Introduction
On December 8, 2022, in a case relating to a de-referencing request to an internet search engine operator on the basis of inaccurate information, the Grand Chamber of the Court of Justice of the European Union (CJEU) delivered its judgment (the Judgment)Footnote 1 on the interpretation of the right to erasure (right to be forgotten) under Article 17 of the EU General Data Protection Regulation 2016/679 (GDPR),Footnote 2 and the rights of access and objection under Articles 12 and 14 of the EU Directive 95/46/EC (the Directive),Footnote 3 in light of fundamental rights to privacy, protection of personal data, and freedom of expression and information under Articles 7, 8, and 11 of the Charter of Fundamental Rights of the European Union (the Charter).Footnote 4 The case establishes that the burden of proof is on the person requesting de-referencing to show manifest inaccuracy of information, but this does not require them to seek a judicial remedy against the website publisher before requesting de-referencing. Although the search engine operator is obliged to carry out checks to confirm the merits of the request, it has no obligation to investigate the facts and probe further with the website publisher. However, it must de-reference where relevant and sufficient evidence is submitted to show manifest inaccuracy, and it must display a warning where it is made aware of judicial proceedings.
Background
The German Federal Court of Justice requested a preliminary rulingFootnote 5 from the CJEU in order to apply the findings on interpretation to a case before it between the applicants, two investment managers of a group of investment companies (TU, RE) and the defendant internet search engine operator (Google). TU and RE requested Google to de-reference results of a search based on their names that linked to articles criticizing the group's investment model that the managers argued was based on inaccurate information. They also requested that Google cease displaying their photos featured in one of the articles in the form of preview images (thumbnails). Google refused to comply with the request, referring to the professional context in which the articles and images were set and arguing that it was unaware of the inaccuracy of the information.
The German Federal Court referred two questions to the CJEU:
1. Is it compatible with a data subject's right to respect for private life and to protection of personal data if, in the exercise of weighing up conflicting rights and interests in a case relating to a de-referencing request alleging inaccuracy of information, the national court also considers whether the data subject could reasonably seek legal protection against the website publisher?
2. In the case of a de-referencing request involving a name search searching for photos of natural persons that third parties have introduced into the internet in connection with the person's name, and which displays the photos which it has found in its search results as preview images (thumbnails), should the context of the original third-party publication be conclusively taken into account, even if the third-party website is linked by the search engine when the preview image is displayed but is not specifically named, and the resulting context is not shown with it by the internet search engine?Footnote 6
In answering these questions, the CJEU determined the extent of a person's burden of proof when requesting de-referencing on the basis of alleged inaccuracy of information, and the extent of obligations of a search engine operator in such a case.
Rights of Persons Requesting De-referencing
The right to de-referencing was previously linked to Articles 12(b) and 14(1)(a) of the Directive enabling data subjects to submit requests to the data controller who would then have to examine the merits and, where necessary, end data processing. With the entry into force of the GDPR on May 25, 2018, this is now protected by the right to be forgotten under Article 17. Article 17(3)(a) provides an exception to the right to be forgotten to the extent that processing of data is necessary for exercising the right to freedom of expression and information.
Previously, in Google Spain SL and Google Incorporated v. Agencia Española de Protección de Datos and Costeja González (Google Spain), the CJEU held that the processing of personal data by a search engine “is liable to affect significantly the fundamental rights to privacy and to the protection of personal data.”Footnote 7 A “fair balance” must be struck between the data subject's rights to privacy and protection of personal data under Articles 7 and 8 of the Charter, and the right of internet users to information under Article 11 of the Charter.Footnote 8 As a general rule, the data subject's rights override the interest of internet users to access information, but the balance may vary depending on the nature and sensitivity of the information and “the role played by the data subject in public life.”Footnote 9
On the first question in the Judgment, the CJEU held that the right to inform and the right to be informed does not include dissemination and access to information where, at the very least, a part (which is not minor in relation to the content as a whole) of the information proves to be inaccurate.Footnote 10 It further held that any de-referencing by the search engine operator was not subject to the condition that the accuracy of claims made on internet pages be resolved beforehand. A person requesting de-referencing from a search engine operator on account of the referenced content being inaccurate is obliged to establish the “manifest inaccuracy” of the information found in that content or, at the very least, of a part (which is not minor in relation to the content as a whole) of that information.Footnote 11 They have only to provide evidence that, in the light of the circumstances of the particular case, can reasonably be required of them to try to find in order to establish that manifest inaccuracy.Footnote 12 A person is not required to obtain a judicial decision against the website publisher in order to support their de-referencing request, as this would be an “unreasonable burden.”Footnote 13
Obligations of Search Engine Operators
Previously, in Google Spain, the CJEU established that the activity of an internet search engine constitutes “processing of personal data,” for the purposes of Article 2(b) of the Directive, as it involves finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily, and making it available to internet users according to a particular order of preference. Since the search engine operator determines the purposes and means of the activity, it is the “controller” of data under Article 2(d) of the Directive.Footnote 14
On the second question in the Judgment, the CJEU held that account must be taken of the “informative value” of photos without taking into consideration the context of their publication on the internet page from which they are taken. However, any text element directly accompanying the display of those photos in the search results that is capable of casting light on their “informative value” must be taken into account.Footnote 15 Photos in the form of thumbnail images displayed on search results may be with or without text. In either case, the search engine operator must undertake a separate weighing up of competing rights and interests to ascertain whether displaying those photos is necessary for exercising the right to freedom of information and contributes to a debate of public interest.Footnote 16 Although freedom of expression and of information includes publishing photos, the protection of the right to privacy takes on particular importance in this context since photos can convey personal or intimate information about an individual or their family.Footnote 17
Where there is a de-referencing request alleging inaccuracy of information, the search engine operator must check to confirm the merits of the request, but it is not obliged to investigate the facts or enter a debate with the website content provider in order to obtain missing information.Footnote 18 The search engine operator must de-reference where there is relevant and sufficient evidence to establish the manifest inaccuracy of information or, at the very least, of a part (which is not minor in relation to the content as a whole) of that information. It must also de-reference where there is a judicial decision against the website publisher that is based on the finding that information found in the referenced content (which is not minor in relation to that content as a whole) is, at least prima facie, inaccurate.Footnote 19 If the inaccuracy of the information is not obvious and there is no judicial decision establishing inaccuracy, the operator is not obliged to de-reference.Footnote 20 But if the operator is made aware that administrative or judicial proceedings concerning the alleged inaccuracy of information in the referenced content exist, then it must put up a warning to the search results to inform internet users.Footnote 21
