1
IN THE COURT OF JUSTICE OF THE EUROPEAN UNION
Case C-136/17
G.C.
A.F.
B.H.
A.D.
Applicants
V
COMMISSION NATIONALE DE L’INFORMATIQUE ET DES LIBERTES
(CNIL)
Defendant
WRITTEN OBSERVATIONS OF IRELAND
Dated this 30th day of June 2017
To the President and Members of the Court of Justice of the European Union
Pursuant to Article 23 of the Protocol on the Statute of the Court of Justice of the
European Union, Ireland, represented by Maria Browne, Chief State Solicitor, Osmond
House, Little Ship Street, Dublin 8, acting as Agent, accepting service via e-Curia with
an address for service at the Embassy of Ireland, 28 route d’Arlon, Luxembourg,
assisted by Miss Margaret Gray, Barrister-at-Law, of the Bar of Ireland, has the honour
of submitting these written observations.
2
1.
This reference for a preliminary ruling under Article 267 of the Treaty on the
Functioning of the European Union (“TFEU”) was made on 24 February
2017 (lodged on 15 March 2017) by the Conseil d'État of the French
Republic (“the Referring Court”). The referred questions concern the
interpretation of certain provisions of Directive 95/46 on the protection of
individuals with regard to the processing of personal data and on the free
movement of such data (OJ L 281 p.31) (“the Directive”), in particular,
Articles 8(1) and (5), 9, 12 and 14.
THE ORDER FOR REFERENCE
2.
Ireland refers to the facts as described in the Order for Reference. In brief
outline, in the four cases before the Referring Court, each of the applicants
had requested Google Inc. to ‘de-reference’ various links to web pages
appearing in the results displayed by its search engine in response to a
search of their respective names. Google refused each request. The
applicants complained to the French Data Protection Authority, the CNIL,
seeking orders that Google ‘de-reference’ the links. The CNIL rejected the
complaints. Before the Referring Court, the applicants sought orders for the
annulment of the CNIL’s decisions.
3.
The Referring Court held (at paragraph 2) that the relevant French
legislative provisions must be interpreted in light of the Directive, which they
transpose. It further held that, in view of the judgment of the CJEU of 13
May 2014 in Case C-131/12
Google Spain and Google, a number of
principles are relevant. First, the activity of a search engine must be
classified as “processing of personal data” within the meaning of Article 2(b)
of the Directive when that information contains personal data; and, second,
the operator of the search engine must be regarded as the “control er” in
respect of such processing, within the meaning of Article 2(d).
4.
As regards each of the applicants:
a. Ms C. requested ‘de-referencing’ of a satirical photomontage posted
online, on YouTube, showing her at the side of the mayor of the
municipality where she was head of office and explicitly conveying the
intimate relationship between them, as well as that relationship’s
bearing on her own political career. The photomontage was posted
3
online during an electoral campaign in which she was a candidate. On
the date when her request for ‘de-referencing’ was refused, she was
neither elected, nor a candidate for elected office, and no longer served
as head of the office of the municipality’s mayor;
b. Mr F. requested ‘de-referencing’ of an article in Liberation posted on the
website of the French Centre Against Mind Control, relating to the
suicide of an advocate of the Church of Scientology in December 2006.
Mr F. is mentioned in that article as the public relations officer for the
church, but subsequently ceased working in public relations. The author
of the article describes how he contacted Mr. F. to get his version of the
facts and reports what he said during the interview;
c. Mr. H. requested ‘de-referencing’ of mainly press articles relating to the
judicial inquiry into the financing of the French Republican Party in the
course of which he, together with several businessmen and political
figures, was placed under investigation. The proceedings against him
were dismissed. Most of the links at issue lead to articles published
when the investigation was opened, and make no reference to the
outcome of the proceedings;
d. Mr. D. requests ‘de-referencing’ of two articles published in
Nice Matin
and
Le Figaro reporting on the criminal court hearing during which he
was sentenced to seven years’ imprisonment and an additional ten
years of socio-judicial supervision for sexual assault against minors
aged 15. One of those reports reveals a number of intimate details
about the applicant, which were disclosed during the trial.
