The Court of Justice of the European Union has ruled in Case C-136/17 GC and Others v Commission nationale de l’informatique et des libertés that the prohibition on processing certain categories of sensitive personal data also applies to operators of search engines.
In addition, it held that in the context of a request for de-referencing, a balance must be struck between the fundamental rights of the person requesting the de-referencing and those of internet users potentially interested in that information.
The case arose in the context of proceedings concerning decisions by the French data protection authority refusing to serve formal notice on Google to de-reference various links in the search results when people searched for the claimants’ names. The links lead to third party websites including a satirical photomontage relating to a female politician that was placed online pseudonymously, articles mentioning one of the individuals concerned in his capacity as public relations officer of the Church of Scientology, the judicial investigation of a male politician and the sentencing of another individual for sexual assaults on minors.
The French referring court asked a number of questions about the interpretation of EU law on the protection of personal data. In particular, it sought to establish whether having regard to the specific responsibilities, powers and capabilities of a search engine, the prohibition imposed on other controllers on processing data falling within certain special categories such as political opinions or religious beliefs, also applied to it.
The CJEU noted that it needed to be considered whether the activity of a search engine is likely to significantly affect (and more so than the activities of website publishers), the fundamental rights to privacy and so the protection of personal data. If so, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of their responsibilities, powers and capabilities, that the activity meets the requirements of EU law so that the guarantees provided by EU law may have full effect. This means that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.
Secondly, the CJEU clarified that processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life is prohibited, subject to certain exceptions and derogations. In addition, subject to specific derogations, the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of an official authority. A complete register of criminal convictions may be kept only under the control of an official authority. The court said that prohibition and those restrictions apply, subject to the exceptions provided for by EU law, to all controllers carrying out such processing.
However, the court emphasised that the operator of a search engine is responsible, not because sensitive data appears on a third party website, but because of the referencing of that page and in particular, the display of the link to that website in results presented to internet users following a search.
The court also ruled that as a general rule the data subject’s rights override the freedom of information of internet users. However, that balance may be called into question depending on the nature of the information in question and its sensitivity for the data subject’s private life and taking into account the interest of the public in having that information. This interest may vary, in particular, according to the role played by the data subject in public life.
Consequently the court concluded that where the operator of a search engine receives a request for de-referencing relating to a link to a web page on which sensitive information is published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data, decide if the inclusion of that link in the displayed results following a search for the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search.
Furthermore, where the processing relates to data which is made public by the data subject, an operator of a search engine may refuse a request for de-referencing as long as the processing satisfies all the other conditions of lawfulness and unless the data subject has the right to object to that processing on compelling legitimate grounds relating to his or her particular situation.
Finally, the court considered websites containing data relating to criminal proceedings brought against a particular person, concerning an earlier stage of the proceedings and no longer corresponding to the current situation. In those cases it is for the operator of the search engine to assess whether that person has a right to the information in question no longer being linked with his or her name by a list of results displayed following a search for his or her name.
To assess that right, the operator of the search engine must take into consideration all the circumstances of the case, such as, in particular, the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by that person in public life and his or her past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for that person.
The operator of a search engine must agree to a request for de-referencing relating to legal proceedings/a conviction if that relates to an earlier stage of the proceedings and is no longer current, as long as it is established that, in the light of all the circumstances of the case, the data subject’s fundamental rights override the rights of potentially interested internet users.
The Court also made clear that, if even if this is not the case, the operator is required, at the latest when a request for de-referencing is made, to adjust the list of results so that the overall picture it gives the internet user reflects the current legal position.
