OPINION OF ADVOCATE GENERAL
SZPUNAR
delivered on 10 January 2019 (1)
Case C‑507/17
Google LLC, successor to Google Inc.
v
Commission nationale de l’informatique et des libertés (CNIL),
intervening parties
Wikimedia Foundation Inc.,
Fondation pour la liberté de la presse,
Microsoft Corp.,
Reporters Committee for Freedom of the Press and Others,
Article 19 and Others,
Internet Freedom Foundation and Others,
Défenseur des droits
(Request for a preliminary ruling from the Conseil d’État (Council of State, France))
(Reference for a preliminary ruling — Personal data — Scope of the right to de-referencing — Judgment of 13 May 2014, Google Spain and Google, C‑131/12 — De-referencing on the domain name extension corresponding to the Member State of the request or on the search engine’s domain name extensions corresponding to that search engine’s national extensions for all Member States)
I. Introduction
1. The present request for a preliminary ruling from the Conseil d’État (Council of State, France) follows on from the judgment in Google Spain and Google (2) and will provide the Court, in particular, with the opportunity to clarify the territorial scope of Directive 95/46/EC. (3) It is common knowledge that in that case the Court established a ‘right to be forgotten’ in that, on certain conditions, a person may have internet links de-referenced by the operator of a search engine. In the present case, the Court is requested to clarify the territorial scope of a de-referencing and to determine whether the provisions of Directive 95/46 require de-referencing at national, European or worldwide level.
2. In the present case, I shall propose that the Court adopt a European de-referencing: the operator of a search engine should be required to remove the links of results displayed following a search carried out from a place situated in the European Union.
II. Legal framework
A. EU law
1. Directive 95/46
3. According to Article 1, the purpose of Directive 95/46 is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to eliminate obstacles to the free flow of those data.
4. Article 2 of Directive 95/46 provides that, ‘for the purposes of [that] Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
…
(h) “the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’
5. Article 3 of that directive, entitled ‘Scope’, states in paragraph 1:
‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’
6. Article 4 of that directive, entitled ‘National law applicable’, provides:
‘1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;
…’
7. In Chapter II, Section I of Directive 95/46, entitled ‘Principles relating to data quality’, Article 6 provides:
‘1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is complied with.’
8. In Chapter II, Section II of Directive 95/46, entitled ‘Criteria for making data processing legitimate’, Article 7 provides:
‘Member States shall provide that personal data may be processed only if:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1.’
9. Article 12 of that directive, entitled ‘Right of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
…
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
…’
10. Article 14 of that directive, entitled ‘The data subject’s right to object’, provides:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
…’
11. Article 28 of that directive, entitled ‘Supervisory authority’, is worded as follows:
‘1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
…
3. Each authority shall in particular be endowed with:
– investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,
– effective powers of intervention, such as, for example, that of … ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing …,
…
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
…
6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.
The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.
…’
2. Regulation (EU) 2016/679
12. Regulation (EU) 2016/679 (4) is, pursuant to Article 99(2), to apply from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date.
13. Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:
‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(e) for the establishment, exercise or defence of legal claims.’
14. Article 18 of Regulation 2016/679, entitled ‘Right to restriction of processing’, provides:
‘1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
…
(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.’
15. Article 21 of that regulation, entitled ‘Right to object’, provides in paragraph 1:
‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’
16. Article 85 of that regulation, entitled ‘Processing and freedom of expression and information’, states:
‘1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.’
B. French law
17. Directive 95/46 was implemented in French law by loi nº 78-17 relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 on information technology, data files and civil liberties) of 6 January 1978 (‘the Law of 6 January 1978’).
III. Facts and main proceedings
18. By decision of 21 May 2015, the President of the Commission nationale de l’informatique et des libertés (French Data Protection Authority) (‘the CNIL’) served formal notice on Google LLC that, when it granted the request of a natural person seeking the removal of links to web pages from the list of results displayed following a search carried out on the basis of his name, it must apply that removal to all the domain name extensions of its search engine.
19. Google refused to comply with that notice, but merely removed the links in question only from the results displayed in response to searches carried out on versions of its search engine whose domain name corresponds to a Member State of the European Union.
20. The CNIL also considered insufficient the further proposal, known as ‘geo-blocking’, made by Google after the time limit laid down in the formal notice had expired, which consists in eliminating the possibility of accessing, from an IP address deemed to be located in the Member State of residence of the data subject, the results in question obtained following a search carried out on the basis of his name, irrespective of the version of the search engine on which the internet user carried out the search.
21. After finding that Google had not complied with the formal notice within the prescribed time limit, the CNIL, by an adjudication of 10 March 2016, imposed a fine on Google of EUR 100 000, which was made public.
