CE - N° 399922

CE - N° 399922
Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Article 17 GDPR
Decided:	27.03.2020
Published:
Parties:	Google Inc. CNIL
National Case Number/Name:	N° 399922
European Case Law Identifier:
Appeal from:	CNIL (France)
Appeal to:
Original Language(s):	French
Original Source:	(in French)
Initial Contributor:	n/a

The French Council of State annulled the fine of EUR 100,00 that CNIL imposed on Google Inc. The Court issued that the scope of the de-referencing obligation ('right to be forgotten') concerns only the EU. The Court hold that the deletion measures taken by Google Inc. regardless of the extensions concerned, and the user's geographical origin meet the requirements set by the Court of Justice in the case C-507/17.

English Summary

Facts

In 2016, the CNIL fined Google Inc. 100,000 € for failing to comply with de-referencing request on all national versions of its search engine Google Search. Google challenged the decision before the Council of State.

The CNIL claimed that the deletion of personal data has to be performed worldwide to provide effective protection of the rights of individuals.

Google Inc. claimed that their measures adopted in March 2016 were sufficient. They implemented a mechanism which automatically redirects to the national version used by the data subject and which blocks the access, to delete the content for any Internet user identified as being located in the same territory.

Holding

First, the Council of State recalled that the alleged breach of Google Inc. must be judged in accordance with the applicable law, back in 2016.

Then, in the lights of the preliminary ruling, C-507/17, the Council of Stated issued that Google Inc. took sufficient and appropriate measures, and that the de-referencing obligation has to be implemented at the European level.

C-507/17 ruling : "where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request",

Finally, the Court pointed out that the French government did not adopted any special provisions allowing the CNIL in France to order a de-referencing beyond the scope of EU law.

Therefore, the Court issued that the CNIL's decision was vitiated by an error of law because it ordered a worldwide de-referencing.

As a consequence, the Council of State annulled the CNIL's sanction imposing 100,000 € fine on Google Inc.

Comment

Share your comment on the decision here!

Further Resources

Share other blogs or news articles here!

See the CNIL summary and comment here.

