By decision of March 10, 2016, the president of the Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties, France; hereinafter: ‘CNIL’) imposed a fine of EUR 100,000 on Google Inc. because, although it had complied with a request to remove links, it had refused to remove the links in question for all domain name extensions of its search engine.
Google Inc., which was ordered by the CNIL on May 21, 2015, to remove the links in question for all extensions, refused to comply and only removed those links from the results displayed after searches carried out from domain names corresponding to the Member State-specific versions of its search engine. Google Inc. requested the Conseil d’État (highest administrative court, France) to annul the decision of March 10, 2016. It considers that the right to have links removed does not necessarily imply that the links in question must be removed without geographical restriction on all domain names of its search engine.
The Conseil d’État has referred several questions to the Court of Justice for a preliminary ruling, asking whether the EU rules on the protection of personal data [1] should be interpreted as meaning that a search engine operator who complies with a request to remove links is obliged to remove the links in question from all versions of its search engine, or – on the contrary – is only obliged to do so for all Member State-specific versions of its search engine, or even only for the version specific to the Member State in which the beneficiary of the removal resides.
In today's judgment, the Court first recalls that it has already held [2] that the operator of a search engine is required to remove links to web pages published by third parties and containing information about a person from the list of results displayed following a search made using that person's name, even if that name or information has not been or is not simultaneously erased from those web pages, and, where appropriate, even when the publication of that name or information on those web pages is lawful in itself.
The Court then finds that Google Inc.'s establishment on French territory carries out activities, including commercial and advertising activities, which are inextricably linked to the processing of personal data for the purposes of operating the search engine in question, and that it must be assumed that this search engine—given, inter alia, the existence of links between its various national versions—carries out a single processing of personal data in connection with the activities of Google Inc.'s French establishment. Such a situation therefore falls within the scope of EU legislation on the protection of personal data.
The Court emphasizes that, in a globalized world, the access of internet users—particularly those located outside the Union to the indexed link referring to
information about a person whose center of interests is located in the Union may have immediate and significant effects within the Union itself, so that the removal of links at the global level fully meets the objective of protection pursued by Union law. Nevertheless, the Court clarifies that many third countries do not recognize the right to have links removed or take a different approach to this right. The Court adds that the right to the protection of personal data is not absolute,
but must be considered in relation to its function in society and, in accordance with the principle of proportionality, must be weighed against other fundamental rights. Furthermore, the balance between the right to respect for private life and the protection of personal data on the one hand, and the freedom of information of internet users on the other,
can vary considerably around the world.
The applicable provisions do not show that the EU legislature made such a consideration with regard to the scope of the removal of links outside the EU, nor that it chose
to grant individuals rights that extend beyond the territory of the Member States. Nor do those provisions indicate that it intended to impose on market participants such as Google an obligation to remove links that also extends to the national versions of their search engine that are not specific to the Member States. In addition, EU law does not provide for instruments and mechanisms for cooperation with regard to the scope of the removal of links outside the Union.
The Court therefore concludes that, in the current state of affairs, does not impose on the operator of a search engine who complies with a request submitted by the person concerned
to remove links—where applicable, after being ordered to do so by a supervisory authority or a court of a Member State—
an obligation to remove the links in question from all versions of its search engine.
However, EU law does impose an obligation on the operator of a search engine to remove those links for all Member State-specific versions of its search engine and to take measures that are sufficiently effective to ensure effective protection of the fundamental rights of the data subject. Where necessary, that removal must be accompanied by measures that actually make it possible to prevent internet users in any of the Member States of the European Union from accessing the links whose removal is requested when they search for the name of the data subject using a non-EU version of the search engine concerned, to access the links whose removal is requested via the list of results displayed following that search, or at least to seriously discourage them from seeking access to such links. The national court will have to verify whether the measures taken by Google Inc. meet these requirements.
Finally, the Court finds that, as things stand, EU law does not require the removal of links for all versions of the search engine in question, but neither does it prohibit it. Consequently, the authorities of the Member States remain competent to strike a balance, in the light of national standards for the protection of fundamental rights, between the right of the person concerned to respect for his private life and the protection of his personal data, on the one hand, and freedom of information, on the other, and, after that balancing exercise, to order the operator of that search engine to remove the links in question from all versions of that search engine.
[1] Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995, L 281, p. 31) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016, L 119, p. 1, with corrigendum in OJ 2018, L 127, p. 2).
[2] Judgment of May 13, 2014, Google Spain and Google, C-131/12 (see CP 70/14)