5.
In essence, the Referring Court seeks guidance on the interpretation of the
scope of the prohibition on the processing of special categories of personal
data laid down in Article 8(1) of the Directive and the restrictions on
processing of data relating to offences, criminal convictions or security
measures laid down in Article 8(5), as well as the scope of the exemptions
or derogations for
inter alia solely journalistic purposes laid down in Article
9. Although not expressly cited by the Referring Court, the Order for
Reference also raises issues concerning the rights to rectification, erasure
or blocking of data in Article 12(b) of the Directive, and the right to object
under Article 14.
4
6.
Having outlined the legal questions arising for determination, the Referring
Court held that a number of issues arose which, in its view, were decisive
to the outcome before it, and raised several serious questions of
interpretation of EU law.
THE DIRECTIVE
7.
Before addressing the questions posed by the Referring Court, and
Ireland’s responses to those questions, it is necessary, in the first instance,
to consider the structure and content of the Directive, which must,
moreover, be interpreted in light of relevant fundamental rights. Those
rights include the following.
8.
Firstly, Article 8 of the Charter of Fundamental Rights of the European
Union (“the EU Charter”). Article 8 of the EU Charter provides for the
protection of personal data concerning any individual and permits such data
to be processed fairly for specified purposes and on the basis of consent
or some other legitimate basis laid down by law. Such right to the protection
of personal data is not, however, absolute: see, Case C-112/00
Schmidberger [2003]; and Joined Cases C-92/09 and C-93/09
Volker und
Markus Schecke GbR. The right must be considered in relation to its
function in society, and, under Article 52(1) of the EU Charter, may be
limited by law where limitations are proportionate, provided that they also
respect the essence of the rights and freedoms concerned, and are
necessary and genuinely meet objectives of general interest recognised by
the European Union and the need to protect the rights and freedoms of
others (see
Volker und Markus Schecke GbR, paragraph 50).
9.
Second, Article 10 of the EU Charter, in essence, addressing freedom of
expression, provides for the right to freedom of thought, conscience and
religion.
10.
Third, Article 16 of the EU Charter provides for the freedom to conduct a
business, and more specific iterations of this right are codified, for example,
in Articles 49 and 56 of the Treaty on the Functioning of the European Union
(“TFEU”) which provide for freedom of establishment and to provide
services.
5
11.
Turning, then to the Directive itself, one of its key objectives1 is to ensure
the
“effective and complete protection of the fundamental rights and
freedoms of natural persons, and in particular their right of privacy, with
respect to the processing of personal data” (see,
Google Spain, paragraph
53). The nature of those rights and the framework in which the Directive
operates was recognised by this Court in Case C-362/14
Schrems, as
follows:
“
38. It should be recalled first of all that the provisions of Directive 95/46,
in as much as they govern the processing of personal data liable to
infringe fundamental freedoms, in particular the right to respect for
private life, must necessarily be interpreted in the light of the
fundamental rights guaranteed by the Charter.
39. It is apparent from Article 1 of Directive 95/46 and recitals 2 and 10
in its preamble that the directive seeks to ensure not only effective and
complete protection of the fundamental rights and freedoms of natural
persons, in particular the fundamental right to respect for private life
with regard to the processing of personal data, but also a high level of
protection of those fundamental rights and freedoms. The importance
of both the fundamental right to respect for private life, guaranteed by
Article 7 of the Charter and the fundamental right to the protection of
personal data, guaranteed by Article 8 thereof, is, moreover,
emphasised in the case law of the Court.”
12.
The fact that the provisions of the Directive must be interpreted in the light
of the fundamental rights guaranteed by the Charter is reaffirmed by this
Court in Case C-398/15
Manni, paragraphs 39 and 40.
13.