Conclusion
The Judgment develops the right to be forgotten in cases involving inaccurate information and establishes that photos and thumbnail images are included in the right. The latter point is not surprising as it follows well-established principles about a person's image being integral to their personality and important to privacy rights in the case law of the European Court of Human Rights.Footnote 22 A person requesting de-referencing on the basis of inaccurate information must establish the “manifest inaccuracy” of that information to the search engine operator. Other than excluding the requirement for a prior judicial decision, the CJEU does not elaborate on how individuals might demonstrate “manifest inaccuracy” or what would be deemed sufficient for the purposes of de-referencing by search engine operators. It would have been unreasonably onerous on persons requesting de-referencing to require them to seek a prior judicial determination of inaccuracy, yet by requiring them to demonstrate “manifest inaccuracy,” the CJEU introduces a high burden of proof that is open to interpretation by search engine operators, who are not obliged to undertake a fact-finding investigation to establish the accuracy of information. The Advocate General's Opinion took a different approach to the extent of a search engine operator's obligations by recognizing that, “where possible,” they will need to initiate an “adversarial debate” with the web publisher to ascertain the reasons supporting the truth of the personal data processed and the lawfulness of the processing.Footnote 23
The CJEU did not consider the full extent of data subjects' rights applicable to the case, which, under Article 18(1)(a) GDPR, includes the right to suspension of data processing where the accuracy of the personal data is contested, to enable the data controller to verify the accuracy of the personal data. This would prevent irreparable harm to the data subject through continued publication by enabling the search engine operator to take temporary preventative action until such time as it verifies the accuracy of personal data. Interestingly, the Advocate General's Opinion refers to this right of suspension as part of “procedural fairness.”Footnote 24
JUDGMENT OF THE COURT (Grand Chamber) 8 December 2022 (Footnote **)
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive 95/46/EC – Article 12(b) – Point (a) of the first paragraph of Article 14 – Regulation (EU) 2016/679 – Article 17(3)(a) – Operator of an internet search engine – Research carried out on the basis of a person's name – Displaying a link to articles containing allegedly inaccurate information in the list of search results – Displaying, in the form of thumbnails, photographs illustrating those articles in the list of results of an image search – Request for de-referencing made to the operator of the search engine – Weighing-up of fundamental rights – Articles 7, 8, 11 and 16 of the Charter of Fundamental Rights of the European Union – Obligations and responsibilities of the operator of the search engine in respect of processing a request for de-referencing – Burden of proof on the person requesting de-referencing)
In Case C-460/20,
REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesgerichtshof (Federal Court of Justice, Germany), made by decision of 27 July 2020, received at the Court on 24 September 2020, in the proceedings
TU,
RE
v
Google LLC
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Prechal, K. Jürimäe, C. Lycourgos,
P.G. Xuereb, L.S. Rossi and D. Gratsias, Presidents of Chambers, M. Ilešič (Rapporteur), F. Biltgen,
N. Piçarra, N. Jääskinen, N. Wahl, I. Ziemele and J. Passer, Judges, Advocate General: G. Pitruzzella,
Registrar: D. Dittert, Head of Unit,
having regard to the written procedure and further to the hearing on 24 January 2022, after considering the observations submitted on behalf of:
– TU and RE, by M. Siegmann and T. Stöber, Rechtsanwälte,
– Google LLC, by B. Heymann, J. Spiegel and J. Wimmers, Rechtsanwälte,
– the Greek Government, by S. Charitaki, A. Magrippi and M. Tassopoulou, acting as Agents,
– the Austrian Government, by G. Kunnert, A. Posch and J. Schmoll, acting as Agents,
– the Romanian Government, by E. Gane and L. Liţu, acting as Agents,
– the European Commission, by A. Bouchagiar, F. Erlbacher, H. Kranenborg and D. Nardi, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 7 April 2022, gives the following
Judgment
1. This request for a preliminary ruling concerns the interpretation of Article 17(3)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’) and Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L281, p.31), read in the light of Articles 7, 8, 11 and 16 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
2. The request has been made in proceedings between TU and RE, of the one part, and Google LLC, of the other part, concerning a request seeking, first, that articles in which they are identified be de-referenced from the results of a search carried out on the basis of their names and, second, that photographs representing them, displayed in the form of preview images (‘thumbnails’), be removed from the results of an image search.
Legal context
Directive 95/46
3. Article 1 of Directive 95/46, entitled ‘Object of the Directive’, provided in paragraph 1 thereof:
‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.’
4. Article 2 of that directive, entitled ‘Definitions’, provided: ‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …
(b) “processing of personal data” (“processing”): shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, …
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …’
5. In Section I of Chapter II of that directive, entitled ‘Principles relating to data quality’, Article 6 was worded as follows:
‘1. Member States shall provide that personal data must be:
…
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
…’
6. In Section V of Chapter II of that directive, entitled ‘The data subject's right of access to data’, Article 12 thereof, itself entitled ‘Right of access’, stated:
‘Member States shall guarantee every data subject the right to obtain from the controller:
…
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
…’
7. In Section VII of Chapter II of Directive 95/46, entitled ‘The data subject's right to object’, the first paragraph of Article 14 of that directive provided:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
…’
The GDPR
8. As provided in Article 94(1) thereof, the GDPR repealed Directive 95/46 with effect from 25 May 2018. By virtue of Article 99(2), the GDPR applies from that date.
9. Recitals 4, 39 and 65 of that regulation state:
‘4. The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
…
39. … Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. …
65. A data subject should have the right to have personal data concerning him or her rectified and a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’
10. In Chapter I of that regulation, entitled ‘General provisions’, Article 4 thereof, itself entitled ‘Definitions’, is worded as follows:
‘For the purposes of this Regulation:
(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); …
(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means …
(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …’
11. In Chapter II of that regulation, entitled ‘Principles’, Article 5, itself entitled ‘Principles relating to the processing of personal data’, provides:
‘1. Personal data shall be:
…
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
…
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’
12. Section 3 of Chapter III of the GDPR, entitled ‘Rectification and erasure’, includes, inter alia, Articles 16 and 17 of that regulation.
13. Article 16 of the GDPR, entitled ‘Right of rectification’, provides:
‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’
14. Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:
‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
…’
The dispute in the main proceedings and the questions referred for a preliminary ruling
15. TU is a member of the board of directors and the only shareholder of an investment company as well as chairman of a subsidiary of that company, which, together with other companies, constitute a group of companies. He is also the sole shareholder in a third company, which is the sole shareholder in a fourth company, which in turn holds 60% of the shares in a fifth company.
16. RE was TU's cohabiting partner and, until May 2015, held general commercial power of representation in that fourth company.
