The right to be forgotten and the EU Court of Justice: Round 2

In our previous blog post available here, we covered the long-awaited decision (Case C-507/17) from the Court of Justice of the European Union (the "Court") regarding the territorial scope of the European "right to be forgotten" in the context of search engines (also referred to as "de-indexing" or "de-referencing"). It is said that "the best things come in pairs" and the above-decision from the Court is no exception. On the same day (24 September 2019), the Court issued another decision (Case C-136/17) which has been not received much attention but is still important since it further clarifies the scope of the "right to be forgotten" and, in particular, the conditions under which individuals may obtain the de-referencing of a link from search results.

As a reminder, back in May 2014 (the often discussed Google Spain case), the Court affirmed the existence in the European Union of a right to have personal data deleted from search engines on request after a certain time upon fulfillment of certain conditions. This is commonly known as the 'right to be forgotten'.

Facts and proceedings

The case at hand involved four individuals who had asked Google to remove links to webpages about them from the lists of results displayed whenever a search of their names is performed on Google's search engine. For example, one of the links involved a satirical photomontage video depicting one of the plaintiffs with the mayor of a municipality whom she served as head of cabinet and explicitly referring to an intimate relationship between them. Another link involved a press article on the suicide of a member of the Church of Scientology mentioning that one of the plaintiffs was the public relations manager of that church, a function he had ceased to exercise. Other links involved articles relating to criminal proceedings of another plaintiff. After Google refused their request to have such links removed from its search results, the plaintiffs contested Google's decision before the French data protection authority (CNIL). Unfortunately for the plaintiffs, the CNIL agreed with Google’s decision, and the plaintiffs then took their case to the highest administrative court in France (the "Conseil d'Etat"), which referred it to the Court in order to clarify the scope of the right to be forgotten. In particular, the Court was asked to confirm whether data processing prohibitions relating to information falling within certain special categories (such as political opinions, religious or philosophical beliefs) also apply to search engine operators.

The Court's decision

1. The prohibition surrounding the processing of sensitive information

The Court held that a search engine plays an important role in the dissemination of information and is able to have a significant effect on the fundamental rights to privacy and the protection of personal information. Accordingly, the Court found that the operator of a search engine, as the person determining the purposes and means of that activity, has a responsibility for ensuring that its data processing activities comply with European data protection requirements. In particular, the Court found that the general prohibition and restrictions laid down in EU data protection law in relation to the processing of sensitive information should apply to all controllers processing such information, including search engine operators.

However, the Court also recognized a search engine operator is not in the same position as a website publisher, since it did not cause the sensitive information to appear on the internet in the first place. After all, the search engine operator only provided a link to an existing website. In particular, the Court observed that the operator of a search engine is responsible, not because personal data appears on a web page published by a third party, but because the display of the link to that page in the list of results presented to users of the search engine is affecting the individual's fundamental right to privacy. Accordingly, the prohibition and restrictions would apply to search engine operators only after a request has been made by the relevant individual to remove the link in the search results to the page containing sensitive personal information, under the supervision of the competent national authorities.

2. A necessary balancing test

One of the requirements imposed by European data protection law is that the processing of personal data that reveals sensitive information (such as a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or information concerning a person's health or sex life) is generally prohibited, subject to specific exceptions laid out under data protection law. Accordingly, the Court held that the operator of a search engine is in principle required to comply with those provisions and to accede to requests for de-referencing links to web pages containing sensitive personal data, unless of course an exemption is applicable.

Nevertheless, there is no automatic requirement for search engine operators to remove links to certain websites pursuant to a deletion request made by the affected individual. Instead, in order to determine whether to remove links to pages that contain sensitive personal data, the search engine operator would have to perform a balancing test of the competing rights in presence. According to the Court, the search engine operator should balance the right to privacy of the individual whose information is accessible (including the nature of the information available and its sensitivity for the individual’s life) against the right of the public to have access to such information (particularly when the person is a public figure). In other words, an assessment is needed to determine whether the inclusion of the link in search engines is necessary and proportionate to protect Internet users' right to access that information. If however it is determined that the information is no longer relevant or accurate, or it is incomplete, then the data subject's privacy rights overrides the general public’s right to information.

3. Considerations relating to legal proceedings

The Court also held that information concerning legal proceedings brought against an individual (e.g. relating to a judicial investigation, a trial and the ensuing conviction) is information relating to ‘offences’ and ‘criminal convictions’ under European data protection law, regardless of whether the offence was determined to have been committed. Accordingly, when a search engine operator includes links to pages containing such information in its search results lists, the Court found that the search engine is conducting a processing activity, which is subject to special restrictions according to European data protection law. In particular, this means that the search engine operator has to assess whether the individual has a right to request that the information in question be no longer associated with his or her name in the search results. In order to conduct such assessment, the Court held that the search engine operator should take into account all the circumstances of a given case. This includes for example the nature and seriousness of the offence, the progress and outcome of the proceedings, the time elapsed, the part played by that person in public life and his or her past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for that person.

The above-mentioned balancing act is not the only requirement imposed by the Court on search engine operators. The Court further adds that even if the search engine operator deems necessary to include the link after having performed the above-mentioned balancing act, it is still required to adjust the results of the search lists in such a way that "the overall picture it gives the internet user reflects the current legal position of an individual." In other words, there is a duty imposed on the search engine operator to place links relating to the latest information on the given issue to appear in the first place on the list. In other words, there is an obligation to ensure that the most accurate legal information appears first in search results.

The CNIL has already announced in a press release that it will "apply the decisions of the Court when dealing with the hundreds of delisting requests it receives every year".