CJEU - C-507/17 - Google (Territorial scope of de-referencing)
| CJEU - C-507/17 Google (Territorial scope of de-referencing) | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 3(1) GDPR Article 17(1) GDPR Article 4(1),(a) Directive 95/46 Article 12(b) Directive 95/46 Article 14, §1, (a) Directive 95/46 |
| Decided: | 29.09.2019 |
| Parties: | Google LCC CNIL |
| Case Number/Name: | C-507/17 Google (Territorial scope of de-referencing) |
| European Case Law Identifier: | ECLI:EU:C:2019:772 |
| Reference from: | CE (France) Décision N°399922 |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | Matthias Smet |
The territorial scope of the right to be forgotten in the context of search engine operators is limited to the versions of the search engines corresponding to all the Member States of the Union.
The search engine operator needs to take, where necessary, the appropriate measures which effectively prevent or at the very least seriously discourage an internet user, when conducting a search from within the EU on the basis of a data subject’s name, from gaining access, via the search results, to the links to which the de-referencing requests relates.
English Summary
Facts
In 2015, the CNIL informed Google that it must remove links from all versions of its search engine throughout the world when implementing an erasure request from a data subject. Google declined to comply, limiting its de-referencing of links obtained via its search engines with domain extensions inside the EU only (e.g. google.de or google.fr), as well as using geo-blocking techniques, which prohibits links from appearing in searches performed in France regardless of the version used.
As a consequence, the CNIL imposed a fine of 100.000 EUR on Google due to non-compliance with the data protection legislation. Google filed a request with the Conseil d'État to have the fine annulled. The Conseil d'État subsequently submitted concerns to the Court of Justice, citing "many severe challenges" surrounding the interpretation of the directive.
Holding
'Single act of processing':
The search engine in this case must be regarded as carrying out a single act of personal data processing, because of the existence of gateways between its various national versions. Following this reasoning the act of processing is carried out within the framework of an establishment of Google in a Union Member State (France in this case).
Territorial scope:
The fact that the search engine is operated by a company situated in a 'third state' cannot lead to an exemption of the processing of personal data for the purpose of the operation of that search engine (in connection with the advertising and commercial activities) of an establishment of the controller on the territory of a Member State from the obligations and safeguards of Directive 95/46 and Regulation 2016/679 (GDPR).
The Court explained that the Directive and GDPR do not indicate that EU legislature has chosen to establish a scope which would go beyond the territory of the Member States and thus ruled that search engine operators are not required under EU law to remove links on all the versions of its search engine.
Ruling:
It follows that where a search engine operator grants a right to be forgotten (i.e. de-referencing), that operator is not required to carry out that right to be forgotten on all versions of its search engine, but only the versions of that search engine corresponding to all the Member States of the Union. The search engine operator needs to take, where necessary, the appropriate measures which effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that de-referencing request.
Comment
Scope of de-referencing: 'Power of the Member State' :
In its decision, the CJEU ruled that the territorial scope of the right to be forgotten in the context of search engines is limited to the borders of the EU Member States, since under EU law no obligation to do so exists.
However, while reading paragraph 72, we notice that the Court tries to embed a global application and scope of the right to be forgotten as a general principle. Stating that, although EU law does not provide for an obligation, when granting a request for removal of links, to carry out such removal for all versions of the search engine in question, it does not prohibit it either.
Consequently, a supervisory authority or a court of a Member State still has jurisdiction, in the light of national standards for the protection of fundamental rights, to balance the rights of the data subject against the freedom of information of the public and to instruct the operator of the relevant search engine, where appropriate, to remove the links for all versions of that search engine after such consideration.
So it remains to be seen whether the court will uphold this case law
Further Resources
Share blogs or news articles here!
