This issue motivated a request for a preliminary ruling of the Court of Justice of
the European Union from the French Conseil d’État,
159 to which the Court replied as
follows
160 :
On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/
679 of the European Parliament and of the Council of 27 April 2016 on the protection of
individuals with regard to the processing of personal data and on the free movement of such
data and repealing Directive 95/46 (General Data Protection Regulation), where a search
engine operator grants a request for de-referencing pursuant to those provisions, that
operator is not required to carry out that de-referencing on all versions of its search engine,
but on the versions of that search engine corresponding to all the Member States, using,
where necessary, measures which, while meeting the legal requirements, effectively prevent
or, at the very least, seriously discourage an internet user conducting a search from one of the
Member States on the basis of a data subject’s name from gaining access, via the list of
results displayed following that search, to the links which are the subject of that request.
In this landmark judgment, the Court has, in sum, decided that the right to be
forgotten does not require search engine operators to de-list search results on a
global basis, but rather solely within the EU territory.
While acknowledging that the objective of Directive 95/46/EC and the GDPR is
to “guarantee a high level of protection of personal data throughout the European
Union” (para. 54) and that a de-referencing carried out on all the versions of a search
engine “would meet that objective in full” (para. 55), the Court admitted—as this
Report shows—that “numerous third States do not recognise the right to
de-referencing or have a different approach to that right” (para. 59) and that the
right to the protection of personal data is not an absolute right, and must be balanced
against other fundamental rights, in accordance with the principle of proportionality
(para. 60). Furthermore, the Court stated, “the balance between the right to privacy
and the protection of personal data, on the one hand, and the freedom of information
of internet users, on the other, is likely to vary significantly around the world”
(ibidem).
In particular, the Court noted, it is not apparent from the wording of the Directive
or the GDPR that the EU legislature would, for the purposes of ensuring that the said
159 Case C-507/17, Google, OJ C 347, 16.10.2017, p. 22. An opinion was rendered by Advocate
General Maciej Szpunar on 10 January 2019 in respect of the issues raised in this request for a
preliminary ruling, according to which “the search engine operator is not required, when acceding to
a request for de-referencing, to carry out that de-referencing on all the domain names of its search
engine in such a way that the links in question no longer appear, irrespective of the location from
which the search on the basis of the requesting party’s name is performed”. Nevertheless, according
to the Advocate General “once a right to de-referencing within the EU has been established, the
search engine operator must take every measure available to it to ensure full and effective
de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an
IP address deemed to be located in one of the Member States, irrespective of the domain name used
by the internet user who performs the search”. See, on this, de Miguel Asensio (2019).
160 Judgment of the Court (Grand Chamber) of 24 September 2019, ECLI:EU:C:2019:772.
34
D. Moura Vicente and S. de Vasconcelos Casimiro
the European Union from the French Conseil d’État,
159 to which the Court replied as
follows
160 :
On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/
679 of the European Parliament and of the Council of 27 April 2016 on the protection of
individuals with regard to the processing of personal data and on the free movement of such
data and repealing Directive 95/46 (General Data Protection Regulation), where a search
engine operator grants a request for de-referencing pursuant to those provisions, that
operator is not required to carry out that de-referencing on all versions of its search engine,
but on the versions of that search engine corresponding to all the Member States, using,
where necessary, measures which, while meeting the legal requirements, effectively prevent
or, at the very least, seriously discourage an internet user conducting a search from one of the
Member States on the basis of a data subject’s name from gaining access, via the list of
results displayed following that search, to the links which are the subject of that request.
In this landmark judgment, the Court has, in sum, decided that the right to be
forgotten does not require search engine operators to de-list search results on a
global basis, but rather solely within the EU territory.
While acknowledging that the objective of Directive 95/46/EC and the GDPR is
to “guarantee a high level of protection of personal data throughout the European
Union” (para. 54) and that a de-referencing carried out on all the versions of a search
engine “would meet that objective in full” (para. 55), the Court admitted—as this
Report shows—that “numerous third States do not recognise the right to
de-referencing or have a different approach to that right” (para. 59) and that the
right to the protection of personal data is not an absolute right, and must be balanced
against other fundamental rights, in accordance with the principle of proportionality
(para. 60). Furthermore, the Court stated, “the balance between the right to privacy
and the protection of personal data, on the one hand, and the freedom of information
of internet users, on the other, is likely to vary significantly around the world”
(ibidem).
In particular, the Court noted, it is not apparent from the wording of the Directive
or the GDPR that the EU legislature would, for the purposes of ensuring that the said
159 Case C-507/17, Google, OJ C 347, 16.10.2017, p. 22. An opinion was rendered by Advocate
General Maciej Szpunar on 10 January 2019 in respect of the issues raised in this request for a
preliminary ruling, according to which “the search engine operator is not required, when acceding to
a request for de-referencing, to carry out that de-referencing on all the domain names of its search
engine in such a way that the links in question no longer appear, irrespective of the location from
which the search on the basis of the requesting party’s name is performed”. Nevertheless, according
to the Advocate General “once a right to de-referencing within the EU has been established, the
search engine operator must take every measure available to it to ensure full and effective
de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an
IP address deemed to be located in one of the Member States, irrespective of the domain name used
by the internet user who performs the search”. See, on this, de Miguel Asensio (2019).
160 Judgment of the Court (Grand Chamber) of 24 September 2019, ECLI:EU:C:2019:772.
34
D. Moura Vicente and S. de Vasconcelos Casimiro