On 24 September 2019 the European Court of Justice (“EUCJ”) closed the case Google LLC vs CNIL with a judgement according to which the “right to be forgotten” is applicable only within the European Union. The key issue here is how a search engine operator is required to enjoy subject’s removal request i.e. how to be removed certain personal information about an individual from the results’ list which is displayed after a search conducted on the individual’s name basis.
Back to 2014 in its judgement on the case Google Spain and Google (C‑131/12, EU:C:2014:317) the EUCJ established the “right to de-referencing”. The Spain citizen Mr. González complaint that when an internet user entered Mr. González’s name in the search engine of the Google group he would obtain links to two pages of a local newspaper. On the links an announcement was mentioning Mr. González’s name in respect of a real-estate auction connected with attachment proceedings for the recovery of social security debts. At the same time, the attachment proceedings concerning him had been fully resolved for several years and that reference to them was then entirely irrelevant.
Interpreting the applicable European personal data protection law, the EUCJ ruled that a data subject generally is entitled to request his or her personal information to be de-referenced – no longer be made available to the general public on account of its inclusion in such a list of results provided by a search engine. The court found this right (based on the fundamental rights under Articles 7 and 8 of the Charter) overrides, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for reasons, that the data subject plays role in public life and therefore the public’s interest of having access to information overrides the subject’s personal data right in question.
The dispute in the latest EUCJ’s case
The current case Google LLC vs CNIL (C-507/17, ECLI:EU:C:2019:772) originates from a dispute between the French data protection authority (“CNIL”) and Google. Seeking to expand the application of the described above right to de-referencing CNIL served formal notice on Google that when Google enjoys a subject’s request for removing his or her personal data from the results’ list provided by the search engine, Google must apply that removal to all its search engine’s domain name extensions. In other words, as per the interpretation of CNIL the subject’s personal data shall not be accessible by searching through Google Search neither from EU nor from any other place in the world.
Google refused to comply with that formal notice and in response proposed “geo-blocking” by means of which the internet user would be automatically directed to the national version of Google’s search engine that corresponds to the place from where he or she is presumed to be conducting the search. Therefore, the results of that search would be displayed according to that place, which would be determined by Google using a geo-location process. Google implemented this geo-blocking approach shortly thereafter. As this measure was found by CNIL insufficient to comply with the formal notice, CNIL imposed penalty of EUR 100 000 on Google. The latter appealed the fine before the Council of State, France.
Based on these circumstances and the Council of State’s request for preliminary ruling the EUCJ adopted its judgement of 24 September 2019 interpreting the territorial scope within which the “right to de-referencing” shall be applicable.
The EUCJ findings
The main considerations of the court concern the territorial scope of application of personal data principles provided by the European data protection law (GDPR and Directive 95/46). The EUCJ found on the one hand that referencing to personal data of an individual situated in EU by means of a global search engine accessed internationally is likely to have immediate and substantial effects on that person within the Union. This justifies the existence of EU law providing the right to de-referencing. Also, the court emphasizes that there must be balance between the individual’s personal data rights, on the one hand, and the public’s interest of access to information, on the other hand. At the same time, numerous third States do not recognise the right to de-referencing or have a different approach to that right. Appling the right to de-referencing internationally would mean EU to be able to impose its rules on citizens of another states which jurisdictions do not recognise this right.
Since EU law does not provide any instruments and mechanisms enabling Member States and third States to cooperate as regards the scope of a de-referencing outside the Union the EUCJ found that there is no obligation under EU law for a search engine operator to carry out such a de-referencing on all the versions of its search engine. Therefore, the EUCJ limits the territorial scope of the right to be forgotten to the EU and thus Google will be required to remove the respective personal data under data subject’s request within the EU. However, the same data can be accessed by internet users obtaining the results of the search engine list outside the EU, so it turns out that the right to be forgotten cannot have worldwide effect.