Three Recent Landmark CJEU Rulings: Virtual Territorial Boundaries and the Balance Between Privacy and Freedom of Information
In September and October 2019, the Court of Justice of the European Union (CJEU) issued three landmark decisions. In the first decision, the CJEU held in Google's favor that search engine operators are not required to de-reference links regarding a data subject on a global basis. Therefore, Google was only required to carry out de-reference requests on versions of its search engine that are accessible in the member states of the European Union. In the second decision issued on the same day, the CJEU held that a search engine operator must weigh the rights of individuals requesting the removal of their sensitive information against the freedom of information of Internet users, in order to determine whether to remove such information. In the third decision, the CJEU held that a court of an EU member state could order a host provider (in this case Facebook) to block access to information covered by an injunction on a global basis. We look at the implications of each of these decisions below.
Decision 1: Systematic De-Referencing is Not Required on a Global Scale
What was the background?
The first decision stems from a 2015/2016 dispute between Google and the French data protection supervisory authority, Commission Nationale de l'Informatique et des Libertés (CNIL), where CNIL fined Google €100,000 for refusing to carry out a de-reference (right to be forgotten) request on a global scale across all versions of its search engine—meaning all domain name extensions such as Google.com (in the United States), Google.fr (in France), or Google.it (in Italy). There were different options for implementing the de-reference request at issue:
- De-reference links on the country-level domain name at issue (here, Google.fr in France).
- De-reference links on the EU-level (i.e. across all EU member state domain names).
- Utilize geo-location technology to locate Internet users via their IP addresses, and automatically redirect users in the European Union to country-level domain names that carry out de-referencing in their list of search results.
- De-reference on a global scale across all versions of Google (including Google.fr, and all country-level Google domain names in the EU, as well as all versions of Google that are accessible outside of the EU, such as Google.com).
What is the "right to be forgotten"?
The "right to be forgotten" is now based on Article 17 of the GDPR (the "Right to Erasure ('right to be forgotten')") and, prior to the GDPR, was based on Article 12(b) of EU Directive 95/46/EC. The right enables individuals to request the erasure of their personal data, where exceptions to the right (such as that the information is required for exercising the right of freedom of expression and information) do not apply. The right was notably discussed in the "Google Spain" May 2014 decision, which provided that EU citizens have the right to erase or the "right to de-reference" information that is "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine" which includes a list of results that appear on search engines. Since 2014, Google has reported that it received more than 3.3 million requests to delist links, and has granted about 45%, or more than 1.4 million, requests.
What was the decision?
After considering the relevant legal authorities, including the GDPR, the previous Directive 95/46/EC, and the French law implementing Directive 95/46/EC, the CJEU held that, where a search engine operator complies with a request for de-referencing, i.e. where an exception to complying with such request does not exist under the legislation, the operator is not required to carry out the de-referencing on all versions of its search engine, but on the versions of the search engine corresponding to all of the EU member states. Google welcomed this decision. The CJEU's rationale included that:
- many non-EU countries do not recognise the right to de-referencing, or they do not have the same approach to that right;
- the balance between individuals' privacy rights and the freedom of information of Internet users is likely to vary globally; and
- although EU law provides for cooperation and mutual assistance regarding de-referencing inside of the EU, it does not currently do so in relation to countries outside of the EU.
An example of the implications of the decision is as follows. EU resident John Smith asks Google to de-reference a website link that contains obsolete information associated with his name, and Google carries out the de-reference request. Consequently, a subsequent search for EU resident "John Smith" in France (on Google.fr) will not include the de-referenced website link. However, an identical search for the same EU resident "John Smith" conducted in the United States could produce search results including the de-referenced link that is no longer available in the EU.
The CJEU however emphasised that while the EU legislation does not currently require de-referencing to take place on all versions of a search engine, it also does not prohibit it. Therefore, EU member states may have discretion to weigh individuals' rights to privacy against users' rights to freedom of information and issue further relief with respect to de-referencing.
What are the implications?
The CJEU's decision has been hailed by various media reports as a victory for Google, and more broadly, free speech and the Internet at large. In particular, it appears to place an important extraterritorial limitation on the application of the GDPR, in confining the de-referencing obligation to the EU. However the CJEU did not foreclose the possibility that de-referencing may occur across all versions of a search engine and it is possible that EU member states may order this in future cases.
