By Philippe Vlaemminck, Lidia Dutkiewicz & Justine Van den Bon
On 10 January, Advocate General Szpunar issued his Opinion in Case C-507/17, Google v CNIL, on the territorial scope of a so-called “right to be forgotten”. According to the AG, the fundamental right to be forgotten must be balanced against other fundamental rights, such as the right to data protection, the right to privacy and the legitimate public interest in accessing the information sought. In addition, there should be no general worldwide right to be forgotten. Were this permitted, the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and to privacy.
The right to be forgotten, established in the landmark Google Spain case, enables individuals to request that search engines operators remove links to “inadequate, irrelevant or excessive” information relating to them.
The case in question concerns a dispute between Google and the French Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties; ‘CNIL’). The CNIL served formal notice on Google that removal of links to web pages from the list of results displayed, following a search performed on the basis of a person’s name, must apply to all of its search engine’s domain name extensions worldwide. Google refused, and only did so for the domain names corresponding to the versions of its search engine in the Member States of the EU. In addition, Google proposed a ‘geoblocking’ measure on domain names accessed from an IP address deemed to be located in the state of residence of the person concerned. The CNIL regarded these proposals as insufficient.
The AG now agrees with Google, taking the view that search requests from outside the EU should not be affected by the de-referencing of the search results; there must be a balancing of rights. Were worldwide de-referencing allowed, persons in third states would be prevented from accessing information and, in turn, that third states would prevent persons in the EU Member States from accessing information. This argument is widely shared between different human rights and free speech organisations, which fear that a worldwide right to be forgotten could encourage censorship in countries such as China, Russia and Saudi Arabia.
In certain situations, worldwide de-referencing could, however, still be possible. The fundamental right to be forgotten must always be balanced against other fundamental rights.
Thus, the AG concludes that, “the search engine operator is not required, when acceding to a request for de-referencing, to carry out that de-referencing on all the domain names of its search engine in such a way that the links in question no longer appear, irrespective of the location from which the search on the basis of the requesting party’s name is performed”.
Furthermore, “once a right to de-referencing within the EU has been established, the search engine operator must take every measure available to it to ensure full and effective de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an IP address deemed to be located in one of the Member States, irrespective of the domain name used by the internet user who performs the search”.
Advocate General Szpunar issued his Opinion in Case C-136/17 G.C. and Others v CNIL on the same day.
This case concerns the application of prohibitions on processing sensitive personal data to search engines and how to tackle the links containing journalistic material.
In this case, the applicants sought the de-referencing of various search engines results that contained, inter alia, a satirical photomontage of a female politician posted online under a pseudonym, an article referring to one of the interested parties as the public relations officer for the Church of Scientology, the placing under investigation of a male politician and the conviction of another interested party for sexual assaults against minors.
In the AG’s view, the prohibition on processing sensitive data cannot apply to the operator of a search engine as if it itself had placed sensitive data on the web pages. Logically, the activity of a search engine only takes place once sensitive data have been published online.
Regarding the question of the derogations authorised under freedom of expression and their reconciliation with the right to respect for private life, the operator of a search engine should conduct a balancing exercise. Alongside the right to respect for a private life and the right to protection of data, there is the right of the public to access information and the right to freedom of expression. De-referencing related to personal data that have become incomplete, inaccurate or obsolete must be conducted on the basis of the same balancing exercise. Here, it must be considered that certain information relates to journalism or constitutes artistic or literary expression.