This article first appeared in the E-Commerce Law Reports – volume 15 issue 03 (edited)

For the first time in France since the European Court of Justice (“ECJ”) Costeja v. Google case[1], which enshrined the so-called “right to be forgotten” in a landmark decision dated May 13, 2014, the balance has tipped in favor of the public’s right to know in two recent court decisions rendered in injunctive proceedings targeting respectively Google Inc. and an online newspaper. At the same time, the French data protection authority has set its sights on ensuring that the effects of the Costeja case will be felt worldwide.

Barely a year ago thrown under the spotlight, the right to be forgotten actually has a long pedigree. Behind the catchy name hide the not so glamorous rights of erasure and objection, as set forth in France’s 1978 data protection law (Law No. 78-17 dated January 6, 1978), and later copied in articles 12 and 14 of the 1995 Directive.

After the ECJ’s decision in May 2014, French judges initially embraced the new case law. On the basis of the right to be forgotten, the Paris Civil Court ordered Google France, and then Google Inc., to de-index certain links in two injunctive decisions dated September 16, 2014[2] and December 19, 2014[3], respectively. In the first case, the plaintiffs alleged that a search for their name produced links to websites containing statements about plaintiffs that had been held libelous in a French criminal court decision rendered earlier in 2014. The judge laconically ordered Google France[4] to de-index the litigious links, even though Google France does not operate the Google search engine. In the second case, concerning two links to press articles relating to the plaintiff’s conviction for fraud, the judge performed a thorough balancing test, certainly inspired by the set of guidelines issued by the Article 29 Working Party (“WP29”) on November 26, 2014[5], to find that the plaintiff had paramount and legitimate reasons overriding the right to information and justifying de-indexing[6].

These two cases, along with other European courts’ decisions[7], gave teeth to the European Union and many Member State institutions’ will to strengthen the protection of individual privacy; at the same time, countries such as the United States moved in the opposite direction. For example, the Second Circuit U.S. Court of Appeals held, in a January 2015 decision[8], that the beneficiary of a nolle prosequi[9] may not obtain the deletion of accurate news reports of her arrest, thus affirming the primacy of news organizations’ First Amendment right over individuals’ right to privacy.

The approaches adopted in these French and U.S. decisions seemed completely irreconcilable until the Toulouse Civil Court in a January 21, 2015 decision[10], and the Paris Civil Court in a March 23, 2015 decision[11], finally tipped the scale in favor of the public’s right to know. But let’s not jump to conclusions too quickly, as this convergence may hide deeper fractures between the European and American models.

When the public’s “right to know” outweighs the “right to be forgotten”

On January 21, 2015, the Toulouse Civil Court wrote that “it may not be claimed that anyone has an absolute right to the online de-indexing of his/her personal data” and refused to order Google Inc. to de-index from search results certain links to news articles, considering that (i) the links point users to information regarding the plaintiff’s dismissal and therefore his professional life, not his private life; (ii) such information is by nature public as the dismissal resulted in a court decision rendered publicly, subsequently published and receiving extensive media coverage due to the circumstances of the case, notably harassment by plaintiff, i.e., questionable professional behavior; and (iii) the events date from 2011. The Toulouse court found irrelevant the fact that a judicial proceeding is still pending with respect to the dismissal, and moreover stated that the pending proceeding does not prove that the articles are inaccurate, inadequate, irrelevant or excessive. Based on the foregoing, the Toulouse court ruled that Google Inc. demonstrated the public’s predominant interest in having access to the articles, justifying Google Inc.’s decision to refuse de-indexing. The outcome would have certainly been different if, like in the September 16, 2014 decision rendered by the Paris Civil Court, the plaintiff could have relied on a judgment recognizing the defamatory nature of the linked information, and therefore its inaccuracy.

On March 23, 2015, the Paris Civil Court refused to order a French news website to remove or anonymize a December 2014 article announcing that charges for rape against the plaintiff had been dropped. The court considered that such information, including the name, age and profession of the plaintiff, was of public interest in that it concerned (i) the functioning of the judicial system and how serious crimes against individuals are handled; and (ii) a professional working with the public and in particular with children.