The Directive emphasises, in Article 6(1)(a), that processing of personal
data must be both fair and lawful. This is also particularly recognised by
recital (28) which provides,
inter alia, that “
any processing of personal data
must be lawful and fair to the individual concerned; whereas, in particular,
the data must be adequate, relevant and not excessive in relation to the
purposes for which they are processed”. It is further recognised by recital
(30) that the processing of data may be lawful where it is carried out
“as a
1 Another key objective being to facilitate the free movement of such data
6
legal requirement, or for the performance of a task carried out in the public
interest or in the exercise of official authority, or in the legitimate interests
of a natural or legal person, provided that the interests or the rights and
freedoms of the data subject are not overriding”.
14.
The Directive also contemplates, under recital (37) and as then codified in
Article 9, that
“the processing of personal data for purposes of journalism
or for purposes of literary or artistic expression, in particular in the
audiovisual field, should qualify for exemption from the requirements of
certain provisions of this Directive in so far as this is necessary to reconcile
the fundamental rights of individuals with freedom of information and
notably the right to receive and impart information, as guaranteed in
particular in Article 10 of the European Convention for the Protection of
Human Rights and Fundamental Freedoms”.
15.
To recall, Article 6 of the Directive establishes the principles that apply to
Member States in relation to data quality. Member States and, in turn,
controllers of data processing, are obliged to adhere to the principles set
out in Article 6, as confirmed by this Court in Google Spain (at paragraph
72). Expressly, Article 6(1)(b) requires Member States to provide that
personal data must be “
collected for specified, explicit and legitimate
purposes and not further processed in a way incompatible with those
purposes”.
16.
Article 7 of the Directive sets the criteria according to which data processing
may be legitimate (save for special categories of data, which are dealt with
in Article 8). Article 7(f) permits processing where
“necessary for the
purposes of the legitimate interests pursued by the controller or by the third
party or parties to whom the data are disclosed, except where such
interests are overridden by the interests [or] fundamental rights and
freedoms of the data subject which require protection under Article 1(1).”
In that regard, consideration of whether or not Article 7(f) provides a basis
for the justification of lawful processing of personal data may, in some
instances, require the balancing of competing interests, being those of
other interested parties against those rights of the data subject.
17.
Article 8 provides for the processing of special categories of personal data,
and, Article 8(1) lays down the following prohibition:
7
“Member States shal prohibit the processing of personal data revealing
racial or ethnic origin, political opinions, religious or philosophical
beliefs, trade-union membership, and the processing of data
concerning health or sex life.”
18.
Article 8 paragraphs (2),(3) and (4) lay down certain grounds for derogating
from the prohibition in Article 8(1). Article 8(5) of the Directive provides as
follows:
“
5. Processing of data relating to offences, criminal convictions or
security measures may be carried out only under the control of official
authority, or if suitable specific safeguards are provided under national
law, subject to derogations which may be granted by the Member State
under national provisions providing suitable specific safeguards.
However, a complete register of criminal convictions may be kept only
under the control of official authority.”
19.
As referred to above, Article 9 seeks to reconcile processing of personal
data, on the one hand, and freedom of expression on the other, as follows:
“
Member States shall provide for exemptions or derogations from the
provisions of this Chapter, Chapter IV and Chapter VI for the processing
of personal data carried out solely for journalistic purposes or the
purpose of artistic or literary expression only if they are necessary to
reconcile the right to privacy with the rules governing freedom of
expression.”
20.
Article 12 deals with a data subject’s right of access to data and certain
remedies including, under Article 12(b), the right to obtain from the
controller “
as appropriate the rectification, erasure or blocking of data the
processing of which does not comply with the provisions of this Directive,
in particular because of the incompatible or inaccurate nature of the data”.
21.
Article 14, which is entitled ‘The data subject’s right to object’, provides:
“Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at
any time on compelling legitimate grounds relating to his particular
situation to the processing of data relating to him, save where otherwise
8
provided by national legislation. Where there is a justified objection, the
processing instigated by the controller may no longer involve those
data…”.
QUESTIONS POSED BY THE REFERRING COURT
Question 1
22.
By Question 1, the Referring Court asks the following:
“1. Having regard to the specific responsibilities, powers and
capabilities of the operator of a search engine, does the prohibition
imposed on other controllers of processing data caught by Article 8(1)
and (5) of Directive 95/46, subject to the exceptions laid down there,
also apply to this operator as the controller of processing by means of
that search engine?”
