The European Court of Justice entered judgement for Google in the legal dispute between the company and the National Commission of Informatics and Freedoms of France (CNIL for its acronym in French), ruling that the search engine is only obliged to apply the “right to be forgotten” within the scope of the European Union.
The CJEU decision falls within the dispute between Google and the CNIL, French authority in charge of overseeing the respect for privacy on the Internet. In 2016, the CNIL sanctioned the American multinational with a fine of € 100,000 for not removing sensitive information from its search engine, as a French user had required.
Google had simply deleted this information from searches conducted within the European Union and activated a geographical block to avoid search queries from French devices. However, the National Computing and Freedom Commission did not consider that the measures taken by the search engine were enough. Therefore, the CNIL proceeded to impose the sanction, which was appealed to the Conseil d’État (Council of State of France).
European Court of Justice case law, specifically in its judgment of May 13th, 2014, case C-131/12, dictates that the European Union law accepts the “right to be forgotten”. Under that right, users can make requests for deletion or de-indexation of personal information that is irrelevant for the time elapsed, despite being true.
The French Council argued that for the “right to be forgotten” in the network to be effective, it must be applied worldwide. On the contrary, Google position was that the contested sanction was based on a misinterpretation, and that its conduct was within the framework of Directive 95/46 / EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This directive was repealed with effect from May 25th, 2018, date from which Regulation 2016/679 is applicable.
Since this argument posed several difficulties to interpret the European legislation, the Conseil d’Etat (Council of State) decided to suspend the procedure and refer it to the Court of Justice, who proved Google right in its judgment of September 24th, 2019, case C507/17, stating that the search engine must remove, when requested by a user, the links to their personal information, but only within the scope of the European Union, not in the rest of the world.
Concretely, the court expressed that “the manager of a search engine is not obliged to remove the links in all versions of its search engine. However, they must be removed in the versions that correspond to all Member States and measures, to prevent Internet users from accessing, from one of the Member States, to the controversial links that appear in the versions of that engine outside the Union, must be adopted.”
The Luxembourg court admits that in a space without borders such as the network, the formula for protection sought by European Union law would consist of the removal of the links globally. However, he points out that the “right to be forgotten” is not accepted or regulated in the same way outside the European sphere, and that Community legislation “does not provide for instruments and mechanisms of cooperation as regards the extent of the removal of links outside of the Union.”
The CJEU adds in the judgment that the “right to be forgotten” cannot be considered as an absolute right but it is subject to the principle of proportionality. There must be a balance between data protection and the right to privacy, and freedom of expression and information.
Suscríbete a LeQuid de la Cuestión
La publicación de LeQuid sobre el mundo del Derecho en los negocios.