The Court of Justice of the European Union has once again spoken about the limits of the right to be forgotten. This time, it answered requests for a preliminary ruling in the case of Google v CNIL (Commission Nationale de l’Informatique et des Libertés, the French public authority responsible for regulating personal data processing). The case concerned a fine of EUR 100,000 which the CNIL imposed on Google after it refused to remove, in the exercise of a data subject’s right to be forgotten, links from all language versions of its search engine.
Although the judgment is formally based on the legal situation prior to the GDPR, the similarity of the wording of the right to be forgotten before entry into force of the GDPR and the current law, and the reasoning followed by the CJEU in the judgment, make the replies given by the CJEU relevant to exercise of the right to be forgotten under the GDPR.
Links do not need to be removed from all language versions of search engine
In this case, the CNIL requested Google to apply the deletion to all language versions of the Google search engine, taking into account the individual’s request to remove links to websites from the list of results displayed when his name is entered in the search engine. Google refused, removing links only from search results in versions of the search engine operating in EU member states. Subsequently, the CNIL imposed a fine on Google, which was challenged by Google. The CNIL took the view that all language versions of the Google search engine were accessible from the territory of France and that the Google search engine carried out a single processing, irrespective of the domain extension, and that the processing could be attributed to Google France. On the other hand, Google argued that the right to be forgotten does not mean that the links in question are removed without geographical restriction from domains with all extensions, and argued that the CNIL decision infringed the freedom of information and the press.
In its judgment, the Court of Justice pointed out that in many countries outside the European Economic Area, the right to be forgotten by removing links is not known or understood differently than in the European Union. In addition, this right is not absolute, but must be understood in accordance with the principle of proportionality, and the balance between the right to respect for privacy and freedom of information may vary from country to country. The court stressed that it is not clear from the GDPR that the scope of its application (including the right to be forgotten) extends beyond the EU or that obligations are imposed on entities in the GDPR with respect to the national version of the search engine in countries other than EU member states. However, the obligation to remove links applies to all national versions of the search engine in EU countries, in order to ensure the consistency of data protection law in the EU. In addition, the CJEU found that the search engine operator is obliged to take “sufficiently effective measures” to ensure effective protection of the fundamental rights of data subjects. As a result, EU internet users’ access to such links is to be prevented, or at least made more difficult, to dissuade internet users from accessing them.
The CJEU judgment is favourable to Google and has probably been greeted with relief by other entities operating on a global scale. As can be deduced from this judgment, the CJEU does not tend to extend the de facto already very broad scope of application of the GDPR. However, the question remains unanswered which measures referred to by the court will sufficiently discourage EU internet users from using other versions of search engines.
Katarzyna Szczudlik