English Machine Translation of the Decision

No. 399922- 1 - COUNCIL OF STATUTORY STATUTORY AUDITORS No. 399922
GOOGLE INC.
 Mrs. Christelle Thomas Rapporteur
Mr. Alexandre Lalle tPublic Reporter
Session of March 13, 2020
Reading of March 27, 2020
FRENCH REPUBLIC
ON BEHALF OF THE FRENCH PEOPLE 
The Council of State adjudicating in contentious cases (Administrative Jurisdiction Division, Tenth and Ninth Chambers, meeting) On the report of the Tenth Chamber Having regard to the following procedure:
By a decision of 19 July 2017, the Council of State, ruling on the application by Google Inc. for the annulment of Deliberation No. 2016-054 of 10 March 2016 by which the restricted formation of the Commission nationale de l'informatique et des libertés (CNIL) imposed on it a penalty, made public, of EUR 100,000, stayed the proceedings until the Court of Justice of the European Union has ruled on the following questions: 
1°) whether the "right to dereferencing" as enshrined by the Court of Justice of the European Union in its judgment of 13 May 2014 on the basis of the provisions of Articles 12(b) and 14(a) of the Directive of 24 October 1995 must be interpreted as meaning that the operator of a search engine is bound where it grants a request for dereferencing, to dereferencing all the domain names in its engine in such a way that the disputed links no longer appear irrespective of the place from which the search for the applicant's name is carried out, including outside the territorial scope of the Directive of 24 October 1995 ;
2°) in the event of an affirmative answer to that first question, whether the 'right to dereferencing' as enshrined by the Court of Justice of the European Union in its abovementioned judgment must be interpreted as meaning that the operator of a search engine is only bound, when it grants a request for dereferencing, to remove the disputed links from the results displayed following a search carried out using the applicant's name on the domain name corresponding to the State where the application is deemed to have been made or, more generally, on the domain names of the search engine that correspond to the national extensions of that engine for all the Member States of the European Union ;
3°) furthermore, if, in addition to the obligation referred to in 2°, the "right to dereferencing" as enshrined by the Court of Justice of the European Union in its aforementioned judgment must be interpreted as meaning that the operator of a search engine that grants a request for dereferencing is required to remove the domain name by means of the technique known as "geo-blocking", from an IP address deemed to be located in the State of residence of the beneficiary of the "right to dereferencing", the disputed results of searches carried out using his name, or even, more generally, from an IP address deemed to be located in one of the Member States subject to the Directive of 24 October 1995, irrespective of the domain name used by the internet user carrying out the search. 
By judgment C-507/17 of 24 September 2019, the Court of Justice of the European Union ruled on these issues. 
By a new statement of case and a reply statement, filed on 26 November 2019 and 21 January 2020, Google LLC maintains its conclusions.  It submits that the restricted composition of the CNIL vitiated its deliberations by an error of law by retaining the principle of worldwide dereferencing and that the technical solution implemented to ensure dereferencing satisfies the requirements laid down by European Union law as interpreted by the Court of Justice of the European Union. 
By two new statements of defence, registered on 29 November 2019 and 6 February 2020, the CNIL concluded that the application was dismissed. It submits that the judgment of the Court of Justice of the European Union does not prohibit a national supervisory authority from ordering the implementation of global dereferencing and that the technical solution implemented by Google to ensure dereferencing does not meet the requirements of effective protection of personal data. 
In an intervention, registered on 13 January 2020, Wikimedia Foundation Inc. requested that the Conseil d'Etat uphold the conclusions of Google Inc. It argued that the restricted formation of the CNIL could only order global dereferencing after balancing the right to privacy and protection of personal data with the right to information specific to a particular case and not by reasoning of principle. 
In an intervention, registered on 28 January 2020, Microsoft Corporation requested that the Council of State uphold the conclusions of Google Inc.'s application. It submits that the restricted composition of the CNIL could order worldwide dereferencing only after balancing the right to privacy and the protection of personal data against the right to information specific to a particular case and not by reasoning of principle and that the CNIL erred in law by rejecting the technical solution for dereferencing proposed by Google which satisfies the requirements of the relevant law. 
Having regard to the other documents in the file, including those referred to in the Conseil d'Etat's decision of 19 July 2017 ;  
Having regard to:
 - the European Convention for the Protection of Human Rights and Fundamental Freedoms;
- the Charter of Fundamental Rights of the European Union; Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016; - Law No. 78-17 of 6 January 1978;
- the judgment of the Court of Justice of the European Union of 13 May 2014, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (C-131/12) ;
- the judgment of the Court of Justice of the European Union of 24 September 2019, Google LLC v. CNIL (C-507/17) ; 
- the Code of Administrative Justice;
After hearing in open session:
- the report by Mrs Christelle Thomas, Maître des requêtes en service extraordinaire,
- the conclusions of Mr Alexandre Lallet, public rapporteur ;
The floor having been given, before and after the conclusions, to SCP Spinosi, Sureau, lawyer for Google LLC, SCP Piwnica, Molinié, lawyer for Wikimedia Foundation Inc, SCP Baraduc, Duhamel, Rameix, lawyer for Microsoft Corporation, Me Haas, lawyer for ReportersCommittee for Freedom of the Press and others, SCP Tapie, Rousseau-Tapie, lawyer for the association Article 19 and others; 
Considering the following: 
Wikimedia Foundation Inc. and the company Microsoft have shown a sufficient interest in the annulment of the contested decision.  Thus, their interventions are admissible.
2. It follows from the investigation that, by decision of 21 May 2015, the President of the Commission nationale de l'informatique et des libertés (CNIL) gave formal notice to Google Inc, when it grants a request by a natural person for the deletion from the list of results, displayed following a search carried out using his name, of links leading to web pages, to carry out that deletion on all the domain name extensions of its search engine. In a decision dated March 10, 2016, after noting that the company had not complied with this formal notice within the allotted timeframe, the restricted panel of the CNIL imposed a penalty of 100,000 euros on the company, which was made public. Google Inc. seeks the annulment of that decision.
