2)(a)) and public interest (Article 8(2)(e)) exceptions outlined in Directive 95/46
   • If search engine operators could refuse to grant a de-refencing request if the data in question was published solely for journalistic, artistic or literary purposes.
3. Must Article 8(5) of Directive 95/46 be interpreted as meaning that information relating to the investigation of an individual or reporting a trial and the resulting conviction and sentencing constitutes data relating to offences and to criminal convictions? More generally, does a web page comprising data referring to the convictions of or legal proceedings involving a natural person fall within the ambit of those provisions?’

Google argued that the specific features of the processing carried out by the operator of a search engine should exempt them from compliance with Article 8(1) and (5) of Directive 95/46 and Article 9(1) and Article 10 of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

---

Decision Overview

The Grand Chamber of the Court delivered a per curiam opinion to the Preliminary Ruling request by the Council of State, France.

Question 1

The Court began by defining “processing of personal data” as the activity of a search engine that includes finding information online, indexing it automatically, storing it temporarily and making it available to internet users.  Relying on its judgment in the Google Spain case, the Court  reiterated that under Directive 95/46 a search engine must be regarded as the “controller” in respect to processing of personal data.

The Court further noted that the processing of personal data by search engines played “a decisive role in the overall dissemination of those data” and made websites accessible to “internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published.” (para. 36) Search engines also allowed internet users to establish a detailed profile of the data subject. Consequently, search engines significantly affected one’s fundamental right to privacy, and thus their activities fell within the domain of Directive 95/46.

Article 8(1) of Directive 95/46 provides that the Member States must prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life. Article 8(5) states that the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of an official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. The Court found that the above prohibitions applied to every kind of processing of special categories of data, including processing activities performed by search engines.

The Court dismissed Google’s argument that the activity of the search engine operators exempted them from Directive 95/46. The Court recalled that the European Commission emphasized that the operator of a search engine was responsible not because personal data appeared on “a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search on the basis of an individual’s name, since such a display of the link in such a list is liable significantly to affect the data subject’s fundamental rights to privacy and to the protection of the personal data relating to him.” [para. 46]

Question 2:

Having established that the provisions of Article 8(1) and (5) of Directive 95/46 also applied to operators of search engines, the Court turned to determining if the operator was required to de-reference links to web pages containing certain categories of personal data and what exceptions it could enjoy.

According to Article 17 of the Regulation 2016/679, the data subject has the right to be forgotten or the right to “obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those data without undue delay where one of the grounds set out in that provision applies.” (para. 55) The grounds for erasure of personal data include cases in which: “the personal data is no longer necessary in relation to the purposes for which they were processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing pursuant to Article 21(1) or (2) of the regulation, which replaces Article 14 of Directive 95/46; the data have been unlawfully processed; the data have to be erased for compliance with a legal obligation; or the data have been collected in relation to the offer of information society services to children.” [para. 55]

However, the data subject’s right to be forgotten is not absolute and must be balanced against the the right of information, guaranteed by Article 11 of the European Charter on Fundamental Rights. Further, the right to privacy and the right to the protection of personal data, guaranteed respectively by Articles 7 and 8 of the European Charter, could be restricted “as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognized by the European Union or the need to protect the rights and freedoms of others.” [para. 58]

In light of these exceptions, the Court had to determine the conditions in which the operator of a search engine was required to accede to a request for de-referencing. The Court noted that per Article 8(2)(a) and (e) of the Directive 95/46 the prohibition on processing of personal data did not apply when the data subject has given his or her explicit consent to such processing, unless a Member State concerned prohibited such consent. Additionally, Article 8(4) of Directive 95/46, allows “the processing of those categories of data where it is necessary for reasons of substantial public interest, on the basis of European Union or Member State law which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” [para. 61]

The Court reiterated that consent must be “specific” and must therefore relate specifically to the processing carried out by the search engine. The Court conceded that in practice, search engine operators do not seek express consent of data subjects to process their personal data and highlighted that “the mere fact that a person makes a request for de-referencing means, in principle, at least at the time of making the request, that he or she no longer consents to the processing carried out by the operator of the search engine.” [para. 62] Such withdrawal of consent is one of the grounds justifying the application of right to be forgotten under Article 9(2)(a) of Regulation 2016/679.

When the operator of a search engine receives a request for de-referencing, he must ascertain if the right to freedom of information of internet users override the right to privacy of the data subject. In conducting this assessment, the search engine operator must consider “the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.” [para. 66] Furthermore, in cases dealing sensitive data, interference with the data subject’s fundamental rights to privacy and protection carries particular seriousness.

Therefore, when the operator of a search engine receives a request for de-referencing of a link to a web page with sensitive data it must determine if the inclusion of that link in search results on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.

Accordingly, the Court concluded that:

• The search engine operators must process de-referencing requests of links to web pages containing personal data falling within the special categories referred to in Article 8(1) and (5) of Directive 95/46, subject to exceptions
• The search engine operator may refuse to accede to a request for de-referencing if the processing was manifestly made public by the data subject or was necessary for the establishment, exercise or defense of legal claims
• When the search engine operator receives a request for de-referencing, it must balance the data subject’s fundamental rights to privacy and protection of personal data against the protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.

Question 3:

Lastly, the Court had to determine if information relating to a legal proceeding of an ensuing conviction fell within the meaning of “offences and criminal convictions” of Article 8(5) of Directive 95/46, and if the search engine operator had to grant de-referencing requests for search results displaying outdated or no longer relevant information.

Citing the position of the French, Irish, Italian and the Polish Governments, as well as the European Commission, the Court noted that “information concerning legal proceedings brought against an individual, such as information relating to the judicial investigation and the trial and, as the case may be, the ensuing conviction, is data relating to ‘offences’ and ‘criminal convictions” regardless of whether the data subject was convicted. (para. 73) The processing of such information is permitted, but even “initially lawful processing of accurate data may over time become incompatible with the directive or the regulation where those data are no longer necessary in the light of the purposes for which they were collected or processed.” (para. 74)

In assessing de-referencing requests of data relating to offences and criminal convictions, search engine operators must strike a fair balance between their right to respect for private life and inter alia the public’s freedom of information. “In seeking that fair balance, account must be taken of the essential role played by the press in a democratic society, which includes reporting and commenting on legal proceedings. Moreover, to the media’s function of communicating such information and ideas there must be added the public’s right to receive them.” (para. 76). Citing, M.L. and W.W. v. Germany, the Court recalled that “the public had an interest not only in being informed about a topical event, but also in being able to conduct research into past events, with the public’s interest as regards criminal proceedings varying in degree, however, and possibly evolving over time according in particular to the circumstances of the case.” [para. 77]

Accordingly, the Court held that it was for the operator to assess whether the information relating to criminal proceedings brought against the data subject, concerning an earlier stage of the proceedings and no longer corresponding to the current situation must be de-referenced based on “the nature and seriousness of the offence, the progress and the outcome of the proceedings, the time elapsed, the data subject’s part in public life and his past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for the data subject.”  [para. 77]

Further, even if the operator were to decide not to de-reference the links in question, the operator was required “to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position,” meaning that the most up to date information is listed first.  [para. 88]

---