In two significant judgements made on September 24, 2019, the top court of the European Union, the CJEU, has deliberated upon the scope of the delisting and de-indexing requirements (otherwise known as the Right to Be Forgotten (‘RTBF’)) to be followed by search engine operators under the EU’s data protection laws, including the Data Protection Directive as well as the more recent General Data Protection Regulation. In Google v CNIL, the Court has held that EU law does not require or prohibit national data protection authorities from enforcing the delinking requirement at a global scale. In another dispute between French residents and CNIL, the Court has held that higher obligations for delinking exist for specific categories of sensitive personal information.
The judgements are important developments in the field of intermediary liability and data protection, particularly as India looks to import certain concepts of the right to be forgotten into its own data protection regulations.
Google Spain and the Right to Be Forgotten in the EU
The initial development of the right to ‘de-listing’ of personal information emerged in the EU as a consequence of a landmark judgement by the CJEU in Google v Spain, where the court had held that search engines must remove links to a webpage that contains personal information which is ‘inadequate, irrelevant or no longer relevant, or excessive’, (even if otherwise lawful), upon receiving adequate notice from individuals. The ruling, made in 2014, was delivered under the 1996 Data Protection Directive 95/46/EC, and linked back to Article 12(b) of the Directive, which provides that data subjects have the right to ‘rectification, erasure or blocking of data the processing of which does not comply with the provisions of [the] Directive.’
However, the Court also held that the right was not absolute and had to be read in context of the exemptions provided under the Directive, including balancing public interest in the personal information with the individual’s right to privacy. This balancing exercise was, largely, left in the hands of the search engine operator.
While Google’s Transparency Report indicates that around 45% of de-listing requests are denied, criticisms about the takedown of content relating to politicians and public figures and Google’s uneasy role as the arbiter of rights abounds as well. Even though the scope and application of the right of delinking has been largely shaped by Google’s internal practices and rules, questions ultimately arose in disputes concerning the delinking right, which were ultimately referred to the CJEU.
The Conseil d’État References: Viva La Google?
The judgements delivered by the CJEU both relate to the scope of the delinking obligation under EU law, but both arise from different disputes.
In the first case, Google v CNIL, the Court was concerned with the territorial scope of delinking requests. CNIL, the French data protection authority, claimed that an order for delinking must be enforced by Google ‘globally’, or on all of Google’s domain name extensions, which differ between jurisdictions and offer slightly differentiated services. Google argued that it was sufficient to de-link only within the EU member states or the member state of residence of the data subject. The CJEU held that EU law did not mandate that the de-linking request must be followed globally, but must at least de-link the impugned links on all versions of the search engine corresponding to EU member states. However, importantly, the decision comes with two caveats –
Firstly, the CJEU did not rule out global delisting on search engines entirely. In a somewhat incongruent phrase in Paragraph 72, the Court states that:
“a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.”
This leaves the door open to data protection agencies in EU states to consider situations which may gravely affect the right to privacy and order a global delisting in such situations. However, it does mean that, for the present, the EU’s right to be forgotten is restricted to the EU itself, and those of us outside its hallowed boundaries can continue to access ‘inadequate, irrelevant or excessive’ personal information.
Secondly, the CJEU ruling also requires that search engines must take ‘sufficiently effective’ measures which prevent individuals in member states from accessing the information required to be de-linked in the EU, which presumably corresponds to Google geo-fencing EU residents and redirecting to national versions of the search engine.
In the second case, concerning French citizens petitioning the CNIL, the Court was concerned with whether prohibitions on the processing of special categories of personal information applied to search engines and indexes, and if so, to what extent. These correspond to ‘sensitive’ personal information such as legal proceedings, criminal convictions, political beliefs, race or ethnicity, etc. The Court held that, for information falling within these categories, there is a default obligation on search engines to de-link such information. However, this too is subject to specific exemptions which must be weighed up and enforced by the search engines themselves. As the Court notes:
“where the operator of a search engine has received a request for de-referencing relating to a link to a web page … the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data … ascertain, having regard to the reasons of substantial public interest … whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.”
Therefore, search engines bear a higher burden of proving ‘strict necessity’ prior to refusing the de-indexing of the special categories of information. In addition, the Court held that:
“even if the operator of a search engine were to find that that is not the case because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and protection of personal data with the freedom of information of potentially interested internet users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.”
As Daphne Keller notes on Twitter, this innocuously placed paragraph has immense implications for individual name searches on Google, and also marks an interesting precedent for active intervention into determining the effect of Google’s search algorithms, apart from merely requiring Google to oblige with Notice-and-Takedown requests.
The above decisions are being praised as a victory for free speech (and for Google), and, indeed, the CJEU’s restraint and deference towards international comity in matters of cross-border effects of the privacy laws on internet access is something that should be praised – particularly in the context of other countries like Canada issuing ‘global’ takedown orders against Google in similar matters (which I had reported here).
However, I am skeptical about how much of a victory this is, particularly given the wide scope of the caveats in the first decision, and also the precedent for active judicial interventions in search algorithms without much law or indeed rationale backing such an intervention in the second. India’s own right to be forgotten jurisprudence has developed quite unevenly, and is likely to develop further – these latest developments in the EU should be carefully looked at to frame the appropriate scope for a right to be forgotten in India, particularly in its territorial scope.