3. First, Article 45 of the Law of 6 January 1978, as applicable at the date of the contested decision, provides that: 'I. - The restricted formation of the Commission nationale de l'informatique et des libertés may, after a contradictory procedure, issue a warning to the controller of a processing operation which does not comply with the obligations arising from the present law. This warning shall have the character of a sanction. / The chairman of the commission may also issue a formal notice to the controller to put an end to the failure to comply within a period of time which he shall determine.  In case of urgency, this time limit may be reduced to five days. / If the controller complies with the formal notice addressed to him, the chairman of the committee shall declare the procedure closed. / Otherwise, the restricted panel may impose the following sanctions on him, after an adversarial procedure: / 1° A pecuniary sanction, under the conditions laid down in Article 47, except in cases where the processing is implemented by the State; (...)". These provisions ensured the implementation in national law of the provisions then in force of Article 24 of Directive 95/46/EC of 24 October 1995, which left it up to the Member States to determine the sanctions to be applied "in the event of infringement of the provisions adopted pursuant to this Directive".
 4.    On the other hand, Article 38 of the Law of 6 January 1978, in its wording applicable at the date of the contested deliberation, provides that: "Any natural person has the right to object, on legitimate grounds, to the processing of personal data concerning him/her; he/she has the right to object, free of charge, to the use of the data concerning him/her for the purposes of canvassing, in particular commercial canvassing, by the current controller or the controller of a subsequent processing operation. / The provisions of the first paragraph do not apply where the processing is carried out in compliance with a legal obligation or where the application of those provisions has been precluded by an express provision in the act authorising the processing. Those provisions ensured the implementation in national law of the provisions of Article 12(b) and Article 14(a) of the Directive of 24 October 1995, from which flows a 'right to dereferral' of personal data. They must therefore be interpreted in the light of those provisions, which have been replaced by Article 17 of Regulation No 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC of 24 October 1995, known as the General Data Protection Regulation, which enshrines such a 'right to erasure', also known as the 'right to forget'; 
The European Court of Justice has ruled that: 'Articles 12(b) and 14(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 [...] and Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 [...]. ...] must be interpreted as meaning that, where the operator of a search engine grants a request for dereferencing pursuant to those provisions, he is required to dereferral not all versions of his search engine, but the versions of the search engine corresponding to all Member States, if necessary in combination with measures which, in the absence of such measures, do not apply to all versions of the search engine,  while satisfying the legal requirements, effectively prevent or at least seriously discourage Internet users carrying out a search on the basis of the name of the person concerned from one of the Member States from having, through the list of results displayed as a result of that search, access to the links which are the subject of that request".
6. As mentioned in point 1, the restricted formation of the CNIL sanctioned Google Inc. on the grounds that it refuses, when it grants a delisting request, to delist all the domain names of its search engine and limits itself to removing the links in question from the results displayed only in response to searches carried out from domain names corresponding to the versions of its search engine in the Member States of the European Union. The CNIL's limited membership also considered insufficient the additional proposal, known as "geo-blocking", made by Google Inc. after expiry of the formal notice period, to remove the possibility of accessing, from an IP address deemed to be located in the State of residence of the beneficiary of the "right to dereferencing", the disputed results following a search carried out using his name, irrespective of the search engine version requested by the Internet user.
7. It follows from the reasons set out in paragraph 4 that, by penalising the applicant company on the ground that only a measure applying to the entire processing linked to the search engine, without regard to the extensions searched for and the geographical origin of the internet user carrying out a search, is capable of meeting the requirement of protection as enshrined by the Court of Justice of the European Union, the restricted formation of the CNILa vitiated the contested decision by an error of law.
8. It is true that, as the CNIL argued in its defence, the Court of Justice noted, in paragraph 72 of the judgment of 24 September 2019, that 'if ... EU law does not, as it stands, require that the dereferencing to which it would be entitled relates to all versions of the search engine in question, it does not prohibit it either. Consequently, a supervisory or judicial authority of a Member State remains competent to carry out, in the light of national standards for the protection of fundamental rights (...). ), a balance between, on the one hand, the right of the data subject to respect for his private life and to the protection of personal data concerning him and, on the other hand, the right to freedom of information, and, at the end of this balancing act, to order, where appropriate, the operator of the search engine to derefer to all versions of the search engine".
9. Where, when seized of a petition against a sanction imposed by the CNIL, the administrative court finds that the decision challenged before it could have been taken, by virtue of the same discretionary power, on a basis other than that used by the sanctioning authority, the administrative court may substitute that basis for the one that served as the legal basis for the contested decision, provided that the person sanctioned has had the guarantees that are attached to the application of the text on the basis of which the decision should have been imposed. Such substitution is the responsibility of the court's office, which may do so either at the request of the parties or on its own initiative, in the light of the documents in the file, but subject, in the latter case, to having first given the parties an opportunity to submit observations on this point.
10. While the CNIL maintains in its defence that the contested sanction is based on the power which the Court of Justice has recognised for the supervisory authorities to order a dereferencing of all versions of a search engine, it does not result, as the applicable law stands, from any legislative provision that such dereferencing could go beyond the scope of European Union law to apply outside the territory of the Member States of the European Union. Moreover, it follows in any event from the reasons set out in point 7 that such an option can be opened only after balancing the right of the data subject to respect for his private life and the protection of personal data concerning him against the right to freedom of information. However, it is apparent from the very terms of the contested decision that, in order to establish the existence of persistent breaches and to accuse Google Inc. of having failed to comply with the obligation in principle to derefer to all versions of a search engine, the restricted formation of the CNIL did not carry out such a balancing. It follows that there is no reason to grant the substitution of the legal basis requested in defence by the CNIL.
11. It follows from the foregoing that Google Inc. is entitled to request the annulment of the deliberation it is attacking.