17. On 27 April, 4 June and 16 June 2015, three articles which criticised the investment model implemented by the fifth company and the group of companies referred to in paragraph 15 of the present judgment were published on the website www.g …net (‘the g-net website’). The 4 June 2015 article was also illustrated by three photographs of TU driving a luxury car, in a helicopter and in front of an airplane, respectively, as well as a photograph of RE in a convertible car.
18. The operator of the g-net website is, according to the imprint, G-LLC, whose registered office is in New York (United States). The corporate purpose of G-LLC is, according to its own statement, ‘to contribute consistently towards fraud prevention in the economy and society by means of active investigation and constant transparency’. Various publications criticised G-LLC's business model, in particular accusing it of attempting to ‘blackmail’ companies by first publishing negative reports regarding those companies and then offering to delete them or prevent their publication, in exchange for a sum of money.
19. Google displayed the articles of 4 June 2015 and 16 June 2015 when the names and forenames of the applicants in the main proceedings, both on their own and in conjunction with certain company names, were entered in its search engine, as well as the 27 April 2015 article when certain company names were entered, and included a link to those articles. In addition, when an image search was conducted on that search engine, Google displayed in the list of results, in the form of thumbnails, the photographs of the applicants in the main proceedings contained in the article of 4 June 2015. Those photographs ceased being displayed in September 2017, at the latest. The articles ceased to be accessible on the g-net website from 28 June 2018 at the latest.
20. The applicants in the main proceedings requested Google, as the controller of personal data processed by its search engine, first, to de-reference the links to the articles at issue in the main proceedings from the list of search results, on the ground that they contained inaccurate claims and defamatory opinions, and, second, to remove the thumbnails from the list of search results. They also claimed to have been victims of ‘blackmail’ by G-LLC.
21. Google refused to comply with that request, referring to the professional context in which the articles and photographs at issue in the main proceedings were set and arguing that it was unaware of the alleged inaccuracy of the information contained in those articles.
22. In 2015, the applicants in the main proceedings brought an action before the Landgericht Köln (Regional Court, Cologne, Germany) seeking an order requiring Google to de-reference the links to the articles at issue in the main proceedings from its lists of search results and to put an end to the display, in the form of thumbnails, of the photographs representing them. By judgment of 22 November 2017, that court dismissed the action.
23. The applicants in the main proceedings lodged an appeal against that judgment before the Oberlandesgericht Köln (Higher Regional Court, Cologne, Germany). That appeal was dismissed by judgment of 8 November 2018. That court stated that the specific method of functioning of a search engine and the particular importance it has for the functioning of the internet must be accorded particular importance in the context of the weighing-up of competing rights and interests which is to be undertaken. Given that the operator of the search engine generally has no legal relationship with those providing the content shown, and given that it is impossible for that operator to investigate the facts and assess them while also taking account of the opinions of those providers, the operator of the search engine is subject to specific obligations to act only when it becomes aware, following a specific notification from the data subject, of a prima facie flagrant and clearly discernible infringement of the law. Those principles also apply where the search engine is used solely to search for images, given that the relevant interests involved are comparable.
24. The appeal court added that, in so far as it is necessary conclusively to take account of the accuracy of the alleged fact, the burden of proof in that regard lies with the person requesting the de-referencing. In the present case, since the applicants in the main proceedings have not proven that the facts reported in relation to them are inaccurate, Google is unable to carry out a final assessment of the articles at issue in the main proceedings and, consequently, is not required to de-reference them. As regards the photographs displayed in the form of thumbnails, they could, in so far as they accompany one of those articles, be regarded as being news images.
25. The applicants in the main proceedings brought an appeal on a point of law before the Bundesgerichtshof (Federal Court of Justice, Germany), the referring court.
26. That court observes that the outcome of that action depends on the interpretation of EU law, in particular Article 17(3)(a) of the GDPR and Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46.
27. As a preliminary point, the referring court states that, from its point of view, the request that Google be ordered to de-reference the links to the articles at issue in the main proceedings from the list of search results falls ratione temporis within the scope of the GDPR, whereas the request that Google be ordered to remove the thumbnails from the list of results of an image search falls ratione temporis within the scope of Directive 95/46, given that those thumbnails were no longer displayed by the search engine operated by Google on the date when the GDPR entered into force. However, as regards the request to have the thumbnails removed, the referring court requests the Court to provide an answer on that point which also takes account of that regulation.
28. The referring court then observes that the fact that the articles at issue in the main proceedings are no longer available on the g-net website and that Google no longer displays the thumbnails has not eliminated the interest the applicants in the main proceedings have in pursuing their request for de-referencing, given that the g-net website merely states that, for various reasons, those articles are ‘currently’ unavailable. In those circumstances, it cannot be ruled out that those articles may be re-posted online in the future and may once more be referenced by Google's search engine, since it is noted, moreover, that Google continues to take the view that that request for de-referencing is unjustified and Google continues to refuse to accede to it.
29. As regards the substance, concerning, in the first place, the request for de-referencing of the links to the articles at issue in the main proceedings from the list of search results, the referring court notes that the applicants in the main proceedings justify that request by claiming, in particular, that some of the assertions in those articles are inaccurate. The question therefore arises as to whether it was for the applicants in the main proceedings to prove the alleged inaccuracy of those assertions or, at the very least, to furnish a certain degree of evidence of that inaccuracy or whether, on the contrary, Google ought either to have presumed that the claims of the applicants in the main proceedings were accurate or to have sought to clarify the facts itself.
30. According to the referring court, the requirement to strike an equal balance between competing fundamental rights arising from Articles 7 and 8 of the Charter, on the one hand, and Articles 11 and 16 of the Charter, on the other, is not satisfied if, in a situation such as that at issue in the case in the main proceedings, the burden of proof falls exclusively on one party or the other.
31. Consequently, that court proposes adopting a solution which seeks to require the data subject to resolve, at least provisionally, the question of the accuracy of the referenced content by pursuing in court his or her claim against the content provider, in so far as obtaining judicial protection at least provisionally is a reasonable option for the data subject taking account of the circumstances of the particular case. It is true that, in so far as it has no relationship with the content provider, the data subject could encounter the same difficulties as the operator of the search in making contact with the content provider. However, the data subject knows whether the referenced content is accurate or not. The question whether that data subject may reasonably be required to pursue in court his or her claim against the content supplier could depend, for example, on whether or not the content provider can be approached without particular difficulty within the European Union.
32. Accordingly, the referring court suggests that, as a general rule, the data subject may reasonably be required to bring an action for interim relief against a content supplier whose name is known, but not against an anonymous provider or a provider to whom it is impossible to make notifications. However, the actual likelihood of obtaining enforcement of any order against the content provider requiring erasure is irrelevant as regards the rights vis-à-vis the operator of the search engine.
