Any natural person has the right to object, on legitimate grounds, to the processing of their personal data.
Furthermore, anyone may require the data controller to rectify , complete, update, secure or delete their personal data if it is inaccurate, incomplete, ambiguous or out-of-date, as applicable, or whose collection, use, communication or storage is prohibited (articles 38 and 40 of the French Data Protection law – law no. 78-17 of 6 January 1978).
Those provisions result from the transposition into national law of articles 12 and 14 of directive 95/46 of 24 October 1995.
The Court of Justice of the European Union (CJEU) has interpreted these provisions by stating that the provider of a search engine to which a dereferencing request is referred is in principle obliged to satisfy it. I can only be otherwise "if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question." (CJEU, 13 May 2014, C-131/12, Google Spain vs Google).
In a ruling dated 14 February 2018, the 1st civil chamber of the Cour de Cassation (French Supreme Court) clarified the scope of those provisions in a case in which an individual alleged that Google Inc. used his personal data without his consent, through the search engine Google.fr.
The plaintiff asked the court for interim measures on the basis of article 809 of the French Code of Civil Procedure, in order to obtain the termination of the acts which, according to him , constituted a manifest unlawful disturbance.
The Tribunal de Grande Instance of Nice (first instance court) ordered Google to delete "links related to the strictly private and personal data concerning Mr B, subject to a penalty of €1,000 per day of delay." On 15 September 2016, the Court of Appeal of Aix-en-Provence, confirmed the request to delete the links, leading to any URL address identified and reported to Google Inc. by the user as infringing his privacy, within seven days of receipt of that notice.
On the basis of the aforementioned European case law, the Court de Cassation partially overturned and cancelled , without the possibility of appeal, the Court of Appeal’s ruling for violation of articles 38 and 40 of the French Data Protection law (Cass. 1st Civ., 14 February 2018, no. 17-10.499). It holds that a court to which a dereferencing application is referred is "required to make an assessment of the merits of the application and to carry out concrete measures to balance the interests involved, so that it cannot order a general injunction conferring an automatic character on the deletion of the links results displayed following a search carried out from the name of a person containing information related to that person."
That case serves as a reminder that dereferencing is not an absolute right. This right, which has emerged from the Court of Justice of the European Union (CJEU) case law, is now enshrined in regulation (EU) 2016/679 of 27 April 2016 and known as the right to erasure or the "right to be forgotten".