22. By application to the Conseil d’État (Council of State), Google sought annulment of that adjudication.
23. In the context of that procedure, the Conseil d’État (Council of State) held that the interventions of Wikimedia Foundation Inc., the Fondation pour la liberté de la presse (Foundation for Press Freedom), Microsoft Corp., Reporters Committee for Freedom of the Press and Others, Article 19 and Others and the Internet Freedom Foundation and Others were admissible as they showed sufficient interest in the annulment of the contested adjudication.
24. The Conseil d’État (Council of State) observes that the processing of personal data by the search engine operated by Google, having regard to the activities of promoting and selling of advertising space carried out, in France, by its subsidiary Google France, comes within the scope of the Law of 6 January 1978, which transposes Directive 95/46 into French law.
25. The Conseil d’État (Council of State) finds, moreover, that the search engine operated by Google is divided into different domain names by geographic extensions, in order to adapt the results displayed to the specificities, in particular the language specificities, of the different countries in which Google operates. When the search is carried out from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the country from which that search, owing to the identification of the internet user’s IP address, is deemed to be made. Irrespective of his location, however, it is still possible for the internet user to search on the search engine’s other domain names. Furthermore, although the result may differ according to the domain name on the basis of which the search is carried out on the search engine, it is common ground that the links displayed in response to a search come from common databases and a common indexing.
26. The Conseil d’État (Council of State) considers that, having regard to the fact that the domain names of Google’s search engine are all accessible from French territory and also to the existence of gateways between those different domain names, as illustrated in particular by the automatic redirection of the search and, in addition, the presence of cookies on extensions of the search engine other than the one on which they were initially placed, that search engine, which, moreover, was the subject of only one declaration to the CNIL, must be regarded as carrying out a single processing of personal data for the application of the Law of 6 January 1978. It follows that the processing of personal data by the search engine operated by Google is carried out in the context one of its installations, Google France, established on French territory, and that for that reason it is subject to the Law of 6 January 1978.
27. Before the Conseil d’État (Council of State), Google maintains that the penalty at issue is based on a flawed interpretation of the provisions of the Law of 6 January 1978 that transpose Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in the judgment in Google Spain and Google, (5) recognised a ‘right to de-referencing’. Google claims that that right does not necessarily mean that the links at issue must be deleted, without geographic limitation, from all the domain names of its search engine. In addition, it maintains that, in applying such an interpretation, the CNIL disregarded the principles of comity and non-interference recognised by public international law and committed a disproportionate breach of the freedoms of expression, information, communications and the press guaranteed, in particular, by Article 11 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
IV. Questions for a preliminary ruling and procedure before the Court
28. The Conseil d’État (Council of State) found that those arguments raised a number of serious issues with respect to the interpretation of Directive 95/46 and decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:
‘(1) Must the “right to de-referencing”, as established by the [Court] in its judgment [in Google Spain and Google (6)] on the basis of the provisions of Articles 12(b) and 14(a) of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]?
(2) In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States of the European Union?
(3) Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing”, as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive 95/46, regardless of the domain name used by the internet user conducting the search?’
29. Written observations were lodged by Google, the CNIL, Wikimedia Foundation, the Fondation pour la liberté de la presse, Reporters Committee for Freedom of the Press and Others, Article 19 and Others, Internet Freedom Foundation and Others, the Défenseur des droits, the French Government, Ireland, the Greek, Italian, Austrian and Polish Governments and also by the European Commission.
30. All of those parties — with the exception of the Défenseur des droits and the Italian Government — and Microsoft presented oral submissions at the hearing on 11 September 2018.
V. Analysis
31. The questions submitted by the referring court concern the interpretation not of the provisions of Regulation 2016/679 but of the provisions of Directive 95/46. That regulation, which has been applicable since 25 May 2018, (7) repealed that directive with effect from the same date. (8)
32. Since it is apparent that, in French administrative procedural law, the law applicable to a dispute is the law in force on the day on which a contested decision was adopted, there can be no doubt that it is Directive 95/46 that is applicable to the dispute in the main proceedings. Consequently, it is the provisions of that directive that the Court is required to interpret.
A. First question
33. By its first question, the Conseil d’État (Council of State) asks the Court, in essence, whether the operator of a search engine is required, when it grants a request for de-referencing, to apply that de-referencing on all the domain names of its search engine, so that the links at issue no longer appear irrespective of the place from which the search on the basis of the requester’s name is carried out.