33. In the second place, as regards the request that Google be ordered to put an end to the display, in the form of thumbnails, of the photographs of the applicants in the main proceedings contained in the 4 June 2015 article, the referring court observes, first of all, that those thumbnails do indeed contain a link allowing access to the third party's internet page on which the corresponding photograph was published and thereby to become aware of the context of that publication. However, in so far as the list of results of an image search displays only thumbnails, without reproducing information regarding the context of that publication on the third party's internet page, that list is, in itself, neutral and does not make it possible to ascertain the context surrounding the original publication.
34. Accordingly, the question arises whether, when conducting the weighing-up exercise under Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17(3)(a) of the GDPR, account must be taken solely of the thumbnail as such in the neutral context of the list of results or whether account must also be taken of the original context of the publication of the corresponding image.
35. In that regard, the referring court notes that, in the case in the main proceedings, which concerns persons who are not known to the general public, the photographs in question do not, in themselves, contribute to public debate and do not satisfy a compelling need for information in accordance with the provisions referred to in the preceding paragraph. However, in connection with the 4 June 2015 article published on the g-net website, the photographs play an important role in substantiating the message contained in that article, which is that the applicants in the main proceedings, by virtue of their position as founders and managers of the fourth company and of the group of companies referred to in paragraph 15 of the present judgment, enjoy a high standard of living and possess luxury goods, whilst the employees, distributors and customers of those companies are uncertain as to the safety of the investments made. Consequently, if account ought to be taken of the context in which those photographs were initially published, their publication as thumbnails in the list of results would have to be regarded as justified, provided that the text accompanying them is itself lawful.
36. According to the referring court, one factor militating in favour of taking account of the context of the original publication lies in the fact that, technically, thumbnails constitute links referring to the third party's internet page. Similarly, it is well known that the informed average user of an image search engine is aware of the fact that the thumbnails brought together by the search engine in a list of results are taken from third party publications and that the photographs corresponding to those thumbnails are displayed, in those publications, in a particular context.
37. However, account should be taken of the fact that the original context of the publication of the images is neither stated nor otherwise visible when the thumbnail is displayed, unlike in the case of other referenced results. A user who, from the outset, is interested only in displaying the image has, as a general rule, no reason to seek out the source and the original context of the publication.
38. According to the referring court, it therefore appears logical, for the purposes of assessing the lawfulness of the data processing by the search engine data controller concerned, to include in the weighing-up exercise referred to in point (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17(3) of the GDPR only the rights and interests which are apparent from the thumbnail itself.
39. In those circumstances, the Bundesgerichtshof (Federal Court of Justice) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Is it compatible with the data subject's right to respect for private life (Article 7 of the [Charter]) and to protection of personal data (Article 8 of the Charter) if, within the context of the weighing-up of conflicting rights and interests arising from Articles 7, 8, 11 and 16 of the Charter, within the scope of the examination of his [or her] request for de-referencing brought against the data controller of an internet search engine, pursuant to Article 17(3)(a) of [the GDPR], when the link, the de- referencing of which [that person] is requesting, leads to content that includes factual claims and value judgments based on factual claims the truth of which is denied by the data subject, and the lawfulness of which depends on the question of the extent to which the factual claims contained in that content are true, the national court also concentrates conclusively on the issue of whether the data subject could reasonably seek legal protection against the content provider, for instance by means of interim relief, and thus at least provisional clarification on the question of the truth of the content displayed by the search engine data controller could be provided?
(2) In the case of a request for de-referencing made against the data controller of an internet search engine, which in a name search searches for photos of natural persons which third parties have introduced into the internet in connection with the person's name, and which displays the photos which it has found in its search results as preview images (thumbnails), within the context of the weighing-up of the conflicting rights and interests arising from Articles 7, 8, 11 and 16 of the Charter pursuant to Article 12(b) and [point (a) of the first paragraph of Article 14] of Directive [95/46 or] Article 17(3)(a) of [the GDPR], should the context of the original third-party publication be conclusively taken into account, even if the third-party website is linked by the search engine when the preview image is displayed but is not specifically named, and the resulting context is not shown with it by the internet search engine?’
Consideration of the questions referred
The first question
Admissibility
40. Google expresses doubts as to whether the first question is admissible, on the ground that the problem which it raises is hypothetical in nature. In particular, the solution suggested by the referring court takes the form of an abstract construction which is unrelated to the facts at issue in the case in the main proceedings. In its view, the Court also does not have the necessary material to provide a useful answer to that question.
41. In that regard, it should be noted that, according to settled case-law, in the context of the cooperation between the Court and the national courts provided for in Article 267 TFEU, it is solely for the national court before which a dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances of the case, both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it submits to the Court. Consequently, where the questions submitted by the national court concern the interpretation of EU law, the Court of Justice is, in principle, bound to give a ruling (judgment of 15 July 2021, The Department for Communities in Northern Ireland, C-709/20, EU:C:2021:602, paragraph 54 and the case-law cited).
42. The Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 15 July 2021, The Department for Communities in Northern Ireland, C-709/20, EU:C:2021:602, paragraph 55 and the case-law cited).
43. In the present case, as the Advocate General observed in point 22 of his Opinion, the referring court has provided a sufficiently precise and comprehensive picture of the factual and legal context underlying the dispute in the main proceedings and has sufficiently substantiated the need, in that context, to obtain an answer to the question submitted.
44. In that connection, it should be pointed out that the processing of personal data carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 35). Where the data subject brings an action against the operator of the search engine, the rights, interests and restrictions involved are not, therefore, necessarily the same as in the context of an action brought against a content provider, with the result that a specific weighing-up exercise for the purposes of examining a request for de-referencing under Article 17 of the GDPR is necessary.
45. It is apparent from the considerations set out by the referring court that the Court's answer to the question concerning, first, the extent of the obligations and responsibilities incumbent on the operator of a search engine in processing a request for de-referencing based on the alleged inaccuracy of the information in the referenced content and, second, the burden of proof imposed on the data subject as regards that inaccuracy is capable of having a direct impact on the assessment, by the referring court, of the action in the main proceedings, regardless of whether the applicants in the main proceedings are in a position to obtain effective judicial protection as against the content provider concerning publication on the internet of the allegedly inaccurate content.
46. As the Advocate General observed in point 22 of his Opinion, the fact that the referring court's questions regarding the methodology which it considers to be applicable in a situation such as that at issue in the main proceedings are expressed in general and abstract terms does not mean that the question referred to the Court in that regard is hypothetical.
