Earlier this year we reported on the two opinions of Advocate General Szpunar concerning several aspects of the right to be forgotten: 1) the role of search engine operators in relation to sensitive data; 2) the nature of the respective obligation to respond to de-referencing requests; and 3) territorial reach of required de-referencing measures.
Today the Court of Justice delivered judgments in both cases. Importantly, despite the fact that the questions were referred from the point of view of Directive 95/46, the Court also took General Data Protection Regulation 2016/679 into account (by which Directive was replaced in the meantime), in order to ensure "that its answers will in any event be of use to the referring court".
 |
| Source: Pixabay |
The direction of both judgments generally remains in line with the interpretation proposed in both opinions. In case C-136/17, the Court confirmed that restrictions on the processing of certain categories of sensitive data apply also to operators of search engines. Like in AG's opinion, that prohibition was nonetheless read in the context of responsibilities, powers and capabilities of search engine operators. Restrictions on the processing of sensitive data thus concern the stage of ex post verification triggered by a request from the data subject. The judgment further lays down which steps a search engine operator must take when assessing the notification (and these are far from trivial).
Judgment in case C-507/17 concerned the territorial scope of de-referencing measures which a search engine operator must take. The Court referred to the objective of ensuring a high level of protection of personal data in the EU, pursued by both Directive 95/46 and Regulation 2016/679. It further admitted that a de-referencing carried out on all the versions of a search engine would meet that objective in full and argued that the EU legislature enjoys competence to lay down such an obligation (para. 58). That being said, the Court considered that the EU lawmakers have not done so, thus far. In consequence, for the time being, EU data protection law does not require search engine operators to carry out a de-referencing on all world-wide versions of a search engine. Importantly, however, the Court also did not exclude a possibility for a supervisory or judicial authority of a Member State to weigh up, in the light of national standards of protection of fundamental rights, a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, where appropriate, to order such de-referencing (para. 72).
As regards the EU, the Court began by observing that, in principle, de-referencing is to be carried out in respect of all Member States (para. 66) and, if necessary, the search engine operator should be obliged to take sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. Measures of this kind should have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question while searching on the basis of that data subject’s name (para. 70). The Court left the question open whether automatic redirecting to a different national version of the search engine's website constitutes such a measure. It would seem that such blocking or redirection would then fall under the exception to customers' right of access to online interfaces, set out in Article 3(3) of Regulation 2018/302 on geo-blocking.
At the same time, however, the Court accepted that the interest of the public in accessing information may, even within the Union, vary from one Member State to another, meaning that results of the balancing exercise are not necessarily the same for all the Member States. The Court thus emphasized the role of cooperation between supervisory authorities in the Member States as an adequate framework for reconciling the conflicting rights and freedoms. It is through this framework, therefore, that a de-referencing decision, covering all searches conducted from the territory of the Union on the basis of a data subject’s name, should be adopted (para. 69).
