REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 19 July 2017, received at the Court on 21 August 2017, in the proceedings
The dispute in the main proceedings and the questions referred for a preliminary ruling
30
By decision of 21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, it must apply that removal to all its search engine’s domain name extensions.
31
Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States.
32
The CNIL also regarded as insufficient Google’s further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject’s name, no matter which version of the search engine they used.
33
By an adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of EUR 100 000, which was made public.
34
By application lodged with the Conseil d’État (Council of State, France), Google seeks annulment of that adjudication.
35
The Conseil d’État notes that the processing of personal data carried out by the search engine operated by Google falls within the scope of the Law of 6 January 1978, in view of the activities of promoting and selling advertising space carried on in France by its subsidiary Google France.
36
The Conseil d’État also notes that the search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries on its activities. Where the search is conducted from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the State from which that search is deemed to have been made, as identified by the internet user’s IP address. However, regardless of his or her location, the internet user remains free to conduct his or her searches using the search engine’s other domain names. Moreover, although the results may differ depending on the domain name from which the search is conducted on the search engine, it is common ground that the links displayed in response to a search derive from common databases and common indexing.
37
The Conseil d’État considers that, having regard, first, to the fact that Google’s search engine domain names can all be accessed from French territory and, secondly, to the existence of gateways between those various domain names, as illustrated in particular by the automatic redirection mentioned above, as well as by the presence of cookies on extensions of that search engine other than the one on which they were initially deposited, that search engine, which, moreover, has been the subject of only one declaration to the CNIL, must be regarded as carrying out a single act of personal data processing for the purposes of applying the Law of 6 January 1978. As a result, the processing of personal data by the search engine operated by Google is carried out within the framework of one of its installations, Google France, established on French territory, and is therefore subject to the Law of 6 January 1978.
38
Before the Conseil d’État, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of 6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in its judgment of
13 May 2014,
Google Spain and Google
(C‑131/12, EU:C:2014:317
), recognised a ‘right to de-referencing’. Google argues that this right does not necessarily require that the links at issue are to be removed, without geographical limitation, from all its search engine’s domain names. In addition, by adopting such an interpretation, the CNIL disregarded the principles of courtesy and non-interference recognised by public international law and disproportionately infringed the freedoms of expression, information, communication and the press guaranteed, in particular, by Article 11 of the Charter.
39
Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Conseil d’État has decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
-
Must the “right to de-referencing”, as established by the [Court] in its judgment of
13 May 2014, [
Google Spain and Google
(C‑131/12, EU:C:2014:317
),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]?
-
In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States …?
-
Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46], regardless of the domain name used by the internet user conducting the search?’
Consideration of the questions referred
40
The case in the main proceedings is the result of a dispute between Google and the CNIL as to how a search engine operator, where it establishes that a data subject is entitled to have one or more links to web pages containing personal data concerning him or her removed from the list of results which is displayed following a search conducted on the basis of his or her name, is to give effect to that right to de-referencing. Although Directive 95/46 was applicable on the date the request for a preliminary ruling was made, it was repealed with effect from 25 May 2018, from which date Regulation 2016/679 is applicable.
41
The Court will examine the questions referred in the light of both that directive and that regulation in order to ensure that its answers will be of use to the referring court in any event.
42
During the proceedings before the Court, Google explained that, following the bringing of the request for a preliminary ruling, it has implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national version of the search engine accessed by that user. Thus, the internet user is now automatically directed to the national version of Google’s search engine that corresponds to the place from where he or she is presumed to be conducting the search, and the results of that search are displayed according to that place, which is determined by Google using a geo-location process.
43
In those circumstances, the questions referred, which must be dealt with together, should be understood as seeking to ascertain, in essence, whether Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679 are to be interpreted as meaning that, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is required to carry out that de-referencing on all versions of its search engine, or whether, on the contrary, it is required to do so only on the versions of that search engine corresponding to all the Member States, or even only on the version corresponding to the Member State in which the request for de-referencing was made, using, where appropriate, the technique known as ‘geo-blocking’ in order to ensure that an internet user cannot, regardless of the national version of the search engine used, gain access to the links concerned by the de-referencing in the context of a search conducted from an IP address deemed to be located in the Member State of residence of the person benefiting from the right to de-referencing or, more broadly, in any Member State.
44
As a preliminary point, it should be borne in mind that the Court has held that Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful (judgment of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraph 88
).
45
The Court has also stated that, when appraising the conditions for the application of those same provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him or her personally should, at that point in time, no longer be linked to his or her name by a list of results displayed following a search made on the basis of his or her name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his or her fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his or her fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question (judgment of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraph 99
).
46
In the context of Regulation 2016/679, that right of a data subject to de-referencing is now based on Article 17 of that regulation, which specifically governs the ‘right to erasure’, also referred to, in the heading of that article, as the ‘right to be forgotten’.
47
Pursuant to Article 17(1) of Regulation 2016/679, a data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase personal data without undue delay where one of the grounds listed in that provision applies. Article 17(3) of that regulation specifies that Article 17(1) does not apply to the extent that processing is necessary for one of the reasons listed in the former provision. Those reasons include, in particular, under Article 17(3)(a) of that regulation, the exercise of the right of, inter alia, freedom of information of internet users.
48
It follows from Article 4(1)(a) of Directive 95/46 and Article 3(1) of Regulation 2016/679 that both that directive and that regulation permit data subjects to assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not.
49
In that regard, the Court has held that the processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State (judgment of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraph 60
).
50
In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Union are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that search engine is, at the same time, the means enabling those activities to be performed, the display of the list of results being accompanied, on the same page, by the display of advertising linked to the search terms (see, to that effect, judgment of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraphs 56 and 57
).