47. It follows that the first question is admissible.
Substance
48. By its first question, the referring court asks, in essence, whether Article 17(3)(a) of the GDPR must be interpreted as meaning that, within the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter, on the one hand, and those referred to in Articles 11 and 16 of the Charter, on the other hand, for the purposes of examining a request for de- referencing made to the operator of a search engine seeking the removal of a link to content containing claims which the person who submitted the request regards as inaccurate from the list of search results, that de-referencing is subject to the condition that the question of the accuracy of the referenced content has been resolved, at least provisionally, in an action brought by that person against the provider of that content, where there is a reasonable possibility of obtaining such judicial protection.
49. As a preliminary point, it must be recalled, first, that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 and points 1 and 2 of Article 4 of the GDPR when that information contains personal data and, second, that the operator of the search engine must be regarded as the ‘controller’ in respect of that processing within the meaning of Article 2(d) of that directive and Article 4(7) of that regulation (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 41, and of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 35).
50. Indeed, as recalled in paragraph 44 of the present judgment, the processing of personal data carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page. In addition, that activity plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject's name, including to internet users who otherwise would not have found the internet page on which those data are published. Also, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users' access to that information may, when users carry out their search on the basis of an individual's name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet enabling them to establish a more or less detailed profile of the data subject (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraphs 36 and 37, and of 24 September 2019, GC and Others (De- referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 36).
51. Therefore, inasmuch as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 and of the GDPR in order that the guarantees laid down by that directive and that regulation may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 38, and of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 37).
52. As regards the extent of the responsibility and specific obligations of the operator of a search engine, the Court has already stated that that operator is responsible not because personal data appear on an internet page published by a third party, but because of the referencing of that page and, in particular, the display of the link to that internet page in the list of results presented to internet users following a search carried out on the basis of an individual's name, since such a display of the link in such a list is liable significantly to affect the data subject's fundamental rights to privacy and to the protection of the personal data relating to him or her (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 80, and of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 46).
53. In those circumstances, having regard to the responsibilities, powers and capabilities of the operator of a search engine as the controller of the processing carried out in connection with the activity of the search engine, the prohibitions and restrictions laid down by Directive 95/46 and by the GDPR can apply to that operator only by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject (see, to that effect, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C-136/17, EU:C:2019:773, paragraph 47).
54. As regards such a request, the GDPR contains, in Article 17, a provision which specifically governs the ‘right to erasure’, also known as the ‘right to be forgotten’. Although paragraph 1 of that article provides that the data subject has, in principle, for the reasons listed therein, the right to obtain the erasure of personal data relating to him or her by the controller, it states, in paragraph 3, that that right may not be relied on where the processing in question is necessary on account of one of the grounds listed, which include, in Article 17(3)(a), exercising the right relating, in particular, to freedom of information.
55. Accordingly, the operator of a search engine who receives a request for de-referencing must ascertain whether the inclusion of the link to the internet page in question in the list displayed following a search carried out on the basis of the data subject's name is necessary for exercising the right to freedom of information of internet users potentially interested in accessing that internet page by means of a search, a right protected by Article 11 of the Charter (see, by analogy, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C-136/17, EU:C:2019:773, paragraph 66).
56. The fact that Article 17(3)(a) of the GDPR expressly provides that the data subject's right to erasure is excluded where processing is necessary for the exercise of the right of information, guaranteed in Article 11 of the Charter, is an expression of the fact that the right to protection of personal data is not an absolute right but, as recital 4 of the regulation states, must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 57 and the case-law cited).
57. In that context, it should be recalled that Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 58 and the case-law cited).
58. The GDPR, and in particular Article 17(3)(a), thus expressly lays down the requirement to strike a balance between the fundamental rights to privacy and protection of personal data guaranteed by Articles 7 and 8 of the Charter, on the one hand, and the fundamental right of freedom of information guaranteed by Article 11 of the Charter, on the other (judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 59).
59. It should be added that Article 7 of the Charter, regarding the right to respect for private and family life, contains rights corresponding to those guaranteed in Article 8(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), and that the protection of personal data is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the ECHR (ECtHR, 27 June 2017, Satakunnan Markkinapörssi oy and satamedia oy v. Finland, CE:ECHR:2017:0627JUD000093113, § 137). In accordance with Article 52(3) of the Charter, Article 7 of the Charter is thus to be given the same meaning and the same scope as Article 8(1) ECHR, as interpreted by the case-law of the European Court of Human Rights. The same is true of Article 11 of the Charter and Article 10 ECHR (see to that effect, judgment of 14 February 2019, Buivids, (C-345/17, EU:C:2019:122, paragraph 65 and the case-law cited).
60. It is apparent from the case-law of the European Court of Human Rights that, as regards the publication of data, for the purposes of striking a balance between the right to respect for private life and the right of freedom of expression and information, a number of relevant criteria must be taken into consideration, such as contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, the form and consequences of the publication, the manner and circumstances in which the information was obtained as well and its veracity (see, to that effect, ECtHR, 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, CE:ECHR:2017:0627JUD000093113, § 165).
61. It is in the light of those considerations that an examination must be made of the conditions in which the operator of a search engine is required to accede to a request for de-referencing and thus to remove from the list of results displayed following a search on the basis of the data subject's name, the link to an internet page on which that personal data specific to that person appear, on the ground that the referenced content contains claims which that person regards as inaccurate (see, to that effect, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C-136/17, EU:C:2019:773, paragraph 60).
62. In that regard, it should be noted, first of all, that, while the data subject's rights protected by Articles 7 and 8 of the Charter override, as a general rule, the legitimate interest of internet users who may be interested in accessing the information in question, that balance may, however, depend on the relevant circumstances of each case, in particular on the nature of that information and its sensitivity for the data subject's private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life (judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 81, and of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 66).
63. In particular, where the data subject plays a role in public life, that person must display a greater degree of tolerance, since he or she is inevitably and knowingly exposed to public scrutiny (see, to that effect, ECtHR, 6 October 2022, Khural and Zeynalov v. Azerbaijan, CE:ECHR:2022:1006JUD005506911, § 41 and the case-law cited).
64. The question of whether or not the referenced content is accurate also constitutes a relevant factor when assessing the conditions for application laid down in Article 17(3)(a) of the GDPR, for the purpose of assessing whether the right of internet users to information and the content provider's freedom of expression may override the rights of the person requesting de-referencing.