23.
It is apparent from the judgment in
Google Spain that certain activities of
an operator of a search engine, such as Google, fall within the scope of
application of the Directive. This is clear from paragraph 41 of the judgment:
“…Article 2(b) and (d) of Directive 95/46 are to be interpreted as
meaning that, first, the activity of a search engine consisting in finding
information published or placed on the internet by third parties, indexing
it automatically, storing it temporarily and, finally making it available to
internet users according to a particular order of preference must be
classified as ‘processing of personal data’ within the meaning of Article
2(b) when that information contains personal data and, second, the
operator of a search engine must be regarded as the ‘controller’ in
respect of that processing, within the meaning of Article 2(d).”
24.
This Court did, however, distinguish operators of search engines in at least
two ways. In the first instance, it indicated that the data processing carried
out in the context of the activity of a search engine ought to be in addition
to that carried out by, for example, publishers on websites. In the second
instance, it expressly circumscribed the necessity for a search engine to
act consistently with the Directive only within the framework of its
9
responsibilities, powers and capabilities. The Court put it this way (at
paragraph 83):2
“… inasmuch as the data processing carried out in the context of the
activity of a search engine can be distinguished from and is additional
to that carried out by publishers of websites and affects the data
subject’s fundamental rights additionally, the operator of the search
engine as the controller in respect of that processing must ensure,
within the framework of its responsibilities, powers and capabilities, that
that processing meets the requirements of Directive 95/46, in order that
the guarantees laid down by the directive may have full effect.”
25.
In view of that, it is logical that the specific, and expressly limiting,
responsibilities, powers and capabilities of the operator of a search engine
set it apart from other controllers of processing data who could be subject
to the prohibition on the processing of special categories of personal data
in Article 8(1), subject, of course, to the exceptions and derogations
otherwise provided for in that article, or as set out in the Article 9 derogation
where processing is solely for journalistic purposes or artistic or literary
expression.
26.
Ireland submits that the special position of an operator of a search engine,
which this Court recognises as being different from that of, for example, a
publisher, militates against the automatic application of the Article 8
prohibitions to such an operator, without giving due account to its limited
responsibilities, powers and capabilities. A relevant factor in that regard is
the manner in which search engines and publishers process personal data:
while publishers release a timely piece of information about an individual,
search engines organize and aggregate an individual’s personal
information in order to offer it in a structured fashion to users (see
Google
Spain, paragraphs 36-37).
27.
The logical step from that conclusion is to recognise that an operator of a
search engine has a lack of awareness that it is processing personal data
(and that it would be impossible, otherwise, for it to act within the framework
2 See also paragraphs 35 to 38 of the judgment in
Google Spain
10
of its powers and capabilities to know that it was), and also has a lack of
intentionality in its processing.
28.
To hold an operator of a search engine presumptively liable for processing
of special categories of personal data under Article 8(1) would be to
introduce an unwarranted strict liability. In circumstances where
compliance could be impossible, and where non-compliance could lead to
potential liabilities and swingeing administrative fines,3 Ireland submits that
the starting point ought to be that a search engine operator ought not to be
caught by the prohibition in Article 8(1) and (5) of the Directive. To hold
otherwise, would be contrary to the fundamental principle of proportionality.
29.
Alternatively, Ireland submits that if the prohibition on the processing of
personal data in Article 8(1) and (5) does apply to an operator of a search
engine, equally, such an operator must also benefit from any relevant
exemptions laid down, at least, in that provision. Ireland submits that, if
there was to be such an application of strict liability on the part of an
operator of a search engine, then, again, the principle of proportionality
militates in favour of such an operator taking advantage of any exemptions
that the principal controller of the special categories of personal data
benefits from.
30.