Significantly, the CJEU did not expand on how EU member states may evaluate whether an individual's privacy interests would appropriately call for a global de-referencing. Therefore there are unanswered questions which will likely give rise to additional proceedings and issues to be addressed by EU member states and the CJEU in future cases.
An implication of the decision may be the creation of a virtual territorial barrier which makes de-referenced material inaccessible on search engines within the confines of the EU, but accessible elsewhere. In 2016 Google enabled a geo-blocking feature to redirect users in any EU member state (as identified by their IP addresses) to their local Google homepage; thus, for example, an Internet user in France who attempts to access "Google" will be automatically redirected to Google.fr. Likewise, an Internet user in Italy will be redirected to Google.it. However, these virtual territorial walls are not insuperable and there are workarounds to them.
The simplest work-around is for Internet users in the EU to access the US version of Google by manually typing "www.Google.com" in their web browsers. By doing so, links that are de-referenced on EU versions of Google will be accessible even within the confines of the EU.
For the more tech-savvy, a Virtual Private Network (VPN) enables users to mask their locations and access material that may be hidden or banned in a certain country. By using a VPN, users can essentially manipulate their IP addresses as if they were outside of the EU and consequently gain access to de-referenced material. These workarounds may dilute, to some extent, orders regarding how and where to carry out a de-referencing request, and may be considered by EU supervisory authorities in relation to orders for global de-referencing in future cases.
Decision 2: De-Referencing Needs to be Balanced Against the Right to Freedom of Information
What was the background?
In the second CJEU ruling, the court grappled with four individual de-reference requests where four individuals had appealed the CNIL's decision to take no action against Google for refusing to remove links associated with web pages that contained sensitive information relating to the individuals. The sensitive content included:
- A satirical photomontage of one individual with a mayor whom the individual allegedly had intimate relations with while she served as head of cabinet. The photo reel was published on YouTube during a political campaign in which the data subject was a candidate. The subject requested that Google de-reference the YouTube link during a time in which she was neither a political candidate nor in office.
- A former public relations officer at the Church of Scientology requested the de-referencing of links to an article that discussed the suicide of a member of the Church of Scientology. The former public relations officer was mentioned in the article, and the author noted that he had contacted the former officer, and included his version of the facts in the article.
- A subject of a former judicial investigation regarding the Parti Républicain requested de-referencing of links that discussed the initial investigation but did not mention the ultimate outcome. The proceedings against the individual had been dropped.
- An individual who was sentenced to seven years in prison and a subsequent ten-year social and judicial supervision term for sexual assaults on children requested de-referencing of links to articles that reported his sentencing as well as intimate details about him that were discussed at a court hearing.
What was the decision?
The CJEU held that:
- The provisions in the legislation around processing special categories of personal data (such as data revealing political opinions or data concerning a person's sex life) and processing data relating to criminal convictions and offences, which are afforded greater protection under the legislation, need to be complied with by operators of search engines in their capacity as the controller of the processing carried out in connection with the search engine.
- Search engine operators may refuse to grant a request for de-referencing if they establish that an exception to granting such request applies under the legislation.
- An operator must weigh up, taking into account the seriousness of the interference with the relevant individuals' rights to privacy, whether the inclusion of links in search results is strictly necessary for ensuring the freedom of information of Internet users who may want to access and search for certain information.
- If a request for de-referencing relates to an earlier stage of legal proceedings (as opposed to the latest stage, or outcome of those proceedings) the operator should comply with the request in so far as the privacy rights of the individual override the information rights of Internet users.
Significantly, the CJEU added that even if de-referencing is not "necessary for reconciling the data subject's rights to privacy and protection of personal data with the freedom of information of potentially interested users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list" (emphasis added). In essence, even if a search engine operator refuses to grant a de-reference request, it must reorder search results such that the most up-to-date content appears first.
What are the implications?
Whilst the obligation to balance the privacy rights of individuals against the freedom of information of Internet users, and the CJEU's comments on that, are unremarkable, a key aspect of this decision is the responsibility that it appears to place on search engine operators to adjust results as described above, and the resulting question around the operators' influence with regard to how, and what, information is communicated to the public.