65. In that regard, and as stated, in essence, by the Advocate General in point 30 of his Opinion, while, in certain circumstances, the right to freedom of expression and information may override the rights to private life and to protection of personal data, in particular where the data subject plays a role in public life, that relationship is in any event reversed where, at the very least, a part – which is not minor in relation to the content as a whole – of the information referred to in the request for de-referencing proves to be inaccurate. In such a situation, the right to inform and the right to be informed cannot be taken into account, since they cannot include the right to disseminate and have access to such information.
66. It should be added that, while the issue of whether or not the assertions in the referenced content are accurate is relevant for the application of Article 17(3)(a) of the GDPR, a distinction must be drawn between factual assertions and value judgements. While the existence of facts can be demonstrated, the truth of value judgments is not susceptible of proof (see, to that effect, ECtHR, 23 April 2015, Morice v. France, CE:ECHR:2015:0423JUD002936910, § 126).
67. Next, it is necessary to determine, first, whether, and if so to what extent, it is for the person who has submitted the request for de-referencing to provide evidence to support his or her claim relating to the inaccuracy of the information in the referenced content and, second, whether the operator of the search engine must seek to clarify the facts itself in order to establish whether the allegedly inaccurate information is or is not accurate.
68. As regards, in the first place, the obligations of the person requesting de-referencing on account of the referenced content being inaccurate, it is for that person to establish the manifest inaccuracy of the information found in that content or, at the very least, of a part – which is not minor in relation to the content as a whole – of that information. However, in order to avoid imposing on that person an excessive burden which is liable to undermine the practical effect of the right to de-referencing, that person has to provide only evidence that, in the light of the circumstances of the particular case, can reasonably be required of him or her to try to find in order to establish that manifest inaccuracy. In that regard, that person cannot be required, in principle, to produce, as from the pre-litigation stage, in support of his or her request for de-referencing made to the operator of the search engine, a judicial decision made against the publisher of the website in question, even in the form of a decision given in interim proceedings. To impose such an obligation on that person would have the effect of imposing an unreasonable burden on him or her.
69. As regards, in the second place, the obligations and responsibilities incumbent on the operator of the search engine, it is true that the operator of the search engine must, in order to determine whether content may continue to be included in the list of search results carried out using its search engine following a request for de-referencing, take into account all the rights and interests involved and all the circumstances of the case.
70. However, when assessing the conditions for application laid down in Article 17(3)(a) of the GDPR, that operator cannot be required to play an active role in trying to find facts which are not substantiated by the request for de-referencing, for the purposes of determining whether that request is well founded.
71. Accordingly, when such a request is processed, the operator of the search engine concerned cannot be required to investigate the facts and, to that end, to organise an adversarial debate with the content provider seeking to obtain missing information concerning the accuracy of the referenced content. In so far as it would require the operator of the search engine to contribute to establishing itself whether or not the referenced content is accurate, such an obligation would impose on that operator a burden in excess of what can reasonably be expected of it in the light of its responsibilities, powers and capabilities, within the meaning of the case-law referred to in paragraph 53 of the present judgment. That obligation would thereby entail a serious risk that content meeting the public's legitimate and compelling need for information would be de-referenced and would thereby become difficult to find on the internet. In that regard, there would be a real risk of a deterrent effect on the exercise of freedom of expression and of information if the operator of the search engine undertook such a de-referencing exercise quasi- systematically, in order to avoid having to bear the burden of investigating the relevant facts for the purpose of establishing whether or not the referenced content was accurate.
72. Accordingly, where the person who has made a request for de-referencing submits relevant and sufficient evidence capable of substantiating his or her request and of establishing the manifest inaccuracy of the information found in the referenced content or, at the very least, of a part – which is not minor in relation to the content as a whole – of that information, the operator of the search engine is required to accede to that request for de-referencing. The same applies where the data subject submits a judicial decision made against the publisher of the website, which is based on the finding that information found in the referenced content – which is not minor in relation to that content as a whole – is, at least prima facie, inaccurate.
73. By contrast, where the inaccuracy of such information found in the referenced content is not obvious, in the light of the evidence provided by the data subject, the operator of the search engine is not required, where there is no such judicial decision, to accede to such a request for de-referencing. Where the information in question is likely to contribute to a debate of public interest, it is appropriate, in the light of all the circumstances of the case, to place particular importance on the right to freedom of expression and of information.
74. It should be added that, in accordance with what has been stated in paragraph 65 of the present judgment, it would also be disproportionate to de-reference articles, with the result that accessing all of them on the internet would be difficult, in a situation where only certain information of minor importance, in relation to the content found in those articles as a whole, proves to be inaccurate.
75. Lastly, it must be stated that, where the operator of a search engine does not grant the request for de- referencing, the data subject must be able to bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders that controller to adopt the necessary measures (see, to that effect, judgment of 13 May 2014, Google Spain and Google (C-131/12, EU:C:2014:317, paragraph 77). It is, in particular, for the judicial authorities to ensure a balance is struck between competing interests, since they are best placed to carry out a complex and detailed balancing exercise, which takes account of all the criteria and all the factors established by the relevant case-law of the Court of Justice and of the European Court of Human Rights.
76. However, where administrative or judicial proceedings concerning the alleged inaccuracy of information found in referenced content are initiated and where the existence of those proceedings has been brought to the attention of the operator of the search engine concerned, it is for that operator, for the purposes, inter alia, of providing internet users with information which continues to be relevant and up-to-date, to add to the search results a warning concerning the existence of such proceedings.
77. In the light of all the foregoing, the answer to the first question is that Article 17(3)(a) of the GDPR must be interpreted as meaning that, within the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter, on the one hand, and those referred to in Article 11 of the Charter, on the other hand, for the purposes of examining a request for de-referencing made to the operator of a search engine seeking the removal of a link to content containing claims which the person who submitted the request regards as inaccurate from the list of search results, that de- referencing is not subject to the condition that the question of the accuracy of the referenced content has been resolved, at least provisionally, in an action brought by that person against the content provider.
The second question
The applicable law ratione temporis
78. By its second question, the referring court requests an interpretation of Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 as well as of Article 17(3)(a) of the GDPR. It states, in that regard, that, while the request to have Google de-reference, on a long-term basis, the links to the articles at issue in the main proceedings falls ratione temporis within the scope of the GDPR, the request that Google put an end to the display, in the form of thumbnails, of photographs of the applicants in the main proceedings contained in the 4 June 2015 article falls ratione temporis within the scope of Directive 95/46, given that those photographs, unlike the links, were no longer displayed by the search engine operated by Google on the date when the GDPR entered into force.
79. In that regard, there is no need to distinguish between the provisions of Directive 95/46 and those of the GDPR referred to in the second question referred for a preliminary ruling, since the scope of all of those provisions must be regarded as similar for the purposes of the interpretation which the Court is required to give in the present case (see, by analogy, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, paragraph 58 and the case-law cited).