Although these two decisions were also rendered in injunctive proceedings and not on the merits, they are interesting examples of how Member State judges are applying the ECJ’s ruling — as well as likely the thirteen criteria established by the WP29[12] and those identified by the Advisory Council to Google[13] — in favor of the freedom of expression and the right to know. They are however not the first decisions of this kind in the European Union. For example, the Court of Amsterdam in the Netherlands refused, in a decision dated September 19, 2014, to de-index links to articles linking the plaintiff to the crime for which his conviction to six years imprisonment was under appeal, stating that “the [Costeja] judgment does not intend to protect individuals against all negative communications on the Internet, but only against ‘being pursued’ for a long time by ‘irrelevant’, ‘excessive’ or ‘unnecessarily defamatory’ expressions[14]. On February 13, 2015, the same court emphasized, in respect of links to articles relating the refusal by plaintiff (a top executive) to pay his contractor, who in turn changed the locks and forced him to live in a container on his country estate for a while, that “the [right to be forgotten] is not meant to remove articles which may be unpleasant, but not unlawful, from the eyes of the public via the detour of a request for removal to the operator of a search engine[15].

Thus, if some may have feared a great wave of censorship in the European Union after the Costeja case, search engine operators[16] and judges both seem to have adopted reasonable positions in protecting individuals’ right to privacy. Nonetheless, while the individual right to privacy is finding its boundaries in the form of the freedom of the press and the public’s right to know, the overall scope of the right to be forgotten is still evolving.

Towards a broader application of the Costeja case?

The Paris Civil Court decision of March 23, 2015 is especially interesting in that it is the first time a French court has applied the Costeja case directly to a news website, instead of the usual search engine. It is not however the first case of its kind in Europe. For example, on September 25, 2014, the Liege Court of Appeals in Belgium ordered a newspaper to anonymize a 1994 article relating a DUI accident on the grounds that the driver had been rehabilitated[17].

One of the main aspects of the Costeja case is that it confirmed the application of data protection law to search engine operators, considering that “the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) [of the Directive 95/46/EC] when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d)[18]. Judges have transposed this reasoning to news websites, which usually offer access to their archives via search functionalities, based on automatic processing, and therefore may be considered as “controllers” of the personal data contained in their articles.

This expansion of the scope of application of the right to be forgotten to news websites certainly contrasts with judges’ attention to the preservation of the freedom of expression, which becomes even more important in news context. Indeed, one of the main arguments in favor of the right to be forgotten was that de-indexed content still exists and is still accessible. By directly going after news websites, this argument becomes meaningless. Judges therefore have an ever more important role to play in protecting freedom of the press as they balance individuals’ right to privacy. In this respect, a compromise approach would be to anonymize articles that infringe an individual’s privacy, as suggested by the Liege Court of Appeals[19].

Another recurrent issue regarding the right to be forgotten is its territorial scope. Indeed, whereas the WP29 considers that “in any case de-listing should also be effective on all relevant domains, including .com[20], the Advisory Council concludes that “removal from nationally directed versions of Google’s search services is the appropriate means to implement the ruling[21], arguing notably that adopting the position of the WP29 may contradict solutions espoused by courts in other parts of the world.

Until now, Google Inc. has always adopted a compromise approach, de-indexing links from all the European Union domains, as well as from the Icelandic, Lichtenstein, Norwegian and Swiss domains, regardless of the country of origin of the request. This issue has not to our knowledge been challenged in French court and no general conclusion may be drawn on the territorial effect of a de-indexing decision. However, this apparent status quo is on the verge of coming unhinged because on May 21, 2015, the President of the French data protection authority (the “CNIL”), Mrs. Isabelle Falque-Pierrotin, put Google Inc. on notice to proceed within fifteen days with de-indexing requested by the CNIL following its receipt of complaints[22]; the CNIL’s request covers the entirety of the indexing services and thus all extensions of the search engine[23]. Specifically, the CNIL stated that “the service provided by the company via its search engine ‘Google search’ constitutes a single processing. Indeed, the different domain names that the company chose to implement to facilitate the local use of its service are only means of access to this processing. Thus, when [Google Inc.] launched its service in 1997, it was accessible only from the website ‘www.google.com’ and it has been extended to different domain names only over time”. The CNIL also stated that individuals’ rights are not dependent on the configuration of the processing or the variety of access thereto.

If Google Inc. fails to comply with this formal notice, it could face administrative sanctions, including financial, by the CNIL, as well as criminal prosecution since articles 226-24, 131-38, 131-39 and 226-18-1 of the French Criminal Code provide that the processing by a legal entity of personal data concerning an individual despite his/her objection, when such processing is for marketing purposes, or when the objection is based on legitimate grounds, is notably punishable by a fine up to 1,500,000 euros for legal persons.

It will be interesting to see how search engines will adapt to what may be a new enforcement trend and, more importantly, how jurisdictions which do not recognize the right to be forgotten, like the United States, will react to this more and more expansive European right.