Ireland submits that this gives proper effect to the intended scope of the
Directive, and to the application of the principle of proportionality as
guarding against
“an unfounded overextension of the material scope of the
Directive over new technologies” (see Opinion of Advocate General
Jääskinen in
Google Spain, paragraph 30). It is also consistent with the
findings of the Working Party on the Protection of Individuals 4 which
supported the need for proportionality in the consideration of whether a
search engine should qualify as a controller at all:
“… the principle of proportionality requires that to the extent that a
search engine provider acts purely as an intermediary, it should not be
considered to be the principal controller with regard to the content
3 Under the new General Data Protection Regulation, non-compliance with this obligation could
lead to fines of €20 mil ion or 4% global annual turnover, whichever is higher (Article 83(5)(b),
together with Article 17).
4
Opinion 1/2008 on data protection issues related to search engines 00737/EN WP 148 (4
April 2008) p.14; see also Opinion of Advocate General Jääskinen in
Google Spain, paragraph
88
11
related processing of personal data that is taking place. In this case the
principal controllers of personal data are the information providers.”
31.
Further, Ireland submits that the special circumstances pertaining to an
operator of a search engine as an intermediary, also militates in favour of
its benefitting, when taking account of the nature of data as being special
categories of personal data, from the Article 9 derogation for journalistic
purposes.
32.
It is acknowledged that, in its judgment in
Google Spain, this Court
discussed the potential application of Article 9 to operators of search
engines. While the Court held that Article 9 would benefit the processing by
the publisher of a web page,
“that does not appear to be so in the case of
the processing carried out by the operator of a search engine” (at paragraph
85 of the judgment). However, Ireland considers that it is perfectly
appropriate to give a fresh consideration to the scope of application of
Article 9 on the facts of this case. That is so because, firstly, this case
concerns personal data falling within the Article 8 prohibition, rather than
the Article 7 permission for processing in certain circumstances (including
under Article 7(f), where the balancing exercise between the right to privacy
and the other rights comes into play); second, the finding was, in any event,
by way of an obiter dicta and did not form part of the necessary reasoning
of the court or of the operative part of the judgment.
33.
Further, Article 85 of the General Data Protection Regulation (“the
Regulation”) makes express the weight to be given in the balance to the
right to freedom of expression. Article 85, which is entitled
‘Processing and
freedom of expression and information’ provides as follows:
“1. Member States shal by law reconcile the right to the protection of
personal data pursuant to this Regulation with the right to freedom of
expression and information, including processing for journalistic
purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of
academic artistic or literary expression, Member States shall provide for
exemptions or derogations from Chapter II (principles), Chapter III
(rights of the data subject), Chapter IV (controller and processor),
12
Chapter V (transfer of personal data to third countries or international
organisations), Chapter VI (independent supervisory authorities),
Chapter VII (cooperation and consistency) and Chapter IX (specific
data sanctions) if they are necessary to reconcile the right to the
protection of personal data with the freedom of expression and
information.”
34.
An aid to the interpretation of that provision is given in recital (153) of the
Regulation which provides
inter alia that:
“…
the processing of personal data solely for journalistic purposes, or
for the purposes of academic, artistic or literary expression should be
subject to derogations or exemptions from certain provisions of this
Regulation if necessary to reconcile the right to the protection of
personal data with the right to freedom of expression and information,
as enshrined in Article 11 of the Charter. This should apply in particular
to the processing of personal data in the audiovisual field and in news
archives and press libraries. … In order to take account of the
importance of the right to freedom of expression in every democratic
society, it is necessary to interpret notions relating to that freedom, such
as journalism, broadly.” (emphasis added)
35.
While the Regulation is not yet in force, Ireland submits that, consistently
with the EU principle of statutory interpretation that current obligations must
be construed in such a way that they are consistent with and do not do
damage to future obligations, a broad interpretation of the content and
scope of application of Article 9 ought to be preferred.
Question 2
36.
By Question 2, the Referring Court asks the following:
“2. If Question 1 should be answered in the affirmative:
– Must Article 8(1) and (5) of Directive 95/46 be interpreted as meaning
that the prohibition so imposed on the operator of a search engine of
processing data covered by those provisions, subject to the exceptions
laid down by that directive, would require the operator to grant as a
13
matter of course the requests for ‘de-referencing’ in relation to links to
web pages concerning such data?
