Method of applying the “right to be forgotten”

Publié le 22 October 2019

The advent of internet and social networks has given birth to e-reputation, a new digital component of reputation in its traditional sense. With it, has appeared the issue of the “right to be forgotten”, which is composed of the right to erasure (art. 17 of the GDPR) and of the right to be de-referenced (consecrated in the Court Justice of the European Union -CJUE-’s May the 13thof 2014 judgement,Google Spain). The Court had to specify its application modalities in a series of two judgments handed down on September the 24th2019.

In the C-507/17 case, the French data protection authority’s (CNIL) president had given notice to Google, when proceeding to a de-referencing, to suppress the concerned hyperlink from all the domain name extensions of its research engine. Faced with a refusal to do so and the alleged inadequacy of the complementary technical measure (“geo-blocking”) proposed by Google, the authority issued 100 00 euros fine to the company. Google asked for the canceling of the sanction in front of the Council of State which in turn referred to the CJUE.

The Court had to explain its position on the territorial scope of the right to de-referencing and the obligations it includes, as well as the relevance and adequacy of technical measures such as “geo-blocking” when upholding these obligations.


1.  Reminder on the “Right to be forgotten”


The right to be forgotten is manifested in two different ways.

The first is the right to erasure based on article 17 of the General data protection Regulation (GDPR) which allows data subjects to ask for the erasure of their personal data to data controllers.

The second one is the right to be de-referenced enshrined by theGoogle Spainjudgement. In this case, M. Costeja deemed damaging to his reputation and business the presence of an article that was over 10 years old and contained outdated information pertaining to his financial situation in the list of results appearing in Google’s search engine when a request based on his name was made. He therefore asked for the article to be erased from the results list and won his case.

To quote the judgement, the right to be de-referenced obliged the operator of a search engine to “remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person” in certain conditions. The assessment of these conditions is made by the search engine operator (or, in the event of a contestation, by the competent authorities) depending on a range of circumstantial evidence which includes in particular the nature of the information, its sensitivity for the person’s private life, and the public’s interest to dispose of the information, which may vary depending on the involvement or lack of thereof of the person in public life. This right also prevails on the operator’s economic interests and on the public’s interest to access the information by researching the person’s name, except in a few specific cases.


2.  A true limitation to the scope of the right?


Following the Advocate-General’s opinion which was published on January the 7th2019, the European judge ruled in Google’s favor, considering that “it is in no way apparent that the [European legislature would] have chosen to confer a scope of the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended on impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.”.

It should however be noted that the EU law doesn’t forbid a worldwide de-referencing. At the 72ndrecital of the judgement, the Court sees it fit to emphasize that a supervisory or judicial authority of a Member State remains competent to weigh up a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information (which had already been stated as a limitation to the right to de-referencing in Google Spain) on the other, and after weighing those rights against each other, to order, where appropriate, the operator of a search engine to carry out a de-referencing concerning all versions of that search engine.

Therefore, for now, the EU judge confirms that the application of the right to de-referencing for the operator of a search engine may consist in the combination of a de-referencing for national versions of EU Member States and measures such as “geo-blocking” which while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage internet users to access the links concerned by the de-referencing request when their IP address show that they are doing the research in a Member State. This opinion is particularly relevant given the importance of the extraterritorial nature of the GDPR for all European actors involved in its creation and implementation.

The Advocate-General of the CJUE also said that this position is that which maintains the balance between the right of EU Residents to be de-referenced and the respect of fundamental rights of non-EU citizens.

However, the case is not closed yet, and it is the Council of State that will have to definitively resolve the dispute between the American giant and the French supervisory authority and determine the measures it deems fit. Finally, the European judge has not excluded the future possibility of a worldwide de-referencing.


By Oscar Lourdin


Follow us on Linkedin, Twitter et Facebook

Google Spain judgement;jsessionid=611B665AFFE75DB8FA0101C34705E4D3?text=&docid=152065&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=4840471

C‑507/17 Judgement :

Advocate-General’s conclusions in C‑507/17 judgement :