Over 3 years ago, the European Court of Justice gave the famous Costeja ruling. Since then, it has been clear that search engines are also bound by privacy law and can (therefore) receive correction and removal requests. Privacy law also puts additional strict rules on the processing of so-called special personal data (such as medical information). According to the letter of the law, Google is (therefore) not allowed to process such information. The French Conseil d’État is considering how to handle this. The answer to this question could have major consequences for search engines.

Hyperlinks to sensitive articles

There have been various proceedings in France against Google relating to requests for removal. These proceedings eventually end up at the French Conseil d’État.

The order for reference shows that it always relates to references to articles with a sensitive content:

  • a satirical photo montage about an alleged intimate relationship between a woman and the mayor;
  • an article about suicide by a member of the Church of Scientology revealing the name of the church person responsible for PR at the time;
  • an article about a criminal investigation into party funding (where it was in the meantime known that no prosecution was commenced);
  • an article about the conviction of a man for sexual abuse, also disclosing intimate details of the victim.

Prohibition on processing special personal data

The French Conseil d’État came up against the prohibition of processing special personal data. Such ‘special personal data’ includes criminal data, health data and information relating to sexual behaviour.

At its core, the French Conseil d’État was considering: if Google is bound by privacy law, what is then – in view of the prohibition on processing special personal data – the justification for Google processing this data?

Questions in detail

The Conseil d’État first considered the question whether the prohibition on processing special data actually applied to Google. Questions 2 and 3 were then based on this first question.

If the prohibition is indeed applicable (question 2):

  • the Conseil d’État considered whether or not the exceptions to the prohibition on the processing of special personal data may have to be interpreted differently (wider) for search engines;
  • the Conseil d’État considered, more specifically, whether it could be relevant if a search engine shows that the relevant party had given permission or that the data is required for legal proceedings;
  • the Conseil d’État considered whether it is relevant that the information had been collected by the writer of the source article for journalistic or artistic purposes.

If the prohibition does not apply (question 3):

  • the Conseil d’État would like to learn to which rules of privacy law Google would be bound instead;
  • does this then have consequences for the manner in which a removal request relating to special personal data must be assessed?
  • and how, in this context, must removal requests be handled that relate to publications not falling under European privacy law?

In addition, the Conseil d’État would like to learn (questions 4) whether a removal request relating to a link to an outdated article must be granted by definition, in particular if it relates to a criminal prosecution. In that context, the Conseil d’État would also like to learn how the term ‘criminal’ data must be interpreted.

Cautious look ahead

It would be very striking if the Court of Justice answers the first question in the negative. Everything in the Costeja case actually points to privacy law applying in full (in that case the advocate general had indeed argued for an approach that was more concentrated on search engines and this line was not followed).

In addition, it would also be remarkable if the Court of Justice would interpret the exceptions to the processing of special personal data, wider. To date, the tenor has actually been to interpret the different lists in the guideline as limitative.

The Court could perhaps confirm that the relevant party can give permission, but the question is (i) whether for media reports there is permission at all and (ii) whether this permission is then actually given to Google (and not to the journalist). It is possible that the Court will rule on that.

However, if the Court follows the anticipated line, Google in Europe would be forced to introduce a light version of Google. About what this might exactly entail I blogged some years ago. In view of the large societal appetite for search engine searches, I do not expect that this is going to be the solution.

The Court could therefore come up with a surprising turn. The Court may link the activities of Google to the freedom of information (article 10 ECHR) and therefore resolve the issue via the route of rights of a higher rank (also compare article 85 of the General Data Protection Regulations – AVG). Anyway, this is all speculation.

Final comments

Generally, it takes 1-2 years before a request for a preliminary ruling has been answered by the Court of Justice. We will keep a close eye on the issue and keep you up to date.

In the meantime, do you have any questions relating privacy law? Would you like to know what is permitted and what is not and how to deal with inspection or right to forget applications? Please do not hesitate to contact us. We can help you.

By Mark Jansen