In May 2016, Google was reported to have unsuccessfully appealed against the French highest administrative court, the Conseil d’Etat, over a ruling that the decision in Google Spain requires delisting on all versions of the search engine, including google.com. A new episode of the battle over the interpretation of right to be forgotten requests is now taking place between data subjects and the French Data Protection Authority, CNIL.
On 2 February 2017, the Conseil d’Etat heard four joined appeals relating to right to be forgotten requests. In all four cases, Google refused to delist a number of links appearing on its results page when doing a search against the data subjects’ names. The data subjects appealed such refusal before the CNIL, but the CNIL refused to overturn it.
The hearing was held before the assemblée du contentieux, signalling that the case is considered to be of high importance. Indeed, this is a section of the Conseil d’Etat which only convenes to hear cases which are expected to have far ranging legal effects. The Court must determine which of the Articles of Directive 95/46/EC (the “Directive”), as applied by the French Data Protection Act, are applicable to Google in the context of right to be forgotten requests.
Complicating factors
Following the Google Spain v Costeja case, the data protection authorities have identified criteria used to assess the merits of a delisting request based on the data subject’s right to be forgotten (see here for the CNIL’s guidance on such criteria, and here for the ICO’s).
However, the four joined appeals feature complicating factors which were not present in the Google Spain v Costeja case. In all four cases the legality of the data processing activity is questioned, on the grounds that the relevant data is incomplete, inaccurate and/or sensitive.
This includes a case in which the claimant was reportedly sentenced in 2010 to a 7-year imprisonment sentence for pedophilia (although it is unclear whether or not his conviction is spent). A search for his name features links to articles published in major national newspapers and which relate to his conviction. In relation to convictions, Google’s guidelines indicate that it possesses a wide margin of appreciation:
“Consistent with local law governing the rehabilitation of offenders, we tend to weigh in favor of delisting content relating to a conviction that is spent, accusations that are proven false in a court of law, or content relating to a criminal charge of which the requester was acquitted. We also consider the age of this content and the nature of the crime in our analysis.”
The public rapporteur, an independent administrative judge acting as a neutral advisor to the court, suggested that the Conseil d’Etat’s decision would ultimately depend on the interpretation of Articles 8 and 9 of the Directive. These provisions regulate the situations in which the processing of data is prohibited, and the relevant exceptions. She therefore advised the Conseil d’Etat to make a reference for a preliminary ruling to the Court of Justice of the European Union on this subject.
Suggested interpretations
The public rapporteur identified two possible interpretations. The first is the more radical one. It would entail considering that although search engines are data controllers, they are not subject to the obligations of Article 8 because this would carry “excessive consequences”. To support this interpretation, she cited a passage of the Google Spain v Costeja case, according to which a search engine only acts as a data controller “within the framework of its responsibilities, powers and capabilities”. She did note, however, that this argument was disputable.
The second interpretation consists in finding a balance between subjecting search engines to the obligations of Article 8 as a matter of principle, and establishing relevant exceptions to alleviate the negative consequences of the data processing prohibitions deriving from Article 8. The public rapporteur noted that this may include a right for search engines to process sensitive data if the source is a newspaper article.
This second strand of interpretation is grounded in the new provisions of the General Data Protection Regulation, which will enter into force on 25 May 2018. According to Article 17(3)(a), the data subject’s right to obtain from the controller the erasure of personal data concerning him or her “shall not apply to the extent that processing is necessary for exercising the right of freedom of expression and information”.
This appears to largely preserve the status quo, which involves balancing the data subject’s right to privacy against the question as to whether the links complained of are adequate and relevant, and whether their continuing availability in search results in response to a search against the data subject’s name serves a legitimate purpose and is in the public interest.
Outcome of the case yet unknown
It is expected that the Conseil d’Etat will deliver its ruling within 1 to 3 weeks’ time. Should a question be referred to Luxembourg for a preliminary ruling, the procedure will likely take many months.
Google’s lawyer cautioned against a request for a preliminary ruling, as this risked opening a Pandora’s box. He noted that the principles derived from the Google Spain v Costeja case “work” and that appeals are made to the CNIL against Google’s decisions in only 0.44% of the cases.
Mathilde Groppo is currently working as a paralegal at Carter-Ruck, as part of her French qualification to practice. She has a special interest in media law and data protection.
Reblogged this on World4Justice : NOW! Lobby Forum..