On September 24, 2019, the Court of Justice of the European Union (the "Court") issued two rulings with respect to the online 'right to be forgotten'.

In its first ruling, the Court provided important clarifications on the conditions under which data subjects may secure the de-referencing of a link displayed in a search result (Case C-136/17).

In the second ruling, the Court ruled on the territorial scope of the de-referencing obligation, concluding that, under EU law, Google LLC ("Google") is not required to carry out a de-referencing on all versions of its search engine, but only on the versions of its search engine corresponding to all the Member States (Case C-507/17).

This client alert focuses on the key issues emerging from this second ruling.

I. Context of the decision

The ruling is a result of proceedings between Google and the French Data Protection Authority ("CNIL"). On May 21, 2015, the CNIL issued a formal notice requiring Google to remove a link from the results of all its search engine's domain name extensions. Google refused to do so and decided only to remove the links from the results displayed following searches on versions of its search engine in the Member States.

Considering this a failure to comply with the notice, the CNIL imposed a fine of €100,000 on Google on March 10, 2016. The company challenged the fine imposed and sought the annulment of the CNIL's decision before the French Council of State ("Conseil d'Etat").

II. Questions referred to the Court

Having concluded that the company's argument raised serious issues on the interpretation of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Directive"), the Conseil d'Etat decided to refer several questions of interpretation of EU law concerning the right to de-referencing for preliminary ruling by the Court.

The key questions referred to the Court related to whether the rules of EU law relating to data protection are to be interpreted as meaning that, where a search engine operator grants a request for de-referencing, that operator is required to carry out that de-referencing on all versions of its search engine or whether, on the contrary, it is required to do so only on the versions of that search engine "corresponding to" all the Member States or only on the version "corresponding to" the Member State of residence of the individual benefiting from the de-referencing.

The Court answered these questions by reference not only to the Directive, which was applicable on the date of the request, but also the General Data Protection Regulation (EU) 2016/679 ("GDPR") which became applicable on May 25, 2018.

III. The Court's ruling

In its decision, the Court first referred to its ruling on the 'right to be forgotten' (Case C 131/12, Google Spain and Google dated May 13, 2014, the "Google Spain Ruling") (1) and then concluded that, under EU law, a search engine operator has no obligation to carry out a de-referencing on all the versions of its search engine (2). Finally, the Court clarified that EU Member State authorities remain competent to order, in certain cases, the operator of a search engine to carry out de-referencing concerning all versions of that search engine (3).

1. Obligation to remove links to web pages resulting from a search based on individual's name

In order to answer the questions referred by the Conseil d'Etat, the Court first noted its existing ruling on the interpretation of Articles 12 b) and 14 a) of the Directive.

In the Google Spain Ruling, the Court considered that, in order to comply with the Directive, the operator of a search engine is obliged to remove from the list of results, displayed following a search made on the basis of an individual's name, links to web pages, published by third parties and containing information relating to that individual, even in cases where the name or information is not erased beforehand or simultaneously from those web pages, and where publication on those web pages was, in itself, lawful.

Besides, the Court stated in this case that the right to de-referencing applies against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning data subjects, regardless of whether the processing conducted by the operator takes place in the European Union or not. In this regard, the Court referred to the "inextricable link" criterion which it applied in the Google Spain Ruling and pointed out that Google's establishment in France carries out activities which are inextricably linked to the processing of personal data carried out for the purposes of operating the concerned search engine and that such search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of data processing in the context of the activities of Google's French establishment. Such a situation therefore falls within the scope of the EU legislation on data protection.

2. Territorial scope of the de-referencing obligation

In its ruling of September 24, 2019, the Court determined the territorial scope of the de-referencing obligation, as follows:

  1. it is not apparent from Article 12b) and Article 14a) of the Directive that the EU has chosen to confer a scope on the rights of individuals which would go beyond the territory of the Member States. Accordingly, the Court concluded that there is no obligation under EU law for a search engine operator which grants a request for de-referencing made by a data subject, even following an order from a supervisory or judicial authority of a Member State, to carry out such de-referencing on all the versions of its search engine;
  2. with a view to ensuring a consistent and high level of protection throughout the EU, such de-referencing should be carried out in respect of all the Member States (and not only on the version of that search engine corresponding to the Member State of residence of the individual benefiting from the de-referencing);
  3. it is for the search engine operator to take, "if necessary", sufficiently effective measures to ensure the effective protection of the data subject's fundamental rights. Those measures must have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from accessing the links in question using a search conducted on the basis of that data subject's name. As the Court does not provide for further guidance on this requirement, interested companies will eagerly await further clarity on the approach to be adopted by the Member State data protection authorities and courts.

3. Authorities of the individual Member States remain competent to order a search engine operator to carry out a de-referencing globally

The Court held that, although there is no obligation of global de-referencing under EU law, it is not forbidden to order it. Therefore, the responsible supervisory authorities of each of the EU Member States may order, where appropriate, a search engine operator to delist results on all the versions of the search engine.

IV. Next steps

The case now reverts to the French Conseil d'Etat, which will assess the lawfulness of the decision of the CNIL issued in 2015 against Google, taking into consideration the ruling of the Court on matters of interpretation of EU law.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.