– From that perspective, how must the exceptions laid down in Article
8(2)(a) and (e) of Directive 95/46 be interpreted, when they apply to the
operator of a search engine, in the light of its specific responsibilities,
powers and capabilities? In particular, may such an operator refuse a
request for ‘de-referencing’, if it establishes that the links at issue lead
to content which, although comprising data falling within the categories
listed in Article 8(1), is also covered by the exceptions laid down by
Article 8(2)(a) and (e) of the directive?
– Similarly, when the links subject to the request for ‘de-referencing’
lead to processing of personal data carried out solely for journalistic
purposes or for those of artistic of literary expression, on which basis,
in accordance with Article 9 of Directive 95/46, data within the
categories mentioned in Article 8(1) and (5) of the directive may be
collected and processed, must the provisions of Directive 95/46 be
interpreted as allowing the operator of a search engine, on that ground,
to refuse a request for ‘de-referencing’?”
37.
In essence, the Referring Court asks about the scope of the rights of a data
subject and the concomitant obligations upon an operator of a search
engine in the context of processing of special categories of personal data
as it is regulated under Article 8 of the Directive, subject to the exemptions
and derogations both in Article 8 itself and in Article 9. In short, the
Referring Court asks whether such an operator may, in certain
circumstances, refuse a request for ‘de-referencing’.
38.
Ireland submits that the answers to part 1 of Question 2 is that the operator
of a search engine processing special categories of data covered by either
Article 8(1) (personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, trade-union membership, and
the processing of data concerning health or sex life) or Article 8(5) (data
relating to offences) is not required, as a matter of course, to grant requests
for ‘de-referencing’, and may refuse such requests.
14
39.
This is so particularly given the express limitations upon an operator of a
search engine to act compatibly with the directive, including its prohibitions,
“within the framework of its responsibilities, powers and capabilities.”
Those limitations expressly contemplate the possibility that an operator of
a search engine may, both, rely on substantive exemptions to the
prohibition and, also, seek to justify on a case-by-case basis, the retention
of links to personal data, rather than being required, without any
consideration, to provide for the blanket ‘de-referencing’ where any such
request was made.
40.
In response to part 2 of Question 2, and as submitted in response to
Question 1, the exceptions in Article 8(2)(a) and (e) ought to be interpreted
and applied to an operator of a search engine analogously (given its role
as an intermediary) to how they are so interpreted and applied to, for
example, a web publisher. Ireland submits that to do otherwise would be to
hamper unjustifiably the role of an operator of a search engine to further
the public interest in disseminating such data that is substantively identified
in those provisions as requiring processing, under certain circumstances.
In that regard, an operator of a search engine may refuse a request for ‘de-
referencing’ if it establishes that the links at issue lead to content which,
although comprising data falling within the categories listed in Article 8(1),
is also covered by the exceptions laid down by Article 8(2)(a) and (e) of the
Directive.
41.
In response to part 3 of Question 2, where data has been processed under
the umbrella of Article 8(1) and (5), and, further, for solely journalistic
purposes pursuant to the Article 9 exemption, Ireland submits that an
operator of a search engine ought, in turn, to benefit from any Article 9
exemption and, consequently, refuse a request for ‘de-referencing’, subject
to carrying out the balancing test between, in essence, the right to privacy
with the rules governing
inter alia freedom of expression. To hold otherwise
would, in Ireland’s submission, unduly restrict the right of an operator of a
search engine to rely on the right to freedom of expression, which underpins
the derogation in Article 9 of the Directive. Ireland submits that Article 9 is
for the benefit of newspapers, journalists, web publishers and other such
media, including operators of search engines. The right to freedom of
expression exercised by web publishers etc. would be seriously
15
undermined if the derogation under Article 9 was not available to search
engine operators insofar as members of the public rely on search engines
to locate and access articles and other publications disseminated by web
publishers.
42.
The particular role of operators of search engines was recognised by this
Court in its judgment in
Google Spain (at paragraph 36) as follows:
“[I]t is undisputed that the activity of search engines plays a decisive
role in the overall dissemination of those data in that it renders the latter
accessible to any internet user making a search…”
43.
