The “right to be forgotten” and global de-linking

CASE C-507/17, Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL), 24 September 2019 (GOOGLE — Global De-linking)

Lydia F de la Torre
Sep 30 · 10 min read

(In the presence of: Wikimedia Foundation Inc., Fondation pour la liberté de la presse, Microsoft Corp., Reporters Committee for Freedom of the Press and Others, Article 19 and Others, Internet Freedom Foundation and Others, Défenseur des droits.)

Bobsleeën, vijfmansbob / Bobsleigh / Nationaal Archief / Spaarnestad Photo, SFA002014214

Key points

Territorial scope of EU data protection law: The present case falls within the territorial scope of GDPR because “it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing”.

Right to erase: Under EU law, where a search engine operator grants a request for de-referencing it is “not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request” (¶73)

National data protection authorities: Although EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, but “it also does not prohibit such a practice”. The CNIL and the french courts are competent to weigh up, “in the light of national standards of protection of fundamental rights whether a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other” whether Google should carry out a de-referencing concerning all versions of the Google engine. (¶¶70–72)


This case is the result of a dispute between Google and the CNIL as to how a search engine operator is to give effect to the right to de-referencing (aka the “right to be forgotten”). It has been welcomed by some as the triumph of reason over EU data protection madness and presented by others is a precursor to a future ruling requiring global de-listing of search results. In reality, it is neither. What the Court fundamentally did is acknowledge that the balance between freedom of speech and data protection and privacy rights will vary by jurisdiction, even within the European Union. Therefore, it deferred to Member State courts and national data protection authorities to make a determination on whether a request for de-listing should result on global de-listing, de-listing for all Member States based on Geo-fencing, or de-listing for the particular Member State where the data subject resides.

Moving forward, we will see divergent practices concerning de-listing cases by different member states and the EDPB will be competent to hear those cases and reach a single decision using the cooperation proceeding.

NOTE: Although Directive 95/46 was applicable on the date the request for a preliminary ruling was made, it was repealed with effect from 25 May 2018, from which date Regulation 2016/679 (GDPR) is applicable. The judgement considers the question both under the Directive and under GDPR.

Background

  • By decision of 21 May 2015, the CNIL notified Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, the removal should apply to all of Google’s search engine’s domain name extensions. (¶30)
  • Google confined the removal of links to the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States. (¶31)
  • Google proposed ‘geo-blocking’ (whereby internet users would be prevented from accessing the results at issue from an IP address deemed to be located in the State of residence of a data subject regardless of the version of the search engine used) but the CNIL deemed the proposal insufficient. (¶32)
  • By an adjudication of 10 March 2016, the CNIL imposed a EUR 100 000 on Google. Google appealed seeking annulment of that adjudication (¶34)
  • During the proceedings before the Euroepan Court of Justice, Google explained that, following the bringing of the request for a preliminary ruling, it implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national version of the search engine accessed by that user. Thus, the internet user is now automatically directed to the national version of Google’s search engine that corresponds to the place from where he or she is presumed to be conducting the search, and the results of that search are displayed according to that place, which is determined by Google using a geo-location process. (¶42)

Questions referred

Judgment of the Court (Grand Chamber) on a request for a preliminary ruling from Conseil d’État.

Questions referred:

  1. Must the “right to de-referencing”, as established by be interpreted as meaning that when a search engine operator grants a request for de-referencing that operator is required to carry out that de-referencing on all versions of its search engine, or whether, on the contrary, it is required to do so only on the versions of that search engine corresponding to all the Member States, or even only on the version corresponding to the Member State in which the request for de-referencing was made, using, where appropriate, the technique known as ‘geo-blocking’ in order to ensure that an internet user cannot, regardless of the national version of the search engine used, gain access to the links concerned by the de-referencing in the context of a search conducted from an IP address deemed to be located in the Member State of residence of the person benefiting from the right to de-referencing or, more broadly, in any Member State? (as summarized by the Court in ¶43)

Summary of Judgement

Territorial Scope of EU data protection law: Data subjects may assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not. The processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State because the activities of the operator of the search engine and those of its establishment “are inextricably linked” since the activities relating to the advertising space constitute the means of rendering the search engine economically profitable and that search engine enables those activities to be performed.The fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data escaping the obligations and guarantees laid down under EU data protection law () (¶48–52)

  • The present case falls within the territorial scope of GDPR because “it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing”.

Right to erase:

The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. To make a determination, it should inter alia be examined whether the data subject has a right that the information in question be dereferenced, but need not show prejudice. The data subject fundamental rights under Articles 7 and 8 of the Charter override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, if there are particular reasons, such as the role played by the data subject in public life, the interference with the fundamental rights may be justified by the preponderant interest of the general public in having access to the information in question. (¶¶44–47)

Where a search engine operator grants a request for de-referencing it is “not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request” (¶73)

  • Global de-referencing: The internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual’s name ubiquitous. Internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus “likely to have immediate and substantial effects on that person within the Union itself”. Numerous third States do not recognise the right to de-referencing or have a different approach to that right. The right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality and “[t]he balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world”. There is no obligation under EU law for a search engine that grants a right to de-refering following an injunction from a supervisory or judicial authority of a Member State “to carry out such a de-referencing on all the versions of its search engine(¶64). Ergo, a search engine operator cannot be required, under EU law, to carry out a de-referencing on all the versions of its search engine. (Seem , , Bolagsupplysningen and Ilsjan, C‑194/16, EU:C:2017:766, paragraph 48, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, point 136) (¶¶53–65)
  • Versions of the search engine and de-referencing: Regarding the question whether such a de-referencing is to be carried out on the versions of the search engine corresponding to the Member States or only on the version of that search engine corresponding to the Member State of residence of the person benefiting from the de-referencing, given that GDPR is directly applicable in all the Member States, the de-referencing is “supposed to be carried out in respect of all the Member States”. However, because the interest of the public in accessing information may, even within the Union, vary from one Member State to another, the result of weighing up that interest and a data subject’s rights to privacy and the protection of personal data may vary as well (in particular as regards processing undertaken solely for journalistic purposes or for the purpose of artistic or literary expression). The various national supervisory authorities concerned must cooperate to reach a consensus and a single decision binding on all those authorities. GDPR provides the national supervisory authorities with “the instruments and mechanisms necessary to reconcile a data subject’s rights to privacy and the protection of personal data with the interest of the whole public throughout the Member States in accessing the information in question and, accordingly, to be able to adopt, where appropriate, a de-referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject’s name”. It is for the referring court to ascertain whether, having regard to the recent changes made to Google’s search engine, whether the measures adopted are “sufficiently effective” “to ensure the effective protection of the data subject’s fundamental rights”. Those measures must themselves “meet all the legal requirements and have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name”. (¶¶66–71)

National data protection authorities: Although EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, but “it also does not prohibit such a practice”. The CNIL and the french courts are competent to weigh up, “in the light of national standards of protection of fundamental rights whether a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other” whether Google should carry out a de-referencing concerning all versions of the Google engine. (¶¶70–72)

Additional resources

Legal citation:

Judgment of the Court (Grand Chamber) of 24 September 2019, Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)

Request for a preliminary ruling from the Conseil d’État Case C-507/17

Other resources

Future of Privacy Forum:

Golden Data

Legal blog about data laws

Lydia F de la Torre

Written by

Teacher. Counsel. Author. Queen bee.

Golden Data

Legal blog about data laws

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade