France, Council of State, 19 July 2017 399922
Case summary
Deciding Body
Conseil d'Etat
France
National case details
Registration ID: 399922
Instance: Appellate on fact and law
Case status: Pending
Area of law
Other
Relevant principles applied
Preliminary ruling
Judgement of the CJEU (Grand Chamber), 24 September 2019, Case C-507/17 Google LLC v Commission nationale de l'informatique et des libertés (CNIL)Life-cycle diagram
19 July 2017
Conseil d'Etat, request for a preliminary ruling, n. 399922
24 September 2019
CJEU judgment, C-507/17, Google v CNIL
Identification of the case
- Respect for private and family life (art. 7 CFREU)
- Protection of personal data (art. 8 CFREU)
- Freedom of expression and information (art. 11 CFREU)
- Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, in particular article 45
- Administrative Justice Code
- Directive 95/46/CE of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
- Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR)
Summary of the case
By decision of 21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, it must apply that removal to all its search engine’s domain name extensions. Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States.
By an adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of 100 000 euros, which was made public. By application lodged with the French Council of State, Google seeks annulment of that adjudication.
Before the Council of State, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of 6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, on the basis of which the Court of Justice, in its judgment of 13 May 2014, Google Spain and Google (C 131/12), recognized a « right to de-referencing ». Google argues that this right does not necessarily require that the links at issue are to be removed, without geographical limitation, from all its search engine’s domain names. In addition, Google argues that by adopting such an interpretation, the CNIL disregarded the principles of courtesy and non-interference recognized by public international law and disproportionately infringed the freedoms of expression, information, communication and the press guaranteed in particular by Article 11 of the Charter.
Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Council of State has decided to stay the proceedings and to refer questions to the Court of Justice for a preliminary ruling.
- Administrative judicial enforcement
Annulment of the administrative decision.
The Council of States wishes to determine, in essence, whether Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679 are to be interpreted as meaning that, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is required to carry out that de-referencing on all versions of its search engine, or whether, on the contrary, it is required to do so only on the versions of that search engine corresponding to all the Member States, or even only on the version corresponding to the Member State in which the request for de-referencing was made, using, where appropriate, the technique known as ‘geo-blocking’ in order to ensure that an internet user cannot, regardless of the national version of the search engine used, gain access to the links concerned by the de-referencing in the context of a search conducted from an IP address deemed to be located in the Member State of residence of the person benefiting from the right to dereferencing or, more broadly, in any Member State.
Reasoning of the CJEU:
It follows from Article 4(1)(a) of Directive 95/46 and Article 3(1) of the GDPR that both that directive and that regulation permit data subjects to assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not.
The fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establishment of the controller on the territory of a Member State escaping the obligations and guarantees laid down by Directive 95/46 and the GDPR (CJUE, 13 May 2014, C 131/12, Google Spain and Google Paragraph 58).
It is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of the GDPR that the European legislature would, for the purposes of ensuring a high level of protection of personal data throughout the European Union, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended to impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States. EU law does not currently provide instruments and mechanisms enabling them, where appropriate, to cooperate in order to come to a joint decision based on weighing a data subject’s right to privacy and the protection of personal data concerning him or her against the interest of the public in various Member States in having access to information as regards the scope of a de-referencing outside the Union.
It follows that, currently, there is no obligation under European Law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.
European Law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (CJUE, 26 February 2013, C 617/10, Åkerberg Fransson, Paragraph 29, and of 26 February 2013, C 399/11, Melloni, Paragraph 60) a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.
On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
Role of the Charter and role of the general principles on enforcement
Articles 7 and 8 of the Charter request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.
Article 8 §1: the protection of natural persons in relation to the processing of personal data is a fundamental right.
Article 11: guarantee the freedoms of expression, information of internet users, communication and the press.
- Proportionality
The right to the protection of personal data is not an absolute right but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
A supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights, a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a dereferencing concerning all versions of that search engine.
Elements of judicial dialogue
- Vertical
- Direct dialogue between CJEU and National court (preliminary reference)
- CJUE, 13 May 2014, C 131/12, Google Spain and Google
- CJUE, 26 February 2013, C 617/10, Åkerberg Fransson
- CJUE, 26 February 2013, C 399/11, Melloni
Preliminary reference.
To affirm the European dimension of the right of dereference.
To ensure consistency between European and international rules, and affirm the importance of taking "due" account of rules applicable at international level