DATA PROTECTION
EU Court of Justice: the prohibition on processing certain categories of sensitive personal data applies also to operators of search engines
Ms G.C., Mr A.F., Mr B.H. and Mr E.D. brought proceedings before the Conseil d’État (Council of State, France) against the Commission nationale de l’informatique et des libertés (CNIL) (French Data Protection Authority) concerning four decisions of the CNIL refusing to serve formal notice on Google Inc. to de-reference various links appearing in the lists of results displayed following searches of their names. Those links lead to web pages published by third parties that include a satirical photomontage relating to a female politician that was placed online pseudonymously and articles mentioning one of the individuals concerned in his capacity as public relations officer of the Church of Scientology, the judicial investigation of a male politician and the sentencing of another individual for sexual assaults on minors.
The Council of State referred a number of questions to the Court of Justice concerning the interpretation of EU law on the protection of personal data.
The Council of State seeks, in particular, to establish whether, having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, the prohibition imposed on other controllers on processing data falling within certain special categories (such as political opinions, religious or philosophical beliefs and sex life) applies also to the operator of a search engine.
In today’s judgment, the Court notes that, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of EU law in order that the guarantees laid down by EU law may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.
The Court then makes clear that the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life is prohibited, subject to certain exceptions and derogations. In addition, subject to specific derogations, the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, and a complete register of criminal convictions may be kept only under the control of official authority.
The Court considers that that prohibition and those restrictions apply, subject to the exceptions provided for by EU law, to all controllers carrying out such processing.
It emphasises, however, that the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search. It is by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject, that the prohibition or restrictions can apply to the operator of a search engine.
The Court finds, next, that while the data subject’s rights override, as a general rule, the freedom of information of internet users, that balance may be called into question depending on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
Thus, the Court concludes that, where the operator of a search engine receives a request for de-referencing relating to a link to a web page on which sensitive data are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data, ascertain whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.
Furthermore, where the processing relates to data which are manifestly made public by the data subject, an operator of a search engine may refuse to accede to a request for de-referencing provided that the processing satisfies all the other conditions of lawfulness and unless the data subject has the right to object to that processing on compelling legitimate grounds relating to his or her particular situation.
Lastly, as regards web pages containing data relating to criminal proceedings brought against a particular person, concerning an earlier stage of the proceedings and no longer corresponding to the current situation, it is for the operator of the search engine to assess whether that person has a right to the information in question no longer, in the present state of things, being linked with his or her name by a list of results displayed following a search carried out on the basis of his or her name. In order to assess that right, the operator of the search engine must take into consideration all the circumstances of the case, such as, in particular, the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by that person in public life and his or her past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for that person.
The operator of a search engine is thus required to accede to a request for de-referencing in respect of links to web pages displaying information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction, where that information relates to an earlier stage of the legal proceedings in question and no longer corresponds to the current situation, in so far as it is established that, in the light of all the circumstances of the case, the data subject’s fundamental rights override the rights of potentially interested internet users.
The Court also makes clear that, even if the operator of a search engine were to find that the data subject does not have a right to the de-referencing of such links because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and protection of personal data with the freedom of information of potentially interested internet users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.
(Source: Press Release of the EU Court of Justice no. 113/2019 – Author and ownership of the contents: EU Court of Justice).
The Council of State referred a number of questions to the Court of Justice concerning the interpretation of EU law on the protection of personal data.
The Council of State seeks, in particular, to establish whether, having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, the prohibition imposed on other controllers on processing data falling within certain special categories (such as political opinions, religious or philosophical beliefs and sex life) applies also to the operator of a search engine.
In today’s judgment, the Court notes that, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of EU law in order that the guarantees laid down by EU law may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.
The Court then makes clear that the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life is prohibited, subject to certain exceptions and derogations. In addition, subject to specific derogations, the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, and a complete register of criminal convictions may be kept only under the control of official authority.
The Court considers that that prohibition and those restrictions apply, subject to the exceptions provided for by EU law, to all controllers carrying out such processing.
It emphasises, however, that the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search. It is by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject, that the prohibition or restrictions can apply to the operator of a search engine.
The Court finds, next, that while the data subject’s rights override, as a general rule, the freedom of information of internet users, that balance may be called into question depending on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
Thus, the Court concludes that, where the operator of a search engine receives a request for de-referencing relating to a link to a web page on which sensitive data are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data, ascertain whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.
Furthermore, where the processing relates to data which are manifestly made public by the data subject, an operator of a search engine may refuse to accede to a request for de-referencing provided that the processing satisfies all the other conditions of lawfulness and unless the data subject has the right to object to that processing on compelling legitimate grounds relating to his or her particular situation.
Lastly, as regards web pages containing data relating to criminal proceedings brought against a particular person, concerning an earlier stage of the proceedings and no longer corresponding to the current situation, it is for the operator of the search engine to assess whether that person has a right to the information in question no longer, in the present state of things, being linked with his or her name by a list of results displayed following a search carried out on the basis of his or her name. In order to assess that right, the operator of the search engine must take into consideration all the circumstances of the case, such as, in particular, the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by that person in public life and his or her past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for that person.
The operator of a search engine is thus required to accede to a request for de-referencing in respect of links to web pages displaying information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction, where that information relates to an earlier stage of the legal proceedings in question and no longer corresponds to the current situation, in so far as it is established that, in the light of all the circumstances of the case, the data subject’s fundamental rights override the rights of potentially interested internet users.
The Court also makes clear that, even if the operator of a search engine were to find that the data subject does not have a right to the de-referencing of such links because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and protection of personal data with the freedom of information of potentially interested internet users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.
(Source: Press Release of the EU Court of Justice no. 113/2019 – Author and ownership of the contents: EU Court of Justice).
