Court of Justice of the European Communities (including Court of First Instance Decisions)

Case C‑136/17

GC and Others

v

Commission nationale de l’informatique et des libertés (CNIL)

(Request for a preliminary ruling made by the Conseil d’État (Council of State, France))

 Judgment of the Court (Grand Chamber) of 24 September 2019
See Judgment: [2019] EUECJ C-507/17

(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union)

1.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Article 2 — Processing of personal data — Concept — Activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it, storing it and making it available to internet users — Included — Controller — Concept — Operator of a search engine — Included

(Directive of the European Parliament and of the Council 95/46, Art. 2(b) and (d))

(see paragraphs 35-37)

2.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Processing of special categories of personal data — Prohibitions or restrictions relating to the processing of those categories of data — Applicability to the operator of a search engine — Conditions

(Regulation of the European Parliament and of the Council 2016/679, Arts 9(1) and 10; Directive of the European Parliament and of the Council 95/46, Art. 8(1) and (5)

(see paragraphs 42-48, operative part 1)

3.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to the personal data and right to object to the processing of those data — Right to request the removal of links to web pages from the list of results — Conditions

(Directive of the European Parliament and of the Council 95/46, Arts 12(b) and 14(a))

(see paragraphs 50-52)

4.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46, Articles 12 and 14 — Data subject’s right of access to the personal data and right to object to the processing of those data — Search of an individual’s name using a search engine — Display of a list of results — Right to request that the information no longer be made available to the general public

(Charter of Fundamental Rights of the European Union, Arts 7 and 8; Directive of the European Parliament and of the Council 95/46, Arts 6(1)(c) to (e), 12(b) and (14)(a))

(see paragraph 53)

5.        Fundamental rights — Respect for private life — Protection of personal data — Limitations — Conditions

(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1))

(see paragraph 58)

6.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Processing of special categories of personal data — Request for de-referencing — Obligation of the operator of a search engine to accede to such a request — Exception — Data manifestly made public by the data subject — Conditions

(Regulation of the European Parliament and of the Council 2016/679, Arts 9(2)(a), (e) and (g), 17(1)(b) and (c) and 21(1); Directive of the European Parliament and of the Council 95/46, Arts 8(1), (2)(a) and (e) and (4), and (14)(a))

(see paragraphs 61-65, operative part 2)

7.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Processing of special categories of personal data — Request for de-referencing — Obligation of the operator of a search engine to accede to such a request — Exception — Protection of the freedom of information of internet users — Verification by the operator

(Charter of Fundamental Rights of the European Union, Arts 7, 8, 11 and 52(1); Regulation of the European Parliament and of the Council 2016/679, Arts 9(1) and 10; Directive of the European Parliament and of the Council 95/46, Art. 8(1) and (5)

(see paragraphs 66-69, operative part 2)

8.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Processing of special categories of personal data — Data relating to offences and criminal convictions — Concept — Information relating to legal proceedings — Included — Request for de-referencing — Obligation of an operator of a search engine to accede to such a request — Conditions — Reconciliation of the data subject’s rights to privacy and protection of personal data with the freedom of information of internet users — Verification by the operator

(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 11; Regulation of the European Parliament and of the Council 2016/679, Arts 5(1)(c) to (e) and 10; Directive of the European Parliament and of the Council 95/46, Arts 6(1)(c) to (e) and 8(4) and (5))

(see paragraphs 72-79, operative part 3)

Résumé

The prohibition on processing certain categories of sensitive personal data applies also to operators of search engines

By its judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C‑136/17), the Court, sitting as the Grand Chamber, clarified the obligations of operators of a search engine in the context of a request for de-referencing relating to sensitive data.

Google had refused to accede to the requests of four individuals to de-reference, in the list of results displayed by the search engine in response to searches against their names, various links leading to web pages published by third parties, including press articles. Following complaints by those four individuals, the Commission nationale de l’informatique et des libertés (CNIL) (French Data Protection Authority, France) refused to serve formal notice on Google to carry out the de-referencing requested. The Conseil d’État (Council of State, France), before which the case was brought, asked the Court of Justice to clarify the obligations of an operator of a search engine when handling a request for de-referencing under Directive 95/46. (1)

First, the Court recalled that the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life is prohibited, (2) subject to certain exceptions and derogations. As regards the processing of data relating to offences, criminal convictions or security measures, this may in principle be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law. (3)

The Court ruled that the prohibition and restrictions relating to the processing of those special categories of data apply to the operator of a search engine, in the same way as any other controller of personal data. The purpose of those prohibitions and restrictions is to ensure enhanced protection as regards such processing, which, because of the particular sensitivity of the data, is liable to constitute a particularly serious interference with the fundamental rights to privacy and the protection of personal data. (4)

However, the operator of a search engine is responsible not because personal data appear on a web page published by a third party but because of the referencing of that page. In those circumstances, the prohibition and restrictions relating to the processing of sensitive data apply to that operator only by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject.

Second, the Court held that when the operator receives a request for de-referencing relating to sensitive data, he is in principle required, subject to certain exceptions, to accede to that request. As regards those exceptions, the operator may, inter alia, refuse to accede to such a request if he establishes that the links lead to data which are manifestly made public by the data subject, (5) provided that the referencing of those links satisfies the other conditions of lawfulness of the processing of personal data and unless the data subject has the right to object to that referencing on grounds relating to the data subject’s particular situation. (6)

In any event, when the operator of a search engine receives a request for de-referencing, he must ascertain whether the inclusion in the list of results displayed following a search on the basis of the data subject’s name of the link to a web page on which sensitive data are published is strictly necessary for protecting the freedom of information of internet users (7) potentially interested in accessing that web page by means of such a search. In that regard, the Court pointed out that, while the rights to privacy and the protection of personal data override, as a general rule, the freedom of information of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.

Third, the Court ruled that, in the context of a request for de-referencing in respect of data relating to criminal proceedings brought against the data subject, concerning an earlier stage of the proceedings and no longer corresponding to the current situation, it is for the operator of a search engine to assess whether, in the light of all the circumstances of the case, the data subject has a right to the information in question no longer, in the present state of things, being linked with the data subject’s name by a list of results displayed following a search carried out on the basis of that name. However, even if it is not the case because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and the protection of personal data with the freedom of information of potentially interested internet users, the operator is required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.

1      Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). That directive was repealed, with effect from 25 May 2018, by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

2      Article 8(1) of Directive 95/46 and Article 9(1) of Regulation 2016/679.

3      Article 8(5) of Directive 95/46 and Article 10 of Regulation 2016/679.

4      The rights to privacy and the protection of personal data are guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

5      Article 8(2)(e) of Directive 95/46 and Article 9(2)(e) of Regulation 2016/679.

6      Article 14(a) of Directive 95/46 and Article 21(1) of Regulation 2016/679.

7      The right of freedom of expression and information is protected by Article 11 of the Charter of Fundamental Rights of the European Union.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.