The Right to be Forgotten – Rounds 2 and 3
Such was the interest in two significant judgments involving the ‘right to be forgotten’ handed down by the CJEU this morning (Tuesday 24th September 2019), that the Court’s website was ‘temporarily unavailable’ for an extended period. Although decided under the pre-GDPR regime of Directive 95/46/EC the judgments are significant and will undoubtedly be the source of substantial further comment. Both of the cases involved the search engine Google and the French data protection authority, CNIL.
GC and Others v CNIL and Google Case 136/17
The essential take home message from this decision is that internet search engines are subject to the full rigors of the EU’s Data Protection regime with respect to their referencing (or indexing) of third party websites. The referencing of web pages, and the display of links to those web pages in lists of results presented to internet users following a search, are processing activities which may be prohibited or restricted under relevant EU data protection law. In the face of a ‘right to be forgotten’ request, search engines are entitled to undertake a balancing exercise weighing the seriousness of the interference with the requesting data subject’s fundamental rights, against the need to protect the freedom of information. There are a range of factors which must be weighed in the balance. The right to be forgotten does not encompass an automatic right to de-referencing of links to sensitive personal data.
Significantly, where a search against a data subject’s name returns multiple results reflecting different time points in history, for example during the course of criminal proceedings, a search engine may not be required to de-reference links. Instead it may be required to adjust the ordering of search results in such a way that the current legal position is given prominence. In other words, that the results returned prioritise links to the material which describes the most recent legal position.
Google V CNIL Case 507/17
In this case the Court determined that the right to be forgotten in EU law does not have world-wide effect. Where a search engine is required to de-reference search results there is no obligation under EU law to apply that de-referencing on all the versions of its search engine, regardless of where in the world they operate.
EU law requires the search engine to apply the de-referencing on all versions of its search engine corresponding to all the Member States and to take sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. The Court indicated that if necessary, de-referencing must be accompanied by measures which effectively prevent or, at the very least, seriously discourage an internet user conducting a search from within the EU via a version of the search engine outside the EU.
However, the Court noted that EU law does not prevent the national court issuing an Order requiring de-referencing on all versions of the search engine. Consequently that remedy remains available where it is deemed necessary by the national court, in the particular circumstances of the case before it, in order to protect the data subject’s fundamental right to privacy and protection of personal data.
That EU law will not determine what internet users outside the EU see in their search results is not surprising. However, the Court has reinforced the obligation on search engines to take steps to ensure that de-referencing in the EU is effective within the EU and is not circumvented by easy workarounds.
The potential for a requirement to arise on search engines to play an active role in the ordering of search results to prioritise current information may be a double edged sword. The availability of this strategy may strengthen public interest arguments against de-referencing in a given case. Conversely, many defendants in criminal and regulatory proceedings will know that media coverage of charging decisions or prosecution openings is never counterbalanced by similar reports of a later acquittal. The inability to prioritise links to the acquittal may strengthen their arguments in favour of de-referencing.
The full implications of these judgments will not be known for some time.
This briefing is for guidance purposes only. RadcliffesLeBrasseur LLP accepts no responsibility or liability whatsoever for any action taken or not taken in relation to this note and recommends that appropriate legal advice be taken having regard to a client's own particular circumstances.