34. The CNIL, the Défenseur des droits and the French, Italian and Austrian Governments refer to the need for effective and complete protection of the right to protection of personal data, guaranteed in Article 8 of the Charter, and to the practical effect of the right to de-referencing, arising under Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46, claiming that a requirement of worldwide de-referencing is necessary in order to ensure the effectiveness of those rights. That also seems to be the position expressed by the ‘“Article 29” Working Party on Data Protection’ (9) in its ‘Guidelines on the Implementation of the [Google Spain and Google] judgment’ (10) of 26 November 2014 (11) (‘the Guidelines’). In fact, that working party observes that ‘in order to give full effect to the data subject’s rights as defined in the Court’s ruling, [de-referencing] decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. In that sense, limiting [de-referencing] to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient mean to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case [de-referencing] should also be effective on all relevant domains, including .com’. (12)
35. By contrast, Google, Wikimedia Foundation, the Fondation pour la liberté de la presse, Reporters Committee for Freedom of the Press and Others, Article 19 and Others, Internet Freedom Foundation and Others, Ireland, the Greek and Polish Governments and the Commission maintain, in essence, that the establishment of a worldwide right to de-referencing on the basis of EU law would not be compatible with either EU law or public international law and would amount to a dangerous precedent that would invite authoritarian regimes also to require the implementation on a worldwide scale of their censorship decisions.
36. The idea of worldwide de-referencing may seem appealing on the ground that it is radical, clear, simple and effective. Nonetheless, I do not find that solution convincing, because it takes into account only one side of the coin, namely the protection of a private person’s data.
1. The Google Spain and Google judgment
37. The starting point of my analysis is the judgment in Google Spain and Google. (13)
38. That judgment does not determine the geographic scope of the implementation of a de-referencing. Nonetheless, it contains a number of factors, in particular concerning the question of the territorial scope of Directive 95/46, that deserve mention here.
39. One of the questions was in what circumstances Directive 95/46 applies territorially to the processing of personal data carried out in the context of the activity of a search engine such as Google Search, which is operated by Google Inc., the parent company of the Google group, whose headquarters are in the United States.
40. In that regard, the Court ruled — on the basis of Article 4(1)(a) of Directive 95/46, which established as a criterion that the ‘processing [of personal data] is carried out in the context of the activities of an establishment of the controller [of that processing] on the territory of [a] Member State’ — that the territorial scope of Directive 95/46 covers cases in which the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State (such as Google Spain or, in this instance, Google France). (14)
41. In doing so, the Court rejected Google Spain’s and Google Inc.’s argument that the processing of the personal data at issue was carried out not ‘in the context of the activities’ of Google Spain, but exclusively by Google Inc., which apparently operated Google Search without any intervention on the part of Google Spain, whose activity was confined to providing support for the advertising activities of the Google group, which were separate from its search engine service.
42. In that regard, the Court made clear that the objective of Directive 95/46 is to ensure effective protection of the fundamental rights and freedoms of natural persons, and in particular the right to privacy, with respect to the processing of personal data and that the expression ‘in the context of the activities’ cannot be interpreted restrictively. (15) Furthermore, it follows from Article 4 of Directive 95/46 that the European Union legislature sought to prevent individuals from being deprived of the protection guaranteed by that directive and that protection from being circumvented, by prescribing a particularly broad territorial scope. (16)
2. The place from which the search is made
43. Just as in the present case, in Google Spain and Google (17) the dispute in the main proceedings was between Google (18) as applicant and a national data protection agency (19) concerning a decision of that agency.
44. Nonetheless, the person at the centre of the judgment in Google Spain and Google (20) is clearly the person whose personal data must be protected. It is to that person’s rights that the Court gives pre-eminence. The viewpoint of the person who searches for information appears in that judgment only incidentally. (21) Accordingly, by referring only to ‘the list of results displayed following a search made on the basis of a person’s name’, the Court did not specify the context in which, by whom and from where that search was carried out.
45. If the provisions of Directive 95/46 are thus intended to protect the fundamental rights, on the basis of Articles 7 and 8 of the Charter, of the person ‘searched’ and subsequently ‘referenced’, they are silent, however, on the question of the territoriality of the de-referencing. By way of example, neither those provisions nor the judgment in Google Spain and Google (22) make clear whether a search request made from Singapore must be treated differently from a search request made from Paris or from Katowice.
46. To my mind, a distinction must be drawn according to the place from which the search is carried out. Search requests made outside the territory of the European Union should not be subject to de-referencing of the search results.
(a) The territorial application of Directive 95/46
47. Under Article 52(1) TEU, the Treaties are to apply to the 28 Member States. (23) The territory of a Member State is defined by national law and by public international law. (24) Article 52(2) TEU further states that the territorial scope of the Treaties is specified in Article 355 TFEU. (25) Outside that territory, EU law cannot, in principle, apply or, consequently, create rights and obligations.
48. The question therefore arises whether, for an exceptional reason, the scope of Directive 95/46 extends beyond the abovementioned territorial borders, that is to say whether the provisions of that directive must be interpreted sufficiently broadly as to have effects beyond those borders.
