On February 24, 2017, France’s highest administrative court (the “Conseil d’Etat”) submitted to the European Court of Justice (“ECJ”) a series of questions raising serious issues with regard to the interpretation of the 1995 Data Protection Directive in light of the ECJ’s 2014 ruling in the Google v. Costeja case[1].

The Conseil d’Etat had received from four individuals their appeals against decisions of the French data protection authority (“CNIL”). In each case, the CNIL rejected the appellant’s complaint seeking an order that Google Inc. remove certain links from the list of results displayed following a search of each appellant’s name. The links direct to content on third party sites relating to the appellants, and specifically:

  • a 2011 video, posted anonymously, that explicitly reveals the nature of the relationship that the first appellant was deemed to have entertained with a person holding a public office, and alleges that such relationship was beneficial for the appellant’s political career;
  • a 2008 press article relating to the suicide of a Church of Scientology member, mentioning that the second appellant was the public relations manager of that Church; the appellant no longer holds that position;
  • various articles dating from 1995 relating to criminal proceedings for illegal political party financing in which the third appellant was charged; the appellant was acquitted in 2010; and
  • articles (date not mentioned) relating to the conviction of the fourth appellant for sexual assault of minors and mentioning intimate details relating to the appellant that were revealed at the trial.

Noting that in each case the published information is either sensitive data or concerns offenses and criminal convictions, the Conseil d’Etat questions whether and to what extent the prohibition on processing such data applies to search engine operators, as they are only required to comply with data protection requirements “within the framework of [their] responsibilities, powers and capabilities” (para. 38 of the Google v. Costeja case).

The Conseil d’Etat has therefore declined to rule, stating that appellants’ claims raise serious questions of interpretation regarding the implementation of the right to be forgotten, and has deemed it necessary to refer to the ECJ for a preliminary ruling on the following questions:

  1. Considering the specific responsibilities, powers and capabilities of search engine operators, does the prohibition on processing sensitive data and data relating to offenses and criminal convictions, subject to certain exceptions, apply to search engine operators as controller of the processing in the search engine?
  2. If yes:
    1. Does this mean that search engines must systematically delist links to webpages processing sensitive and/or data relating to offenses and criminal convictions, whenever the relevant individual so requests?
    2. How do the exceptions to the prohibition apply? In particular, can search engine refuse to delist links if they find, for example, that the data subject consented to the processing of their personal data or that the data has been disclosed to the public by the data subject or is necessary for the establishment, exercise or defense of legal claims?
    3. Can search engines refuse to delist links to websites processing such data for journalistic purposes
  3. If no:
    1. What data protection law requirements must the search engines comply with, considering their specific responsibilities, powers and capabilities?
    2. When search engines find that webpages contain illicit content and their delisting is requested:
      1. Are the search engines required to remove the links to those webpages from the search results?
      2. Or are they required to take this circumstance into account when assessing the delisting request?
      3. Or does this circumstance have no impact on such assessment?
      4. If it does have an impact, how must the lawfulness of a publication be appreciated when the personal data contained in such publication originates from processing that fall outside the territorial scope of the 1995 Directive and Member State laws?
  4. Irrespective of the response to the first question:
    1. Irrespective of the lawfulness of the publication:
      1. If an appellant demonstrates that his/her personal data has become incomplete, inaccurate or outdated, do search engines have to delist the links?
      2. More specifically, if an appellant demonstrates that the information regarding a past judicial procedure no longer reflects his/her current situation, do search engines have to delist links to webpages containing such information?
    2. Does information regarding an individual’s indictment or trial, and the subsequent conviction, constitute data relating to offenses and criminal convictions? More generally, do webpages containing this type of information fall within the scope of these requirements?

Almost three years after the Google v. Costeja case, and many intense debates around its interpretation and implementation, the right to be forgotten returns to its progenitor for much needed clarification.