Striking the balance between the RTBF and substantial public interest

GC, AF, BH, ED v CNIL Case C-136/17 GC, AF, BH, ED v Commission nationale de l’informatique et des libertés (CNIL)

The question 

What is the current balancing test for the right to be forgotten as against rights to access information and freedom of expression?

The key takeaway 

The Court of Justice of the European Union (CJEU) has provided guidance and criteria to be followed by search engine operators when balancing requests by individuals to de-reference search engine results linking to their sensitive personal data with the public’s right to access information and publishers’ rights to freedom of expression.

The background 

Four individuals made requests for the removal of certain links to web pages included in the Google search engine results when searching their names. The links contained sensitive personal information including details of an intimate relationship between a female politician and a mayor, a reference to the PR officer of the church of scientology at a time when a member committed suicide, a judicial investigation into political party funding and a prison sentence for child sexual assaults. When their requests were refused, the individuals complained to the French Data Protection Authority, the Commission Nationale de L’informatique et des Libertés (CNIL), but the CNIL refused to grant an order that the links should be de-referenced. 

The individuals pursued legal action against the CNIL and the French courts requested clarification from the CJEU on the interpretation of EU data protection directives and the leading case (case C-131/12) on the scope of the right to be forgotten. 

CJEU decision 

The CJEU confirmed that, in circumstances where a supervisory body is asked to verify the operator’s response to a de-referencing request, search engine operators are subject to data controller obligations and are therefore required (subject to national rules) to accede to de-referencing requests to remove links to web pages containing sensitive personal data. However, this obligation is subject to certain exceptions which may justify the refusal to de-reference, for example that the information is of “substantial public interest” or was “manifestly made public by the data subject”.

These exceptions are subject to a careful balancing act. Although the CJEU confirmed that the right to privacy will generally override the public’s right to information, the following criteria should be considered to determine whether, in those particular circumstances, the substantial public interest in accessing the information should prevail: 

• what is the “substantial public interest” in referencing the personal information (e.g. does the individual hold a public role)?
• how sensitive is the information and how will publication interfere with the individual’s private life?
• whether it is “strictly necessary” to refer to the individual in order to protect freedom of information of internet users potentially interested in accessing that web page?
• whether the information is accurate, complete and current at the time of the request (in particular, search engines should consider whether the information is outdated by the time of the request and, in any event, should adjust results to prioritise links that refer to the most current state of affairs)?
• in respect of information relating to legal proceedings, matters such as the seriousness of the offence, past conduct and the progress and outcome of the proceedings should be taken into account.

In respect of data manifestly made public by the individual, refusal to de-reference will be justified provided that it is lawful and there are no other compelling grounds to comply with the request. 

The CJEU commented that on these facts it would be inclined to grant some of the de-referencing requests on the basis that the information was outdated, some information was particularly sensitive and intimate and the individuals were no longer in public roles. 

Why is this important?

This CJEU ruling helps confirm the requirements for de-referencing requests relating to special category personal data on search engines. As such, when considering these requests, search engine operators are required to carry out a balancing exercise between the individual’s right to be forgotten against the right of the public to access the information and the publisher’s right to freedom of expression. 

Although this exercise could be seen to place a more onerous burden on search engine providers, the CJEU’s criteria does provide clarity in respect of when the public interest will outweigh the right to be forgotten and sets parameters around where an individual’s right to have links removed can be justifiably denied (e.g. where reference to the individual is strictly necessary for protection of the freedom of information of internet users potentially interested in accessing that web page).

Any practical tips?

Search engine operators should adapt their de-referencing request consideration processes to take into account the CJEU’s criteria to ensure that the balancing exercise between the right to be forgotten and the freedoms of information and expression is properly carried out.