C‑507/17, Google LLC v. CNIL, 2019 EUR-Lex CELEX No. 62017CJ0507 (Sept. 24, 2019).
On September 24, 2019, the Court of Justice of the European Union (“the Court”) held that the “right to be forgotten” does not require a search engine to de-list search results on all of its domains. However, a search engine operator is still required to de-list search results on domains for all of the European Union (“EU”) Member States. The ruling left the referring court, the Conseil d’État (“the Conseil”), to apply the Court’s holding to Google’s practices in France.
The events leading to this ruling began on May 21, 2015, when the President of the Commission nationale de l’informatique et des libertés (“CNIL”), the French data protection authority, served formal notice on Google that, when honoring a request to de-list search results, the company must apply the removal globally, rather than just to the domain of the requester’s residence. Google refused, and limited removal only to the EU Member States. The company argued that global removal could be abused by authoritarian states. Google proposed a “geo-blocking technique” that would prevent a user in an EU Member State from accessing links de-listed in the EU.
CNIL found these steps inadequate and imposed a fine of €100,000. Google appealed to the Conseil for an annulment of CNIL’s adjudication. The Conseil, in turn, referred several questions to the Court, resulting in the landmark holding above.
In deciding the case, the Court considered both the EU Data Protection Directive of 1995 (“DPD”) and the EU General Data Protection Regulation of 2016 (“GDPR”). The Court first established that Google fell within the territorial scope of the DPD and the GDPR, given its activities in French territories. It then considered the goal of the relevant EU law: guaranteeing a “high level of protection of personal data throughout the European Union.” Even so, the right to protection of personal data is not absolute and must be balanced against other fundamental rights and the public interest in having access to information.
Given the global nature of the internet, and countries’ differing attitudes toward balancing the right to be forgotten and the right to information, the Court determined that it could not impose the EU legislation beyond Member States. However, within the member states, if a search engine grants a request to de-list, it must “effectively prevent” or “seriously discourage” all users in the Member States from accessing the de-listed links through non-Member-State domains. The court did not explicitly address whether Google’s proposed geo-blocking technique met this standard, leaving this question to be answered by the Conseil.
Theodore F. Claypoole, writing for the National Law Review, commends the decision yet remains skeptical of the EU’s protection of the right to be forgotten. He argues that the foundation of our social system requires any truthful utterances to remain in the light, and allowing de-listing to shove true facts into darkness is wrong. On the other hand, as Joseph Steinburg argues in Inc., the right to be forgotten prevents people from being perpetually stigmatized or punished for long-ago, minor infractions that are not representative of their whole person.
The Court did acknowledge that even within the Member States, different attitudes may exist over balancing de-listing requests with public access to information. To solve this, the Court provided that “various national supervisory authorities concerned must cooperate… to reach a consensus and a single decision which is binding on all those authorities.” While the Court found EU law does not require de-listing on all of a search engine's domains, it left open the possibility for Member States to order global removal.