Put another way, if search engine operators are denied the right to rely on
Article 9, this would undermine not only the rights of the web publishers
concerned but also the ancillary rights of the public. Thus, the right to
freedom of expression would be rendered nugatory if the public are denied
the right to access journalistic, academic, artistic and or literary expression
to which the right to freedom of expression applies. There would be a
“chil ing effect” on the dissemination of such data by the media.
44.
Fundamentally, however, an operator must be permitted, once an individual
exercises his right to request removal or other relevant remedy, to assess
whether the personal information should no longer be linked to his name
(
Google Spain, paragraph 96). The balance of the fundamental rights
comprises the right to privacy and the right to protection of personal data,
on the one hand, and the right of freedom of expression, including the right
of the general public to access of information (together with economic rights
of the search engine). The operator can weigh in the balance the role that
the data subject plays in public life (
Google Spain, paragraphs 81 and 97).5
45.
Given Ireland’s response to Question 1, Question 3 does not arise for
consideration.
Question 4
5 Ireland points to the similarity of the balancing tests carried out under Article 9, on the one
hand, and Article 7(f), on the other. Article 7(f) permits the processing of personal data where
it is necessary for the purposes of the legitimate interests pursued by the third parties to whom
the data are disclosed. The judgment in
Google Spain (paragraph 74) confirms that the
application of Article 7(f) “
necessitates a balancing of the opposing rights and interests
concerned” – namely the rights of the data subject and the rights of the public.”
16
46.
By Question 4, the Referring Court asks the following:
“4. Irrespective of the answer to be given to Question 1:
– whether or not publication of the personal data on the web page at the
end of the link at issue is lawful, must the provisions of Directive 95/46 be
interpreted as:
– requiring the operator of a search engine, when the person making the
request establishes that the data in question has become incomplete or
inaccurate, or is no longer up to date, to grant the corresponding request
for ‘de-referencing’;
– more specifically, requiring the operator of a search engine, when the
person making the request shows that, having regard to the conduct of the
legal proceedings, the information relating to an earlier stage of those
proceedings is no longer consistent with the current reality of his situation,
to ‘de-reference’ the links to web pages comprising such information?
– Must Article 8(5) of Directive 95/46 be interpreted as meaning that
information relating to the investigation of an individual or reporting a trial
and the resulting conviction and sentencing constitutes data relating to
offences and to criminal convictions? More generally, does a web page
comprising data referring to the convictions of or legal proceedings
involving a natural person fall within the ambit of those provisions?”
47.
Again, Ireland’s response is that an operator of a search engine is not, in
any case, automatical y obliged to grant a request for ‘de-referencing’, but
must carry out the balancing exercise outlined above, as laid down in
Google Spain. Ireland also submits that this balancing exercise must take
account of the fact that, on a case-by-case basis, the public interest in
having personal data made available will vary.
48.
Ireland also emphasises that the balancing exercise ought not to become
a vehicle for the vindication of the personal whim of a data subject; in other
words, that the situations in which the erasure or blocking rights under
Article 12(b) of the Directive or objection rights under Article 14 of the
Directive are exercised are strictly interpreted, such that data should not,
17
for example, be subject to ‘de-referencing’ simply because of the subjective
preference of the data subject.6
49.
Bearing that in mind, and as regards the first query posed here by the
Referring Court, Ireland submits that the reference to establishing that data
is incomplete or inaccurate, or no longer up-to-date, is found in Article 12(b)
of the Directive.
50.
Firstly, Article 12(b) imports a degree of discretion for a Member State and,
in turn, an operator of a search engine, to exercise when considering
whether it ought to grant any remedies in respect of data which is
incomplete or inaccurate, as it states clearly that a Member State shall grant
such remedies “
as appropriate”.
51.
Second, it must be borne in mind that there is a significant distinction
between data, for example, in a web publication, which is incomplete or
inaccurate, at the time of posting, and data which only becomes incomplete
or inaccurate due to the passage of time. Ireland submits that it would be
an unlawful interference to seek to correct what, at the time, was a complete
and accurate statement of fact and that, equally, this ought to be borne in
mind when an applicant is making such a claim
.
52.
