Right to be forgotten on the Internet

SUMMARY OF:

Reference for a preliminary ruling – Protection of individuals with regard to the processing of personal data – Territorial scope of the right to de-referencing – Case C-507/17 (2019)

Reference for a preliminary ruling – Protection of individuals with regard to the processing of personal data and the processing of data contained on websites – Extent of that operator’s obligations and of the data subject’s rights – Case C-131/12 (2014)

WHAT ARE THE AIMS OF THE JUDGMENTS?

The 2014 Court of Justice of the European Union (CJEU) ruling clarified the interpretation of Directive 95/46/EC as follows.

Displaying search engine results constitutes processing of personal data.
The search engine operator has a responsibility to remove links to personal information from search results in specific circumstances, effectively introducing the right to be forgotten.

The 2019 CJEU ruling clarified the geographical scope of its earlier decision, in the new context of Regulation (EU) 2016/679 (the general data protection regulation), which modernised and unified data protection rules across the European Union (EU) and repealed Directive 95/46/EC.

KEY POINTS

Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (2014)

In 2010, Mario Costeja González, a Spanish citizen, asked Google to remove or conceal in search results the personal data concerning social security debts printed in the newspaper La Vanguardia in 1998.
He maintained the matter had been resolved several years earlier and that reference to them had become irrelevant.
The Court found that an internet search engine operator is responsible for processing the personal data that appear on web pages published by other sources and must comply with legislation that protects individuals in this regard (Directive 95/46/EC).
The Court ruled that the search engine operator could, in some circumstances, be obliged to remove links to certain web pages from the list of results that appear when a search is carried out for a particular name (this is known as the right to be forgotten or ‘de-referencing’), where the information is considered to be inaccurate, inadequate, irrelevant, no longer relevant or excessive for the purposes of data processing, but not simply because it is inconvenient to the subject.

Google LLC v Commission nationale de l’informatique et des libertés (CNIL) (2019)

In the action brought by Google against the French data protection authority, the CJEU was asked to rule on the geographical scope of application of the right to be forgotten.
In 2016, the French regulator fined Google €100,000 for refusing to apply the right to be forgotten worldwide. It further ordered the company to apply the right to be forgotten to all Google domain names, including google.com. In response, Google maintained that the French data protection authority only had the power to order that it apply to the French google.fr domain.
In its ruling, the Court held that the right to be forgotten does not apply to links displayed in every version of a search engine worldwide, but applies to search engines with domain names associated with EU Member States – i.e. not just google.fr, but also google.it, google.de, google.nl, etc.
Search engine operators are also required to use, where necessary, measures that ‘effectively prevent or, at the very least, seriously discourage’ internet users from accessing de-referenced material when searching by name from a Member State.

BACKGROUND

For further information, see:

Data protection (European Commission)
‘Right to be forgotten’ (GDPR.eu).

MAIN DOCUMENTS

Judgment of the Court (Grand Chamber) of 24 September 2019 – Google LLC, successor in law to Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) – Request for a preliminary ruling from the Conseil d’État – Reference for a preliminary ruling – Personal data – Protection of individuals with regard to the processing of such data – Directive 95/46/EC – Regulation (EU) 2016/679 – Internet search engines – Processing of data on web pages – Territorial scope of the right to de-referencing – Case C-507/17.

Judgment of the Court (Grand Chamber), 13 May 2014 – Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González – Request for a preliminary ruling from the Audiencia Nacional – Personal data – Protection of individuals with regard to the processing of such data – Directive 95/46/EC – Articles 2, 4, 12 and 14 – Material and territorial scope – Internet search engines – Processing of data contained on websites – Searching for, indexing and storage of such data – Responsibility of the operator of the search engine – Establishment on the territory of a Member State – Extent of that operator’s obligations and of the data subject’s rights – Charter of Fundamental Rights of the European Union – Articles 7 and 8 – Case C 131/12.