Guidelines 05/2019 on criteria of the Right to be Forgotten in search engines

Exception 1  Processing is necessary for exercising the right of  freedom of expression and information

44. This exemption to the application of Article 17.1 GDPR must be interpreted and applied in the context of the characteristics that define erasure. Article 17.1 GDPR is described as a clear and unconditional mandate addressed to controllers. If the conditions set forth in Article 17.1 GDPR are met, the controller shall “have the obligation to delete personal data without undue delay“. Nonetheless, this is not an absolute right. The exemptions of Article 17.3 GDPR identify cases in which this obligation does not apply.

45. However, the balance between protecting the rights of interested parties and freedom of expression, including free access to information, is an intrinsic part of Article 17 GDPR.

46. The CJEU recognised in the Costeja judgement and repeated recently in the Google 2 judgment that the processing carried out by a search engine provider can significantly affect the fundamental rights to privacy and data protection law when the search is performed using the name of a data subject.

47. When weighing up the rights and freedoms of data subjects and the interests of Internet users in accessing the information through the search engine provider, the Court understood that “Whilst it is true that the data subject’s rights are protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the publicin having that information, an interest which may vary, in particular, according to the role playedby the data subject in public life.”

48. The Court also considered that the rights of the data subjects will prevail, in general, on the interest of Internet users in accessing information through the search engine provider. However, it identified several factors that may influence such determination. Among them include: the nature of the information or its sensitivity, and especially the interest of Internet users in accessing information, an interest that can vary depending on the role played by the interested party in public life.

49. The analysis of the delisting by the Court implies that, when assessing requests for delisting, the decision on the maintenance or blocking of the search results by a search engine provider necessarily has to consider what would be the impact of a delisting decision on the access to information by Internet users. This impact does not necessarily entail the rejection of a delisting request. As confirmed by the Court, such interference with the fundamental rights of the data subject has to be justified by the preponderant interest of the general public in having access to the information inquestion.

50. The Court also distinguished between the legitimacy that a web publisher can have to disseminate information against the legitimacy of the search engine provider. The Court recognised that the activity of a web publisher can be undertaken exclusively for the purposes of journalism, in which case the web publisher would benefit from the exemptions that Member States could establish in these cases on the basis of Article 9 of the Directive (currently , Article 85.2 GDPR). In this regard, in the judgment “M.L. and W.W. vs Germany” of June 28th, 2018, the ECHR indicates that the balancing of the interests at issue may lead to different results depending on the request at stake (distinguishing (i) a request for erasure brought against the original publisher whose activity is at the heart of what freedom of expression aims to protect from (ii) a request brought against the search engine whose first interest is not to publish the original information on the data subject but notably to enable identifying any available information on this person and thus establishing his or her profile).

51. Those considerations should be assessed in respect of Article 17 GDPR complaints as in those decisions, the rights of the data subjects that have requested the delisting must be weighed with the interests of Internet users to access the information.

52. As explained by the CJEU in its Google 2 judgment, Article 17.3.a GDPR is “an expression of the fact that the right to protection of personal data is not an absolute right but (…) must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality”. It “expressly lays down the requirement to strike a balance between the fundamental rights to privacy and protection of personal data guaranteed by Articles 7 and 8 of the Charter, on the one hand, and the fundamental right of freedom of information guaranteed by Article 11 of the Charter, on the other.”

53. The Court concludes that “where the operator of a search engine has received a request for de-referencing relating to a link to a web page on which personal data falling within the special categories (…), the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data laid down in Articles 7 and 8 of the Charter, ascertain, having regard to the reasons of substantial public interest (…), whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.”

54. To conclude, depending on the circumstances of the case, search engine providers may refuse to delist a content in the event where they can demonstrate that its inclusion in the list of results is strictly necessary for protecting the freedom of information of internet users.