Finally, it will be a matter of fact and degree for each case as to whether or
not a data subject can, in fact, prove that such data is, for example,
incomplete. For example, as regards Mr. H who sought ‘de-referencing’ on
the grounds that the initial articles which had recorded that there had been
investigations into his conduct where, allegedly, no longer accurate or
complete because of the passage of time, Ireland submits that such a
situation falls into the category of a situation rendered inaccurate or
incomplete due to the passage of time and that to interfere in such a
situation by way of requiring ‘de-referencing’ would be close to attempting
to re-write history.
53.
As regards the second query posed here, Ireland repeats its submissions
above.
6 See Opinion of Advocate General Jääskinen in
Google Spain, paragraph 104
18
54.
As regards the third query, Ireland considers that Article 8(5) of the
Directive must be interpreted as meaning that information relating to the
investigation of an individual or reporting a trial and the resulting conviction
and sentencing does constitute data relating to offences and to criminal
convictions. More generally, Ireland takes the view that a web page
comprising data referring to the convictions of or legal proceedings
involving a natural person falls within the ambit of that provision.
55.
The fact that Article 8(5) creates a specific, lawful, basis for the processing
of data relating to offences, criminal convictions or security measures
creates a presumption that data of that nature ought to be capable of being
processed lawfully.
56.
Ireland points, in any event, to Article 9, which would provide a general
basis for processing such data where carried out solely for journalistic
purposes or the purpose of artistic or literary expression.
57.
In conclusion, Ireland invites the Court to respond to the questions posed
by the Conseil d'État of the French Republic on 24 February 2017 as
follows:
(1)
If, contrary to Ireland’s principal submission, the prohibition on the
processing of personal data in Article 8(1) and (5) of Directive 95/46
does apply to an operator of a search engine, equally, such an
operator must also benefit from any relevant exemptions laid down,
at least, in that provision, as well as any exemptions pursuant to
Article 9 of that directive.
(2)
The operator of a search engine processing special categories of
data covered by either Article 8(1) (personal data revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs,
trade-union membership, and the processing of data concerning
health or sex life) or Article 8(5) (data relating to offences) is not
required, as a matter of course, to grant requests for ‘de-
referencing’, and may refuse such requests.
The exceptions in Article 8(2)(a) and (e) ought to be interpreted and
applied to an operator of a search engine analogously (given its role
as an intermediary) to how they are so interpreted and applied to,
19
for example, a web publisher. In that regard, an operator of a search
engine may refuse a request for ‘de-referencing’ if it establishes that
the links at issue lead to content which, although comprising data
falling within the categories listed in Article 8(1), is also covered by
the exceptions laid down by Article 8(2)(a) and (e) of the Directive.
Where data has been processed under the umbrella of Article 8(1)
and (5), and, further, for solely journalistic purposes pursuant to the
Article 9 exemption, an operator of a search engine ought, in turn,
to benefit from any Article 9 exemption and, consequently, refuse a
request for ‘de-referencing’, subject to carrying out the balancing
test between, in essence, the right to privacy with the rules
governing inter alia freedom of expression.
(3)
The provisions of Directive 95/46:
– do not require that the operator of a search engine, when the
person making the request establishes that the data in question
has become incomplete or inaccurate, or is no longer up to date,
or, having regard to conduct of legal proceedings, is no longer
consistent with current reality, must automatically grant the
corresponding request for ‘de-referencing’, but, rather, must
carry out the necessary balancing exercise taking account of the
fact that, on a case-by-case basis, the public interest in having
personal data made available will vary;
– specifically, Article 8(5), must be interpreted as meaning that
information relating to the investigation of an individual or
reporting a trial and the resulting conviction and sentencing
constitutes data relating to offences and to criminal convictions,
and a web page comprising data referring to the convictions of
or legal proceedings involving a natural person falls within the
ambit of those provisions.
20
Dated this 30th day of June 2017
Signed:
Gemma Hodge
On behalf of Maria Browne, Chief State Solicitor
Agent for Ireland
Signed:
Tony Joyce
On behalf of Maria Browne, Chief State Solicitor
Agent for Ireland