The right to be forgotten refers to the possibility for an individual to request the removal of information from the Internet that could damage his or her reputation. The right to be forgotten applies in two different ways: on the one hand ‘the right to erasure’ is a removal of the information in question from a website, on the other, the ‘right to de-referencing’, as established by the [Court] in its judgment of 13 May 2014, [Google Spain and Google (C‑131/12, EU:C:2014:317),] which is that « the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name ».
The Court of Justice of the European Union (ECJ) has just delivered a historic judgment on 24 September, 2019, involving Google Inc. and the CNIL, (an independent administrative authority that operates under the French Data Protection Act).
Google Inc., after being served with a formal notice on 21st, May 2015, refused to extend the de-referencing to all domain name extensions of its search engine. It simply removed unwanted links. On March 10, 2016, the president of the CNIL imposed a penalty of €100,000 on Google Inc which then asked the Conseil d’Etat, which is the French equivalent to the Supreme Court, to annul this decision.
The Conseil d’Etat referred the following question to the ECJ: when the operator of a search engine grants a request for de-referencing, is he required to carry out this dereferencing on all the different versions of his engine, or only on the versions of it which correspond to all the Member States, or the only version corresponding to the Member State where the beneficiary of the dereferencing resides?
The European Court of Justice’s answer was radical: the right to de-referencing remains limited to Member States and is not applicable worldwide. It is therefore a defeat for the CNIL, and a victory for Google Inc. The ECJ justifies its decision by explaining that many states are not familiar with the right to de-referencing, and it is not an absolute right: it must be interpreted in accordance with its role in the society in question, and balanced, in accordance with the principle of proportionality, with other fundamental rights.
More specifically, it is important to take into account the essential balance between, on the one hand, the freedom of information accessible to all Internet users, which may vary depending on where the individual is located in the world, and on the other hand, the protection of the individuals personal data and his right to respect for his private life. Nevertheless, the ECJ said that where a search engine operator grants a request for de-referencing, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the EU Member States the European Union obliges the operator of a search engine to apply de-referencing to the versions of its search engine that correspond to all Member States. Furthermore, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that [de-referencing] request.
The Court emphasized that although EU law does not currently require that the de-referencing granted must apply to all versions of the search engine in question, it also does not prohibit such an order being made. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights, a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of a search engine to carry out a de-referencing concerning all versions of that search engine.
This judgment is extremely important, given that the issue has remained open since the very creation of the right to be forgotten, back in 2014. The geographical scope of the right had never been defined before.
IPzen is aware of the importance of personal data and the safety of its users. That is why we assure you that your information is treated with the utmost caution in accordance with the provisions of GDPR. If you have any questions, please do not hesitate to contact us by e-mail at contact@ipzen.local.