80. Consequently, in order to provide useful answers to the second question, it must be examined from the perspective of both Directive 95/46 and the GDPR.
Admissibility
81. Google also expresses doubts as to whether the second question is admissible, on the ground that the problem which it raises is hypothetical. First of all, Google takes the view that the subject matter of the dispute in the main proceedings is not a request to de-reference the results of an image search carried out on the basis of the names of the applicants in the main proceedings, but rather a general prohibition on displaying thumbnails corresponding to photographs illustrating one of the three articles at issue in the main proceedings. Next, Google argues that the thumbnails have not been available on the g-net website since September 2017 and the articles since 28 June 2018. Lastly, Google states that it introduced a new version of its image search engine as from 2018, in which the abbreviated title of the internet page specifically referenced and the internet address or a part of it are displayed on the results page under each thumbnail in the form of an additional link.
82. Pursuant to the principles identified by the case-law of the Court referred to in paragraphs 41 and 42 of the present judgment, it must be stated, first of all, that, in the present case, it is not obvious from the file before the Court that the interpretation of the provisions of Directive 95/46 and the GDPR, as sought by the referring court in the context of the assessment of the substance of the request seeking to have the display of the photographs brought to an end, bears no relation to the actual facts of the main action or its purpose.
83. As regards, in particular, the fact that the photographs and articles at issue in the main proceedings no longer appear on the g-net website, it is important to note, as the referring court has observed, that the removal of that content appears to be merely temporary, as shown by the statement on the g-net website that it is ‘currently’ impossible to access those articles. In those circumstances, it cannot be ruled out that those articles may be re-posted online in the future and may once again be referenced by Google's search engine. That is all the more so since Google continues to take the view that the request for de-referencing at issue in the main proceedings is unjustified and since Google continues to refuse to accede to that request.
84. Moreover, the interest in a response from the Court concerning the interpretation of the relevant provisions of Directive 95/46 and of the GDPR, in the context of the request seeking to have brought to an end the display, in the form of thumbnails, of the photographs at issue in the case in the main proceedings, cannot be called into question either by the fact, relied on by Google, that the applicants in the main proceedings have not limited their request to searches on the basis of their names, or by the fact that Google has introduced a new version of its image search engine in which the abbreviated title of the internet page specifically referenced and the internet address or a part of it are displayed on the results page under each thumbnail in the form of an additional link.
85. First, even if the request of the applicants in the main proceedings to bring to an end the display, in the form of thumbnails, of the photographs representing them were not limited to searches carried out on the basis of their names, the fact remains that that request covers a display resulting from such searches. In those circumstances, it cannot be held that the interpretation sought by virtue of the second question clearly bears no relation to the actual facts of the main action or its purpose.
86. Second, as regards the introduction in the image search of an additional link showing the internet page on which they were originally published, in accordance with the settled case-law of the Court, it is for the national courts to establish the facts on the basis of which the dispute in the main proceedings must be resolved and to decide the extent to which subsequent developments in the search engine concerned are relevant in that regard.
87. It follows that the second question is admissible.
Substance
88. By its second question, the referring court asks, in essence, whether Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 as well as Article 17(3)(a) of the GDPR must be interpreted as meaning that, in the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter, on the one hand, and those referred to in Articles 11 and 16 of the Charter, on the other hand, for the purposes of examining a request for de-referencing made to the operator of a search engine seeking the removal from the results of an image search carried out on the basis of the name of a natural person of photographs displayed in the form of thumbnails representing that person, the original context of the publication of those photographs on the internet must be conclusively taken into account.
89. That question thereby referred to the Court involves a request which seeks the removal of the photographs displayed in the form of thumbnails, which illustrated the article published on the g-net website on 4 June 2015, from the results of the image search carried out on the basis of the names of the applicants in the main proceedings. In that regard, the referring court seeks, in particular, to ascertain whether, for the purposes of assessing whether that request is well founded, account should be taken solely of the informative value of the thumbnails as such, in the neutral context of the list of results, or whether regard must also be had to the original context of the publication of the photographs, which is not apparent solely from the display of thumbnails in the context of the list of results.
90. As a preliminary point, it should be noted, as the Advocate General did in point 53 of his Opinion, that image searches carried out by means of an internet search engine on the basis of a person's name are subject to the same principles as those which apply to internet page searches and the information contained in them. The Court's case-law referred to in paragraphs 49 to 61 of the present judgment therefore also applies to the processing of a request for de-referencing which seeks the removal of photographs displayed in the form of thumbnails from the results of an image search.
91. In that regard, it is important to state, first of all, that the display, in the results of an image search, of photographs of natural persons in the form of thumbnails constitutes processing of personal data in respect of which the operator of the search engine concerned, as ‘controller’ within the meaning of Article 2(d) of Directive 95/46 and Article 4(7) of the GDPR, must, within the framework of its responsibilities, powers and capabilities, ensure compliance with the requirements contained in those provisions.
92. Next, it should be noted that the question referred concerns the specific method of searching for images offered by certain search engines, such as the search engine at issue in the main proceedings, by means of which internet users can search for information of any kind which takes the form of graphic content (photographs, representations of paintings, designs, graphs, tables, and so forth). When conducting such a search, the search engine generates a list of results consisting of thumbnails providing a link to internet pages containing both the search terms used and the graphic content set out in that list.
93. In that regard, it has been held that, since the inclusion in the list of results, displayed following a search made on the basis of a person's name, of an internet page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of that person and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject's fundamental right to privacy than the publication on the internet page (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 87).
94. That is all the more so where, following a search by name, photographs of the data subject are displayed in the form of thumbnails, that display being such as to constitute a particularly significant interference with the data subject's rights to private life and that person's personal data referred to in Articles 7 and 8 of the Charter.
95. A person's image constitutes one of the chief attributes of his or her personality as it reveals the person's unique characteristics and distinguishes the person from others. The right to the protection of one's image is thus one of the essential components of personal development and mainly presupposes that person's control over the use of that image, including the right to refuse publication of it. It follows that, while freedom of expression and of information undoubtedly includes the publication of photographs, the protection of the right to privacy takes on particular importance in that context since photographs are capable of conveying particularly personal or even intimate information about an individual or his or her family (see, to that effect, ECtHR, 7 February 2012, Von Hannover v. Germany, CE:ECHR:2012:0207JUD004066008, §§ 95, 96 and 103 and the case-law cited).
