In two recent cases, the Court of Justice of the EU was asked to rule on several questions relating to the right to be forgotten. On 10 January 2019, Advocate General Szpunar delivered his opinion in both cases.
In the first case (C-136/17), several individuals had requested the French Data Protection Authority (CNIL) to order Google to de-reference various links from the results list displayed following a search made on the basis of their names. The data on the web pages related to political opinions, religious or philosophical beliefs and sexuality. As the CNIL refused to issue the requested order, the case was brought before the French Council of State, which referred several questions to the Court of Justice.
In his opinion, Advocate General Szpunar states that operators of a search engine must, as a matter of course, grant requests for de-referencing links to web pages on which sensitive data appear, unless one of the exceptions applies. As such, the operator of a search engine must weigh up (i) the right to privacy and the right to protection of data, and (ii) the right of the public to access the information concerned and the right to freedom of expression of the person providing the information. This is also true for data which have become incomplete, inaccurate or obsolete, such as, for example, press articles relating to a period before the conclusion of judicial proceedings.
In the second case (C-507/17), the CNIL had ordered Google, when acceding to a request from a person for the removal of links displayed following a search performed on the basis of that person’s name, to apply that removal to all its search engine’s domain name extensions. Google agreed only to remove the results displayed on the versions of its search engine with domain name extensions from EU Member States. Consequently, persons within the EU could still access the information when using third-country extensions. The CNIL imposed a fine of €100,000 on Google, which brought an appeal before the French Council of State. The Council of State decided to refer several questions to the Court of Justice for a preliminary ruling.
In his opinion, Advocate General Szpunar indicates that EU Directive 95/46/EC, applicable to the case at hand and now replaced by the GDPR, does not expressly govern the issue of the territorial scope of de-referencing. Also, the Advocate General is not in favour of giving the provisions of EU law such a broad interpretation that they would have effects beyond the borders of the 28 Member States.
Although the Advocate General does not rule out that, in certain situations, a search engine operator may be required to take de-referencing actions at the global level, he concludes that results from searches done outside EU territory should in principle not be affected when acceding to a request for de-referencing made by individuals within the EU. However, once a right to de-referencing within the EU has been established, the search engine operator must ensure full and effective de-referencing within the EU, including through use of the geo-blocking technique, irrespective of the domain name used by the internet user who performs the search.
The Advocate General’s opinions are not-binding on the Court of Justice. In most cases, however, the Court follows the advice of the Advocate General.
Please contact Karel Janssens for further information on these cases and/or for general legal advice relating to privacy and data protection.