D E C I D E :
Article 1: The interventions of Wikimedia Foundation Inc. and Microsoft Corporation are admitted.
Article 2: The deliberation of 10 March 2016 of the restricted formation of the Commission nationale de l'informatique et des libertés is annulled.
Article 3: This Decision shall be notified to Google LLC, the Commission Nationale de l'Informatique et des Libertés, Wikimedia Foundation Inc, Microsoft Corporation, Reporters Committee for Freedom of the Press, as the first named, and the association Article 19, as the first named. The other participants will be informed of this decision by Maître Haas and SCP Rousseau-Tapie, lawyers at the Conseil d'Etat and the Cour de Cassation, who represent them before the Conseil d'Etat.

Deliberated at the end of the sitting of 13 March 2020 at which the following sat: Mr Alain Ménéménis, Deputy President of the Litigation Division, presiding; Mr Mattias Guyomar, Mr Guillaume Goulard, Presidents of Chambers; Ms Natalie Escaut, Ms Anne Egerszegi, Mr Thomas Andrieu, Councillors of State, Ms Christelle Thomas, Maître des requêtes en service extraordinaire-rapporteur.read at a public sitting on 27 March 2020The President: Signed: M. Alain Ménéménis The rapporteur: Signed: Mrs. Christelle ThomasThe secretary: Signed: Mrs. Claudine RamalahanoharanaThe Republic orders and orders the Prime Minister as far as he is concerned or any judicial officers to provide for the enforcement of this decision. For dispatch in conformity,For the secretary of litigation, by delegation