The CJEU preliminary ruling was requested by the French Council of State (Conseil d’État), the proceedings concerned four decisions of the French data protection supervisory authority (National Commission for Information – CNIL) regarding the exercise of the right to be forgotten. Specifically, CNIL had refused to order Google Inc. (now, Google LLC) to de-reference several links that were included in the lists of results displayed following searches of the data subjects’ names, that led to webpages published by third parties. Since these facts occurred before the entry into force of the General Data Protection Regulation 2016/679 (GDPR), the request for a preliminary ruling concerned the interpretation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data, and on the free movement of such data. Nevertheless, the CJEU took the opportunity to clarify the conditions upon which the righ to be forgotten under the General Data Protection EU Regulation 2016/679 (GDPR) can be exercised.
The Court, in accordance with the Google Spain decision, stated that the activity of a search engine, automatically indexing certain information published by third parties’ websites, must be considered to be data processing, in respect of which the search engine operator acts as the data controller. Consequently, the operator of a search engine is subject to the stricter rules provided for particular categories of personal data that are published on third parties’ websites as long as such data is subject to processing by the operator in the course of the indexing process, thus leading to a link being included in the search results.
Having established this, the CJEU examined the conditions under which a search engine operator is required to comply with a request to de-reference a link to a webpage containing particular categories of personal data from the list of results that is displayed following a search on the basis of the data subject’s name.
Provided that there is a general prohibition of the processing of particular categories of personal data, the CJEU recognized that particular categories of personal data may be processed if they are subject to one of the exemptions listed by Article 8 of Directive 95/46/EC, e.g., when the data: (i) is processed with the explicit consent of the data subject, (ii) is manifestly made public by the data subject, or (iii) is necessary for the establishment, exercise or defence of legal claims. Nevertheless, the CJEU provided that, if such exceptions also occurred, the search engine might be required to de-reference a link to a webpage if, having regard to substantial public interest, the inclusion of that link in the list of results that are displayed, following a search on the basis of the data subject’s name, is not strictly necessary to protect the freedom of information of internet users who are potentially interested in accessing that web page by means of such a search.
Finally, the CJEU faced a hypothesis in which the linked webpages include information concerning legal proceedings that are brought against an individual, such as information relating to the judicial investigation, the trial, and the ensuing conviction. As a preliminaru measure, the CJEU clarified that such information is personal data that falls under the definition of data relating to “offences” and “criminal convictions”, both of which are covered by Article 8(5) of Directive 95/46/EC and Article 10 of GDPR. As a consequence, the inclusion in the list of results displayed following a search carried out on the basis of the data subject’s name showing links to webpages on which such data is published shall comply with the restrictions provided for such forms of personal data. For instance, this could be the case where the reported information is about an earlier stage of the proceedings and thus no longer corresponds to the current situation. In this context, it is up to the search engine operator to assess whether the inclusion of the link to the webpage in question is necessary in order to exercise the freedom of information for internet users who are potentially interested in accessing that webpage. In so doing, the search engine operator shall take into consideration all the relevant circumstances of the case, e.g.: the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by the data subject in public life, together with his past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for the data subject.
