France, Council of State, 6 December 2019 401258

Identification of the case

• Respect for private and family life (art. 7 CFREU)
• Protection of personal data (art. 8 CFREU)
• Freedom of expression and information (art. 11 CFREU)

• Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties
• Administrative Justice Code

• Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in particular Article 8(5) repealed and replaced by
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data and on the free movement of such data (GDPR)

Summary of the case

An applicant asked Google to remove from the results displayed by the search engine it operates following a search for his name two hyperlinks referring to press articles reporting his seven-year prison sentence by a Criminal Court. Following Google's refusal, he lodged a complaint to the CNIL, asking it to order the company to remove the links in question from its database. The CNIL closed the complaint. The applicant seeks the annulment, on the ground of misuse of powers, of the CNIL's refusal to give formal notice to Google to delist the links in question. The Council of State ruling stayed proceedings until the Court of Justice ruled on the questions referred for a preliminary ruling.

• Civil judicial enforcement

Annulment, on the ground of misuse of powers, of the CNIL's refusal to give formal notice to Google to delist links about criminal convictions.

The questions referred concern the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which was applicable at the time when the request for a preliminary ruling was submitted. That directive was repealed with effect from 25 May 2018, from which date Regulation 2016/679 applies.

The Court has considered the questions referred from the point of view of Directive 95/46, while also taking Regulation 2016/679 into account in its analysis of them, in order to ensure that its answers will in any event be of use to the referring court.

Having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, does the prohibition imposed on other controllers of processing data caught by Article 8(1) and (5) of Directive 95/46, subject to the exceptions laid down there, also apply to this operator as the controller of processing by means of that search engine?

By judgment of 24 September 2019 (C-136/17) the Court of Justice of the European Union ruled on this issue.

The Council of State, on the office of the judge for excess of power:

The useful effect of the removal for excess of power of the CNIL's refusal to give formal notice to the operator of a search engine to de-referencing links to web pages lies in the obligation, which the judge may prescribe ex officio by virtue of the provisions of Article L. 911-1 of the Administrative Justice Code, for the CNIL to proceed with this formal notice so that the links in question disappear from the list of results displayed following a search for the links in question. It follows that, when it is seized of conclusions for the purpose of overturning the CNIL's refusal to give formal notice to the operator of a search engine to remove the links from the list of results, the judge of excess of power is required to assess the legality of such a refusal in the light of the applicable rules and the circumstances prevailing at the date of his decision.

As regards the "right to de-referencing" of personal data relating to criminal proceedings:

The provisions of Article 46 of the Law No. 78-17 of 6 January 1978 ensure the implementation in national law of those of Article 10 of the GDPR, which repealed and replaced those of Article 8(5) of Directive 95/46/EC of 24 October 1995.

The Court of Justice of the European Union stated (CJEU, 24 September 2019, GC, AF, BH et ED contre CNIL (C-136/17)) that the provisions of Directive 95/46 must be interpreted as meaning that the information relating to legal proceedings against a natural person and, where appropriate, information relating to the resulting conviction constitutes data relating to 'offences' and 'criminal convictions' within the meaning of Article 8(5) of that Directive.

The two links still in dispute led to web pages containing the words spoken by the applicant in an interview he gave to a magazine with a large circulation about her conviction. These pages therefore contain information which constitutes personal data relating to the criminal proceedings referred to in Article 10 of the GDPR.

It follows that where links lead to web pages containing personal data relating to criminal proceedings referred to in Article 8(5) of Directive 95/46/EC of 24 October 1995, repealed and replaced by Article 10 of the GDPR, the interference with the fundamental rights to privacy and protection of personal data of the data subject is likely to be particularly serious because of the sensitivity of such data. It follows that it is in principle the responsibility of the CNIL, upon receiving a request for it to give formal notice to the operator of a search engine to de-list links to web pages published by third parties and containing such data, to comply with this request. This is the case only if it appears, taking into account the right to freedom of information, that access to such information from a search for the name of the person concerned is strictly necessary to inform the public. In order to assess whether the right to de-referencing can be legally defeated on the grounds that access to personal data relating to criminal proceedings on the basis of a search for the name of the person concerned is strictly necessary to inform the public, the CNIL must take into account, in particular the nature of the data in question, their content, their more or less objective nature, their accuracy, their source, the conditions and date on which they are put online and the repercussions that their listing is likely to have for the person concerned and, on the other hand, the notoriety of that person, his or her role in public life and his or her function in society. It must also take into account the possibility of accessing the same information from a search on keywords that do not mention the name of the data subject.

In the particular case where the link leads to a web page which refers to a stage of a judicial procedure which no longer corresponds to the current judicial situation of the data subject but it appears, after the balancing carried out under the conditions set out previously, that the maintenance of its referencing is strictly necessary to inform the public, the operator of a search engine is required, at the latest at the time of the request for de-referencing, to arrange the list of results in such a way that the disputed links are preceded on this list of results by at least one link leading to one or more web pages containing up-to-date information, so that the resulting image accurately reflects the current legal situation of the person concerned.

Even though, under the Code of Criminal Procedure, access to data relating to a person's criminal convictions is in principle possible only under restrictive conditions and for limited categories of persons (relating to the lack of notoriety of the person concerned, the length of time the facts have been known, the criminal conviction and the repercussions on the applicant's rehabilitation), by finding that the applicant who alleges that he has lost two jobs as a result of the link in question, the CNIL could not legally consider that maintaining the links based on a search carried out on its name (given the nature and content of the disputed information, which gives the public direct and permanent access to the applicant’s conviction, even if this information comes from press articles whose accuracy is not disputed) was strictly necessary to inform the public for the sole reason that the judicial columns allow the public to exercise a right of oversight over the functioning of criminal justice.

Role of the Charter and role of the general principles on enforcement

• Proportionality

Elements of judicial dialogue

• Direct dialogue between CJEU and National court (preliminary reference)

Preliminary reference