96. Consequently, when the operator of a search engine receives a request for de-referencing which seeks the removal, from the results of an image search carried out on the basis of the name of a person, of photographs displayed in the form of thumbnails representing that person, it must ascertain whether displaying the photographs in question is necessary for exercising the right to freedom of information of internet users who are potentially interested in accessing those photographs by means of such a search, a right protected by Article 11 of the Charter (see, by analogy, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C-136/17, EU:C:2019:773, paragraph 66).
97. In that regard, the contribution to a debate of public interest is an essential factor to be taken into consideration when striking a balance between competing fundamental rights, for the purposes of assessing whether what prevails are (i) the data subject's rights to respect for private life and to protection of his or her personal data or (ii) the rights to freedom of expression and information.
98. In so far as the search engine displays photographs of the data subject outside the context in which they are published on the referenced internet page, most often in order to illustrate the text elements contained in that page, it is necessary to establish whether that context must nevertheless be taken into consideration when striking a balance between the competing rights and interests.
99. In that context, as the Advocate General observed in point 54 of his Opinion, the question whether that assessment must also include the content of the internet page containing the photograph displayed in the form of a thumbnail, the removal of which is sought, depends on the purpose and nature of the processing at issue.
100. As regards, in the first place, the purpose of the processing at issue, it should be noted that the publication of photographs as a non-verbal means of communication is likely to have a stronger impact on internet users than text publications. Photographs are, as such, an important means of attracting internet users' attention and may encourage an interest in accessing the articles they illustrate. Since, in particular, photographs are often open to a number of interpretations, displaying them in the list of search results as thumbnails may, in accordance with what has been stated in paragraph 95 of the present judgment, result in a particularly serious interference with the data subject's right to protection of his or her image, which must be taken into account when weighing-up competing rights and interests.
101. Consequently, a separate weighing-up of competing rights and interests is required depending on whether the case concerns, on the one hand, articles containing photographs which are published on an internet page and which, when placed into their original context, illustrate the information provided in those articles and the opinions expressed in them, or, on the other hand, photographs displayed in the list of results in the form of thumbnails by the operator of a search engine outside the context in which they were published on the original internet page.
102. In that regard, it must be recalled that not only does the ground justifying the publication of a piece of personal data on a website not necessarily coincide with that which is applicable to the activity of search engines, but also, even where that is the case, the outcome of the weighing-up of the rights and interests at issue may differ according to whether the processing carried out by the operator of a search engine or that carried out by the publisher of that internet page is at issue, given that, first, the legitimate interests justifying the processing may be different and, second, the consequences of the processing for the data subject, and in particular for his or her private life, are not necessarily the same (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 86).
103. As regards, in the second place, the nature of the processing carried out by the operator of the search engine, it must be observed, as did the Advocate General in point 55 of his Opinion, that, by retrieving the photographs of natural persons published on the internet and displaying them separately, in the results of an image search, in the form of thumbnails, the operator of a search engine offers a service in which it carries out autonomous processing of personal data which is distinct both from that of the publisher of the internet page from which the photographs are taken and from that, for which the operator is also responsible, of referencing that page.
104. Therefore, an autonomous assessment of the activity of the operator of the search engine, which consists of displaying results of an image search, in the form of thumbnails, is necessary, given that the additional interference with fundamental rights resulting from such activity may be particularly intense owing to the aggregation, in a search by name, of all information concerning the data subject which is found on the internet. In the context of that autonomous assessment, account must be taken of the fact that the display of the photographs in the form of thumbnails on the internet constitutes, in itself, the result sought by the internet user, regardless of his or her subsequent decision to access the original internet page or not.
105. It should be added that such a specific weighing-up exercise, which takes account of the autonomous nature of the data processing performed by the operator of the search engine, is without prejudice to the possible relevance of text elements which may directly accompany the display of a photograph in the list of search results, since such elements are capable of casting light on the informative value of that photograph for the public and, consequently, of influencing the weighing-up of the rights and interests involved.
106. In the present case, it is apparent from the observations in the order for reference that, while the photographs of the applicants in the main proceedings contribute, in the context of the 4 June 2015 article of which they form part, to conveying the information and opinions expressed therein, those photographs, outside that context, when they appear solely in the form of thumbnails in the list of results displayed following a search carried out by the search engine, have little informative value. It follows that, if the request for de-referencing of that article were to be rejected, on the ground that freedom of expression and of information must prevail over the rights of the applicants in the main proceedings to respect for their private life and to protection of their personal data, that fact would be without prejudice to the appropriate outcome of the request for removal of those photographs displayed in the form of thumbnails in the list of results.
107. By contrast, if the request for de-referencing of the 4 June 2015 article at issue were to be granted, the display, in the form of thumbnails, of the photographs contained in that article would have to be removed. If that display were retained, the practical effect of de-referencing the article would be compromised since internet users would continue to have access to the entire article, by virtue of the link contained in the thumbnails which leads to the internet page on which the article from which the thumbnails are taken is published.
108. In the light of all the foregoing, the answer to the second question is that Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 as well as Article 17(3)(a) of the GDPR must be interpreted as meaning that, in the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter, on the one hand, and those referred to in Article 11 of the Charter, on the other hand, for the purposes of examining a request for de-referencing made to the operator of a search engine seeking the removal from the results of an image search carried out on the basis of the name of a natural person of photographs displayed in the form of thumbnails representing that person, account must be taken of the informative value of those photographs regardless of the context of their publication on the internet page from which they are taken, but taking into consideration any text element which accompanies directly the display of those photographs in the search results and which is capable of casting light on the informative value of those photographs.
Costs
109. Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 17(3)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that within the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, on the one hand, and those referred to in Article 11 of the Charter of Fundamental Rights, on the other hand, for the purposes of examining a request for de-referencing made to the operator of a search engine seeking the removal of a link to content containing claims which the person who submitted the request regards as inaccurate from the list of search results, that de-referencing is not subject to the condition that the question of the accuracy of the referenced content has been resolved, at least provisionally, in an action brought by that person against the content provider.
2. Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as Article 17(3)(a) of Regulation 2016/679
must be interpreted as meaning that in the context of the weighing-up exercise which is to be undertaken between the rights referred to in Articles 7 and 8 of the Charter of Fundamental Rights, on the one hand, and those referred to in Article 11 of the Charter of Fundamental Rights, on the other hand, for the purposes of examining a request for de-referencing made to the operator of a search engine seeking the removal from the results of an image search carried out on the basis of the name of a natural person of photographs displayed in the form of thumbnails representing that person, account must be taken of the informative value of those photographs regardless of the context of their publication on the internet page from which they are taken, but taking into consideration any text element which accompanies directly the display of those photographs in the search results and which is capable of casting light on the informative value of those photographs.
[Signatures]
Open access
