(1) GC (2) AF (3) BH (4) ED v CNIL

The four applicants each made de-referencing requests to Google, seeking the removal of various links in the list of results displayed in response to searches for their name. The links were to webpages containing special category data, namely:

1.  a satirical photomontage about GC published during a past election campaign, referring to her intimate sexual relationship with the mayor of a municipality;

2.  an article concerning the suicide of a member of the Church of Scientology, mentioning AF in his previous role as a public relations officer of the Church;

3.  articles concerning a judicial investigation into the funding of a French political party, in which BH was questioned; and

4.  articles reporting that ED had been convicted and sentenced to imprisonment for sexual assaults on children under the age of 15.

Google rejected each of these de-referencing requests. The applicants brought complaints before the CNIL seeking orders that Google de-reference the links. The CNIL closed the complaints. The applicants brought applications in the Conseil d’État against the CNIL’s refusals. The Conseil d’État joined the applications and referred the proceedings to the CJEU under the preliminary ruling procedure.

1) Does the prohibition on processing special category data in Article 8(1) and (5) of Directive 95/46 (“the Directive”) apply to the operator of a search engine?

2) If yes:

(a) Is the search engine operator required to accede to requests for de-referencing in relation to links to webpages containing special category data?

(b) May a search engine operator refuse the request if the links lead to content covered by the exceptions laid down in Art 8(2)(a) and (e) of the Directive?

(c) May a search engine operator refuse the request if the links lead to content published solely for journalistic purposes or those of artistic or literary expression?

3) Does a webpage comprising information about legal proceedings brought against an individual or an ensuing conviction constitute data relating to ‘offences’ and ‘criminal convictions’ within Art 8(5) of the Directive?

4) If yes, is a search engine operator required to de-reference links to webpages displaying information relating to an earlier stage of the legal proceedings in question, which no longer correspond to the current situation?

Although these questions related to the interpretation of the Directive, it was repealed after the Conseil D’État submitted the request for a preliminary ruling. The Court considered the questions from the point of view of the Directive, but took the GDPR into account in its analysis.

1) The prohibition on processing special category data applies to every kind of processing and to all controllers. No provision of the Directive or GDPR provides for a general derogation from that prohibition in the context of an activity of a search engine. Further, an interpretation of Art 8(1) and (5) of the Directive or Arts 9(1) and 10 of the GDPR that excluded the activity of a search engine would run counter to the purpose of those provisions, which is to ensure enhanced protection because of the sensitivity of the data.

However, a search engine operator is responsible for compliance with the prohibitions and restrictions in Art 8(1) and (5) of the Directive and Arts 9(1) and 10 of the GDPR because the search engine references the webpage and displays a list of results following a search for a person’s name, not because personal information appears on webpages by third parties. Therefore, the prohibitions and restrictions only apply to the search engine operator by reason of that referencing and following a de-referencing request by the data subject.

2)

(a) A search engine operator is in principle required, subject to the prescribed exceptions, to accede to requests for de-referencing in relation to links to webpages containing personal data falling within the special categories.

(b) Processing by a search engine operator of special category data is capable of being covered by the exceptions in Arts 8(2)(a) and (e) of the Directive and Arts 9(2)(a) and (e) of the GDPR. However, it is scarcely conceivable that a search engine operator would seek the express and specific consent of data subjects before processing data concerning them for the purposes of referencing activity. By contrast, the exception in (e) for information that has ‘manifestly been made public by the data subject’ is intended to apply to the operator of a search engine. Therefore, a search engine operator could refuse to accede to a request for de-referencing if they established that the links in issue lead to content covered by this exception, provided that: (1) the processing satisfies all other conditions of lawfulness, and (2) the data subject does not have a right to object to that processing on grounds relating to their particular situation (see Art 14(a) Directive and Arts 17(1)(c) and 21(1) GDPR).

(c) Where the operator of a search engine receives a de-referencing request relating to a link to a webpage containing special category data, the operator must ascertain whether the inclusion of that link is strictly necessary to protect the freedom of information of internet users potentially interested in accessing that webpage by means of a search. As a general rule, the data subject’s rights protected by Arts 7 and 8 of the Charter override the freedom of information of internet users protected by Art 11. However, the balance may vary in specific cases. The operator should consider:

(i) all the relevant factors of the particular case, including the nature and sensitivity of the information and interest of the public in having the information;

(ii) the seriousness of the interference with the data subject’s fundamental rights, noting that where processing relates to special category data the interference is liable to be particularly serious; and

(iii) the reasons of substantial public interest in Art 8(4) of the Directive or Art 9(2)(g) of the GDPR.

3) Information concerning legal proceedings brought against an individual (such as information relating to the judicial investigation, trial and ensuing conviction) is data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Art 8(5) of the Directive and Art 10 of the GDPR. This is regardless of whether or not the offence was shown to have been committed.

4) If a request for de-referencing concerns links to a webpage containing information about legal proceedings which is no longer current, the search engine operator is required to accede to the request if, in all the circumstances of the case, the data subject’s fundamental rights override the rights of potentially interested internet users. Even if they refuse the request, the search engine operator is required to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, meaning that in particular links containing information on the current legal position must appear in first place on the list.

An important judgment providing clarification on various aspects of a search engine operator’s obligations when responding to de-referencing requests, which should be read alongside the Court’s judgment on the same day in Google v CNIL. The judgment is helpful in two respects:

First, it clarifies that the prohibitions in Art 9 and 10 of the GDPR do not apply to an operator prior to a request for de-referencing. This carves out a way in which search engine operators can lawfully include webpages containing special category data in lists of search results, without needing to rely on a specific exception.

Second, it confirms that the exceptions for processing special category data are potentially available to de-referencing activity. Except for Art 9(2)(g), these may be of limited application to search engines. For example, the Art 9(2)(e) exemption for data “manifestly made public” only applies where the data subject has themselves publicised the information. By contrast, Art 9(2)(g) is potentially wide in scope, and will require search engines to conduct a balancing exercise of the fundamental rights at stake on a case-by-case basis.

This obligation, coupled with the new requirement to adjust the list of search results to create an accurate impression of the current legal proceedings, place weighty responsibilities on search engine operators. These could prove onerous and require significant resourcing. However, the Court’s statement that a data subject’s rights will ordinarily take precedence provides a helpful indication of the appropriate course of action in most cases.

Judgment