At the end of September 2019, the ECJ further specified its leading decision and clarified additional questions relating to the right to be forgotten – firstly on the geographical scope of the request for de-referencing (ECJ, September 24, 2019 – C-507/17) and secondly with regard to the responsibility of a search engine operator in handling personal data of special categories (ECJ, September 24, 2019 – C-136/17).
In the first case, search engine operator Google had brought an action against the French data protection authority, which had previously imposed a fine on the Internet giant because it had failed to de-reference personal search results worldwide.
The ECJ takes a view that differs from that of the French data protection authority: search engine operators such as Google do not have to remove personal links from their results worldwide. They would have to be removed from all European versions of the search engine, however. In addition, search engine operators would have to take reliable measures to prevent Internet users from accessing the personal, de-referenced links from Member States with the assistance of a non-EU version of the search engine.
The Luxemburg judges did not specify the activities to be taken. It is, however, obvious that geo-blocking is the tried and tested method. This refers to a technique in which a user’s location is established via the IP address or other methods and the online offering is allocated accordingly – a procedure that is frequently used in online shopping or to enforce copyrights.
The decision of the ECJ is not entirely conclusive at this point. Although it does not prescribe deletion in all versions of the search engine, it does not prohibit it either. If, therefore, the judiciary or an authority arrives at the conclusion after consideration of the matter, that deletion on a worldwide basis is necessary due to the circumstances of a special case in a Member State, the claim for erasure limited to Europe may also be globalized.
The second case also comes from France. It is based on several cases in which data subjects wanted to obligate Google to de-reference links to controversial topics – such as satirical composite images, religious affiliations or previous sexual offenses – on third-party websites from the search results that are displayed following a search by name. The French court dealing with the cases requested the ECJ to clarify the rights and obligations that search engine operators have to meet in this context.
The ECJ subsequently denied a fundamental obligation for search engine operators to de-reference links leading to websites with particularly sensitive personal data. At the same time, however, the ECJ confronts the providers with the difficult task of examining whether including the corresponding link in search results is absolutely necessary to protect other users’ freedom of information.
In addition, the European judges specify the requirements with regard to information relating to criminal proceedings against individuals. All circumstances of the individual case would have to be taken into account. A request for de-referencing should therefore always be granted if the information relates to an earlier stage of the proceedings and no longer corresponds to the current status.
The ECJ further states that even if the request is not granted, search engine operator is obligated to take the request as an opportunity to design its search results in such a way that they reflect the current legal status overall for search engine users. The current status of legal proceedings must therefore be at the top of the results that are shown.
It remains highly interesting whether these new ECJ requirements on the right to be forgotten will also be applied to other parts of the Internet in the future, such as to social media platforms or blogs. In any event, data controllers should not, for fear of an incorrect decision on the weighing of interests and the associated fines, categorically give in to all de-referencing requests. This would mean a defeat for freedom of information. Data subjects are advised to use their rights, which have been strengthened by the ECJ, because effective data protection also requires personal responsibility.