51
That being so, the fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establishment of the controller on the territory of a Member State escaping the obligations and guarantees laid down by Directive 95/46 and Regulation 2016/679 (see, to that effect, judgment of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraph 58
).
52
In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that, in those circumstances, that act of processing is carried out within the framework of Google’s establishment in French territory. It thus appears that such a situation falls within the territorial scope of Directive 95/46 and Regulation 2016/679.
53
By its questions, the referring court seeks to determine the territorial scope which must be conferred on a de-referencing in such a situation.
54
In that regard, it is apparent from recital 10 of Directive 95/46 and recitals 10, 11 and 13 of Regulation 2016/679, which was adopted on the basis of Article 16 TFEU, that the objective of that directive and that regulation is to guarantee a high level of protection of personal data throughout the European Union.
55
It is true that a de-referencing carried out on all the versions of a search engine would meet that objective in full.
56
The internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual’s name ubiquitous (see, to that effect, judgments of
13 May 2014,
Google Spain and Google
, C‑131/12, EU:C:2014:317, paragraph 80
, and of
17 October 2017,
Bolagsupplysningen and Ilsjan
, C‑194/16, EU:C:2017:766, paragraph 48
).
57
In a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.
58
Such considerations are such as to justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.
59
That being said, it should be emphasised that numerous third States do not recognise the right to de-referencing or have a different approach to that right.
60
Moreover, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect, judgment of
9 November 2010,
Volker und Markus Schecke and Eifert
, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 48
, and Opinion 1/15 (EU-Canada PNR Agreement) of
26 July 2017, EU:C:2017:592, point 136
). Furthermore, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.
61
While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679, struck a balance between that right and that freedom so far as the Union is concerned (see, to that effect, today’s judgment, GC and Others(De-referencing of sensitive data), C‑136/17, paragraph 59), it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.
62
In particular, it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in paragraph 54 above is met, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended to impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.
63
Moreover, although Regulation 2016/679 provides the supervisory authorities of the Member States, in Articles 56 and 60 to 66 thereof, with the instruments and mechanisms enabling them, where appropriate, to cooperate in order to come to a joint decision based on weighing a data subject’s right to privacy and the protection of personal data concerning him or her against the interest of the public in various Member States in having access to information, it must be found that EU law does not currently provide for such cooperation instruments and mechanisms as regards the scope of a de-referencing outside the Union.
64
It follows that, currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.
65
Having regard to all of the foregoing, a search engine operator cannot be required, under Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, to carry out a de-referencing on all the versions of its search engine.
66
Regarding the question whether such a de-referencing is to be carried out on the versions of the search engine corresponding to the Member States or only on the version of that search engine corresponding to the Member State of residence of the person benefiting from the de-referencing, it follows from, inter alia, the fact that the EU legislature has now chosen to lay down the rules concerning data protection by way of a regulation, which is directly applicable in all the Member States, which has been done, as is emphasised by recital 10 of Regulation 2016/679, in order to ensure a consistent and high level of protection throughout the European Union and to remove the obstacles to flows of personal data within the Union, that the de-referencing in question is, in principle, supposed to be carried out in respect of all the Member States.
67
However, it should be pointed out that the interest of the public in accessing information may, even within the Union, vary from one Member State to another, meaning that the result of weighing up that interest, on the one hand, and a data subject’s rights to privacy and the protection of personal data, on the other, is not necessarily the same for all the Member States, especially since, under Article 9 of Directive 95/46 and Article 85 of Regulation 2016/679, it is for the Member States, in particular as regards processing undertaken solely for journalistic purposes or for the purpose of artistic or literary expression, to provide for the exemptions and derogations necessary to reconcile those rights with, inter alia, the freedom of information.
68
It follows from, inter alia, Articles 56 and 60 of Regulation 2016/679 that, for cross-border processing as defined in Article 4(23) of that regulation, and subject to Article 56(2) thereof, the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid down in those provisions, in order to reach a consensus and a single decision which is binding on all those authorities and with which the controller must ensure compliance as regards processing activities in the context of all its establishments in the Union. Moreover, Article 61(1) of Regulation 2016/679 obliges the supervisory authorities, in particular, to provide each other with relevant information and mutual assistance in order to implement and to apply that regulation in a consistent manner throughout the Union, and Article 63 of that regulation specifies that it is for this purpose that provision has been made for the consistency mechanism set out in Articles 64 and 65 thereof. Lastly, the urgency procedure provided for in Article 66 of Regulation 2016/679 permits the immediate adoption, in exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, of provisional measures intended to produce legal effects on its own territory with a specified period of validity which is not to exceed three months.
69
That regulatory framework thus provides the national supervisory authorities with the instruments and mechanisms necessary to reconcile a data subject’s rights to privacy and the protection of personal data with the interest of the whole public throughout the Member States in accessing the information in question and, accordingly, to be able to adopt, where appropriate, a de-referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject’s name.
70
In addition, it is for the search engine operator to take, if necessary, sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. Those measures must themselves meet all the legal requirements and have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name (see, by analogy, judgments of
27 March 2014,
UPC Telekabel Wien
, C‑314/12, EU:C:2014:192, paragraph 62
, and of
15 September 2016,
McFadden
, C‑484/14, EU:C:2016:689, paragraph 96
).
71
It is for the referring court to ascertain whether, also having regard to the recent changes made to its search engine as set out in paragraph 42 above, the measures adopted or proposed by Google meet those requirements.
72
Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (see, to that effect, judgments of
26 February 2013,
Åkerberg Fransson
, C‑617/10, EU:C:2013:105, paragraph 29
, and of
26 February 2013,
Melloni
, C‑399/11, EU:C:2013:107, paragraph 60
), a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.
73
In the light of all of the foregoing, the answer to the questions referred is that, on a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
On those grounds, the Court (Grand Chamber) hereby rules: