CJEU looks at the right to be forgotten in the context of sensitive personal data

What's the issue?

The CJEU ruled on a second case involving the right to be forgotten online (GC and Others v CNIL), again largely following the earlier AG Opinion. This reference was made regarding four separate cases which were joined by the French courts and which related to requests to de-list search results of URLs which led to sensitive personal data.

What's the development?

The first question considered related to whether the prohibition on processing sensitive personal data applied to the activities of a search engine.

The CJEU found that the prohibition does apply (subject to exceptions and derogations), not because the sensitive personal data appears on a web page published by a third party, but because of its referencing by the search engine and, in particular, the display of the link to that web page in the list of results presented to internet users following a search. It is by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject, that the prohibition or restrictions on controllers processing sensitive personal data can apply to a search engine operator.

If the search engine operator receives a request for de-linking to pages containing sensitive personal data, the operator must, on a case by case basis, taking into account the seriousness of the interference with the data subject's privacy rights, ascertain whether the inclusion of that link is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search. This departs from the AG Opinion which said a balancing exercise was not necessary where sensitive data was concerned.

A search engine operator may turn down a de-referencing request where the processing relates to data manifestly made public by the data subject, provided the processing satisfies all other conditions of lawfulness and unless the data subject has the right to object to that processing on compelling legitimate grounds relating to their specific situation.

Where a request to de-reference relates to data about criminal proceedings brought against a particular person, which are no longer up to date (so they relate to an earlier stage of proceedings), it is for the search engine operator to assess whether the person has the right to that information no longer being linked to them in a list of search results. This decision must be taken on a case by case basis taking into account all circumstances of the case and, in particular:

• The nature and seriousness of the offence in question.
• The progress and outcome of the proceedings.
• The time elapsed.
• The part played by that person in public life and their past conduct.
• The public interest at the time of the request.
• The content and form of the publication linked to.
• The consequences of its publication for the person.

Where the data subject's fundamental rights override the rights of potentially interested internet users, a request for de-referencing of links to web pages relating to legal proceedings and any ensuing conviction should be granted.

Even if the search engine operator does determine that the inclusion of the link concerning an earlier stage of proceedings which is the subject of the de-referencing request is strictly necessary for reconciling the data subject's rights to privacy and data protection with the users' rights to freedom of information, the operator is required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives internet users reflects the current position, in particular, by ensuring that links to the web pages reflecting the then current position appear in first place on the list of search results.

What does this mean for you?

This judgment confirms that search engines process sensitive personal data when they reference pages containing sensitive personal data and, in particular, display links to that web page in the list of results presented to internet users following a search.

It also provides helpful guidance as to when a request to de-reference results linking to sensitive personal data may be successful, especially in relation to criminal proceedings. Perhaps the most interesting aspect of the judgment for search engines is the requirement to ensure that lists of results about criminal proceedings which are the subject of an unsuccessful de-referencing request must be adjusted so as to reflect the then current position at the top of the results.