Case Summary and Outcome

The Grand Chamber of the Court of Justice of the European Union held that existing EU law did not oblige Google to carry out an order to de-reference search results on all versions of its search engine. The case originated in France after the French Data Protection Authority (CNIL) fined Google LLC for failing to  globally de-reference information concerning a data subject.  The Court explained that EU law establishing and regulating the right to be de-referenced (right to be forgotten) was silent about the geographic scope of de-referencing orders. The Court held that in principle the de-referencing was supposed to be carried out in respect of all the Member States, but since privacy protections were not reconciled across the EU, it was up to courts and other relevant bodies in each Member State to decide the breadth of the de-referencing. The Court did not rule that Google could never be obliged to carry out a de-referencing order globally, but it was up to a court to decide when this was appropriate.

Facts

On 21 May 2015, the French Data Protection Authority (CNIL) had served a formal notice on Google LLC stating when a person requests his/her name to be removed from the list of search results, Google was obliged to remove said results from all versions of its search engine. Google LLC refused to comply and confined itself to remove the links in question only from domain names corresponding to versions of its search engine in EU Member States. Google also proposed to “geo-block” search results, whereby internet users would be prevented from accessing the results at issue from IP addresses in the State of residence of the data subject after conducting a search on the basis of that data subject’s name.

On 10 March 10 2016, the CNIL imposed a penalty of EUR 100,000 on Google LLC for failing to comply with the formal notice. Google LLC lodged an application with France’s Conseil d’État (Council of State) seeking annulment of CNIL’s adjudication.

The Council of State noted that Google search is broken down into different domain names by their geographic locations to better tailor results. When searches are conducted from “google.com,” Google usually redirects that search to the domain name corresponding to the State where the search was initiated. However, regardless of the location, the internet user can still search using the search engine’s other domain names. Moreover, regardless of where the user is located, the links displayed in response to a Google search derive from common databases and common indexing. Accordingly, Google’s search qualified as a single act of personal data processing under the 1978 French law on information technology, data files and civil liberties.

Google argued that CNIL misinterpreted the 1978 law, which was supplemented by Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The Google Spain judgment recognizing the right to de-referencing (the right to be forgotten) was based on articles 12(b) and (14)(1)(b) of Directive 95/46. Google argued that this right does not require the de-refencing of links without geographical limitations and from all its search engine’s domain names. Google also argued that CNIL “disregarded the principles of courtesy and non-interference recognized by public international law and disproportionately infringed the freedoms of expression, information, communication and the press guaranteed, in particular, by Article 11 of the European Charter [of Fundamental Rights].”

Since the case involved important issues regarding the interpretation of Directive 95/46 the Council of State stayed the proceedings and referred to the CJEU the following questions:

1. Must a search engine operator deploy de-referencing on all versions of its search engine, so that the links at issue do not appear irrespective of the place where the search is initiated, even if it comes from outside the European Union?
2. If Question 1 is answered in the negative, must the right to de-referencing be interpreted as meaning that a search operator is required only to remove the links at issue from the results in the domain of the country from where the search originated?
3. After granting a de-referencing, must the search engine geo-block search results on the basis of an IP address deemed to be located in the State of residence of the person benefiting from the right to be de-referenced (right to be forgotten) or even from an IP address in the European Union regardless of the domain name used by the internet user conducting the search?

Decision Overview

The Grand Chamber of the Court delivered a per curium opinion to the Preliminary Ruling request. The main question before the CJEU was how a search engine operator is to give effect to that right to be de-referenced. That is, when granting a request for de-referencing, should it deploy the de-referencing to all versions of its search engine and utilize geo-blocking so that the links do not appear even if the search is conducted from a place outside the territorial scope of the Directive.

Google explained to the Court that after the Council of State requested a preliminary ruling, it changed its search engine parameters so that the internet user was automatically directed to the national version of Google’s search engine that corresponds to the place from where the user launched the search. Thus, the results of that search were determined by Google using a geo-location process.

The Court began by reviewing rights of data subjects under the EU Directive 95/46 as well as under Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The Court recalled that according to the Google Spain judgment’s interpretation of articles 12(b) and 14(1)(a) of Directive 95/46, when information about a data subject was no longer relevant or outdated, s/he could request a search engine operator to de-reference his/her name from from links to web pages containing information relating to the data subject. Article 7 (right to privacy) and Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union permitted data subjects to make information about them unavailable to the general public and to override economic interests of the search engine as well as the interest in access to information. However, rights under articles 7 and 8 could be trumped by the “preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.” (para. 45)

Moving on to Regulation 2016/679, the Court recalled that Article 17 of the regulation specifically governed the “right to erasure” also referred to as the “right to be forgotten,” which under certain conditions obliged a data controller to erase personal data without undue delay. However, freedom of information of internet users could restrict the enjoyment of the right to erasure.

Accordingly, the Court concluded that both Directive 95/46 and Regulation 2016/679 allowed data subjects to exercise the right to de-referencing. The implementation of this right is the responsibility of a data controller, such as a search engine operator, on the territory of the European Union. This territorial link exists when a search engine operator establishes a branch or subsidiary in the EU intended to promote and sell advertisement on the search engine. In this case, the search in question was conducted by Google, which has branch in France responsible for commercial and advertising activities.

After outlining the relevant legal provision, the Court turned to the question at the heart of the case. The Court noted that “in a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.” [para. 57] Further, these considerations “justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.” [para. 58]

The Court conceded that the right to de-referencing is not globally recognized. It also noted that the right is not absolute and must be balanced against other fundamental rights in accordance with the principle of proportionality. (Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662 and Opinion 1/15 EU-Canada PNR Agreement of 26 July 2017, EU:C:2017:592) The Court added that the balance between the right to privacy and freedom of information likely varied significantly around the world.

Although the EU’s legislature balanced the right to privacy and freedom of information, it has not struck a similar balance in relation to the scope of a de-referencing outside of the Union. The Court noted that Directive 95/46 and Regulation 2016/679 did not specify if the implementation of a de-referencing order should go beyond the EU borders. EU law also does not provide for instruments and mechanisms to resolve the question of the scope of de-referencing outside of the European Union. The Court thus concluded that under EU law there is no obligation for a search engine operator ordered to implement a de-referencing to carry it out on all version of its search engine.

In principle the obligation must be carried out in all Member States and on applicable search engine versions. However, Member States have different standards of weighing the public interest in access to information against the right to privacy and it is up to them to reconcile these differences. The Court opined that various concerned national supervisory authorities must cooperate to ensure compliance with processing activities and the existing regulatory framework allows for such reconciliation.

At the same time, the Court reiterated that the search engine operator was responsible for taking sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. “Those measures must themselves meet all the legal requirements and have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name.” (para. 70) It was up to the Council of State to determine if Google’s measures met its obligations. The Court emphasized that while EU law does not require de-referencing from all versions of a search engine, it does not prohibit such a practice. A judicial authority of a Member State remains competent to balance the right to information and the right to privacy, and then to order where appropriate to carry out a de-referencing concerning all versions of its search engine