GC and Others v Commission nationale de l'informatique et des libertés (CNIL).
Date: 2019-09-24
35


It must be recalled, first, that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 when that information contains personal data and, second, that the operator of the search engine must be regarded as the ‘controller’ in respect of that processing within the meaning of Article 2(d) of that directive (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 41).
36


The processing of personal data in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page, and that activity plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published. Moreover, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more or less detailed profile of the data subject (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraphs 35 to 37).
37


Consequently, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 38).
46


It must be observed in this respect that, as the European Commission emphasises, the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search on the basis of an individual’s name, since such a display of the link in such a list is liable significantly to affect the data subject’s fundamental rights to privacy and to the protection of the personal data relating to him (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 80).
52


In this respect, it must be recalled that the Court has held that Article 12(b) and Article 14(a) of Directive 95/46 must be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 88).
53


The Court has also held that, when appraising the conditions for the application of those provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him or her personally should, at the present point in time, no longer be linked to his or her name by a list of results displayed following a search made on the basis of his or her name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his or her fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his or her fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 99).
57


The circumstance that Article 17(3)(a) of Regulation 2016/679 now expressly provides that the data subject’s right to erasure is excluded where the processing is necessary for the exercise of the right of information, guaranteed by Article 11 of the Charter, is an expression of the fact that the right to protection of personal data is not an absolute right but, as recital 4 of the regulation states, must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see also judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 48, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 136).
58


In that context, it should be recalled that Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 50).
64


Consequently, in such a case, despite the presence on the web page referenced of personal data falling within the special categories in Article 8(1) of Directive 95/46 and Article 9(1) of Regulation 2016/679, the processing of those data by the operator of the search engine in connection with its activity, provided that the other conditions of lawfulness are satisfied, in particular those laid down by Article 6 of the directive or Article 5 of the regulation (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 72), is compliant with those provisions.
66


In any event, when the operator of a search engine receives a request for de-referencing, he must ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 or Article 9(2)(g) of Regulation 2016/679 and in compliance with the conditions laid down in those provisions, whether the inclusion of the link to the web page in question in the list displayed following a search on the basis of the data subject’s name is necessary for exercising the right of freedom of information of internet users potentially interested in accessing that web page by means of such a search, a right protected by Article 11 of the Charter. While the data subject’s rights protected by Articles 7 and 8 of the Charter override, as a general rule, the freedom of information of internet users, that balance may, however, depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 81).
74


As regards those other conditions of lawfulness, it must be recalled that it follows from the requirements laid down in Article 6(1)(c) to (e) of Directive 95/46, now repeated in Article 5(1)(c) to (e) of Regulation 2016/679, that even initially lawful processing of accurate data may over time become incompatible with the directive or the regulation where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 93).