The Court of Justice of the European Union (CJEU)
The Court of Justice of the European Union (CJEU) in 2019 released its landmark decisions in cases C-507/17, Google v. CNIL and GC. et al. v. CNIL. These cases involved the territorial scope of “the right to be forgotten” and the circumstances under which a person may exercise the “rights to be forgotten” based on links to pages which consist sensitive data pursuant to the EU Data Protection Directive and the EU General Data Protection Regulation (GDPR).
In 2015, the CNIL requested Google LLC to remove all search result, including links to pages with false or insufficient information about an individual, from search engine. The CNIL wanted search results to be removed from search engines worldwide. Instead, Google deleted those originating in the EU Member States and missed the deadline for transposing the CNIL’s request. In 2016, a fine amounting to €100,000 was imposed on Google, and the company failed to pay it.
The CJEU argued that it recognised the “right to be forgotten” in Google Spain and Google v. AEPD & Gonzalez and held that Google and other search engines are only responsible for removing results from domains within the EU, but not worldwide. The “right to be forgotten” is acknowledged and enshrined under Article 17 of the GDPR, where personal details/data should be erased based on numerous circumstances, including withdrawal of consent by data subjects, unnecessary data, false and inadequate information. Application of Article 17(3) of the GDPR has developed a balancing test, similar to the test adopted in Google Spain, which recognise and acknowledge that the “right to be forgotten” is not an absolute right and cannot be enjoyed by non-Member States.
In GC and Others v. CNIL, the CJEU held that search engine operators are responsible for ensuring that results from their search engines are amended to make sure that “the overall picture it gives the internet user reflects the current legal position” of the person involved. The case was filed after CNIL refused to provide formal notices to Google to remove or de-reference some links to those sites containing individuals’ sensitive data. The CJEU ruled that prohibition on the processing of specific categories of individuals’ sensitive data was applicable to search engine operators, such as Google. However, the CJEU further noted that parties must balance between the fundamental rights of individuals requesting to exercise their rights to be forgotten/de-referencing and those potentially interested in that sensitive data.