Outside of the EU, this aspect of the ruling may also have significant implications. For example, in the US, it remains unclear whether any algorithm used by search engine operators to assemble search results in the EU (reflecting the current legal position) will be applied to identical searches run in the US. Currently, search result algorithms are not automatically reordered in the US to reflect the most recent news on a given topic or individual. Rather, search results displayed through organic (unpaid) search engine optimization may contain links to older news articles first, especially if they are visited by a large number of users.
If search engine operators implemented the reordering of search results on a global scale, this could override search engine optimization as we understand it, and may produce top results that include links to short, uninformative sources that merely state the outcome of a given legal matter without providing further detail.
Decision 3: Information Declared Unlawful May Have to be Removed Worldwide
What was the background?
In the third CJEU ruling, the court had to decide whether Facebook had an obligation to remove a comment relating to an individual on a worldwide basis, when national courts had found that comment to be harmful to the relevant individual and unsubstantiated. The case related to an individual who was chair of the Austrian political party Die Grünen (The Greens) and the federal spokesperson for that party. In 2016 a Facebook user shared an article on that user's personal page which linked to the article's original site, as well as a comment relating to the article which an Austrian court found to be damaging to the reputation of the individual. When, following the individual's request, Facebook did not delete the comment, the individual took the matter to court. Facebook was ordered to immediately stop publishing and/or disseminating photographs showing the individual if they were accompanied by text which was the same or had equivalent meaning to the original comment posted. Each of the parties in the proceedings lodged appeals on a point of law at the Austrian Supreme Court, which referred questions to the CJEU.
This CJEU was not considering EU data protection law in this case, as with the other two decisions, but instead EU Directive 2000/31/EC (the Electronic Commerce Directive). Specifically, it considered the extent to which an information society service provider (such as Facebook) can be ordered by a court with jurisdiction in an EU member state to remove content, in light of certain provisions that would appear to apply under the Electronic Commerce Directive. The particular provisions that the CJEU considered were:
- Article 14 - regarding the liability of a service provider where the service provider has no actual knowledge of illegal activity or information, or acts quickly to remove or prevent access to such information;
- Article 15(1) - regarding the prohibition on EU member states to generally oblige providers to monitor information or actively seek facts indicating illegal activity; and
- Article 18(1) - regarding the obligation on EU member states to ensure that national court actions allow for the quick adoption of measures to terminate any alleged infringement / prevent further impairment of interests involved.
What was the decision?
The CJEU held that the provisions of the Electronic Commerce Directive above do not preclude a court of an EU member state from ordering a host provider to:
- remove information/block access to information, the content of which is identical to content that has been declared unlawful; and
- remove/block access as described above on a worldwide basis.
However, the CJEU said that the provider's obligation to monitor and search for information to be removed or blocked was limited to information "essentially unchanged" from the illegal information, and where any differences in wording did not require the provider to carry out an independent assessment to decide whether or not to remove or block access to it.
What are the implications?
The decision clearly leaves unanswered questions as to how far providers such as Facebook are expected to go in removing content that has been considered illegal by a court in the EU. The decision has been met with criticism from Facebook and free speech groups, especially regarding the obligations that the decision may place on Internet companies to assess and monitor content, and as to how blocking access to information can realistically be achieved across borders where different laws apply. The decision can be seen as part of the ongoing debate regarding the extent to which Internet companies can and should be responsible for content uploaded by their users.
How do we reconcile the CJEU's restriction of territorial scope in the first Google case with the global territorial scope of its decision in the Facebook case? The first Google decision concluded that the removal of links to information relating to an individual does not need to be carried out worldwide, whilst the third decision concludes that information relating to an individual can be removed, or access to it blocked, worldwide.
The answer likely lies in the differing legal bases and facts in each case. The Google decisions related to balancing individuals' rights to privacy in relation to (undisputed and true) facts, whereas the Facebook decision related to publication of materials which had been judicially determined as harmful to the individual in question.
The three decisions taken together make it clear that the CJEU is increasingly holding online service providers responsible for content available on their platforms, and that requests for removal of information relating to individuals involves balancing competing interests of privacy and freedom of speech. It is not yet clear how courts will undertake this balance in any particular case, so we expect to see more decisions from Europe as the law continues to develop.
© Arnold & Porter Kaye Scholer LLP 2019 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.