49. I do not think they should.
50. It is a fact that there are certain situations in which extraterritorial effects are accepted in EU law.
51. As the French Government also emphasises, according to settled case-law in competition matters, the fact that an undertaking participating in an anticompetitive agreement or implementing a practice of such a kind is situated in a third country does not prevent the application of the EU rules on competition pursuant to Articles 101 and 102 TFEU if that agreement or practice is operative on the territory of the European Union. (26)
52. In connection with trade mark law, the Court has held that the effectiveness of the rules on the protection of trade mark rights (27) would be impaired if they were not to apply to the use, in an internet offer for sale or advertisement targeted at consumers within the European Union, of a sign identical with or similar to a trade mark registered in the European Union merely because the third party behind that offer or advertisement is situated in a third State, because the server of the internet site used by the third party is located in such a State or because the product that is the subject of the offer or the advertisement is located in a third State. (28)
53. Those two types of situation are in my view extreme situations of an exceptional nature. What is crucial in both situations is the effect on the internal market (even if other markets may also be affected). The internal market is a territory clearly defined by the Treaties. On the other hand, the internet is by nature worldwide and, in a certain fashion, is present everywhere. It is therefore difficult to draw analogies and make comparisons.
(b) The extraterritorial effects of fundamental rights
54. Nor in my view is it possible to rely, as the Défenseur des droits does, on the case-law of the European Court of Human Rights on the extraterritorial effects of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950, in the context of the extradition of a person to a third country, (29) for two reasons.
55. First, the scope of the Charter follows the scope of EU law and not vice versa, as expressly stated in Article 51(2) of the Charter. (30)
56. Second, that case-law concerns the specific cases of the death penalty or the prohibition of torture, human rights which form the basis of any State governed by the rule of law and from which no derogation is possible. (31)
57. Conversely, and this in a way is the core of the present case, the ‘right to be forgotten’ must be weighed against other fundamental rights.
(c) The balancing of the fundamental rights
58. The key argument against de-referencing being required on a worldwide scale is the argument taken from the judgment in Google Spain and Google (32) that the fundamental rights must be weighed against the information relating to those rights. In that case, the Court placed great importance on the weighing of, on the one hand, the right to data protection and privacy and, on the other, the legitimate interest of the public in having access to the information sought.
59. It has been established that the right to the protection of data and the right to private life are rights that flow from Articles 7 and 8 of the Charter and must have a connection with EU law and its territoriality. The same applies to the legitimate interest of the public in having access to the information sought. So far as the European Union is concerned, that right flows from Article 11 of the Charter. The public referred to is not the worldwide public but the public that comes within the scope of the Charter, and therefore the European public.
60. If worldwide de-referencing were admitted, the EU authorities would not be in a position to define and determine a right to receive information, still less to strike a balance between that right and the other fundamental rights to data protection and to private life, a fortiori because such a public interest in having access to information will necessarily vary, depending on its geographic location, from one third State to another.
61. Furthermore, there would then be a danger that the European Union would prevent individuals in third countries from having access to information. If an authority within the European Union could order de-referencing on a worldwide scale, an inevitable signal would be sent to third countries, which could also order de-referencing under their own laws. Let us suppose that, for whatever reason, third countries interpret certain of their rights in such a way as to prevent persons located in a Member State of the European Union from having access to information which they sought. There would be a genuine risk of a race to the bottom, to the detriment of freedom of expression, on a European and worldwide scale. (33)
62. The issues at stake therefore do not require that the provisions of Directive 95/46 be applied outside the territory of the European Union. That does not mean, however, that EU law can never require a search engine such as Google to take action at worldwide level. I do not exclude the possibility that there may be situations in which the interest of the European Union requires the application of the provisions of Directive 95/46 beyond the territory of the European Union; but in a situation such as that of the present case, there is no reason to apply the provisions of Directive 95/46 in such a way.
63. I therefore propose that the Court’s answer to the first question should be that the provisions of Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 must be interpreted as meaning that the operator of a search engine is not required, when granting a request for de-referencing, to operate that de-referencing on all the domain names of its search engine in such a way that the links at issue no longer appear, regardless of the place from which the search on the basis of the requester’s name is carried out.
B. Second and third questions
64. Since I propose that the first question be answered in the negative, it is appropriate to continue the analysis by dealing with the second and third questions together.
65. By its second question, the referring court seeks to ascertain whether, when it grants a request for de-referencing, the operator of a search engine is required only to remove the links in question from the results displayed follow a search on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the search engine’s domain names that correspond to its national extensions for all the Member States of the European Union.
66. The third question, which is submitted ‘in addition’ to the second question, seeks to establish whether the operator of a search engine granting a request for de-referencing is required to delete, by the technique known as ‘geo-blocking’, from an IP address deemed to be located in the State of residence of the beneficiary of the ‘right to de-referencing’, the results at issue of the searches carried out on the basis of his name, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive 95/46, regardless of the domain name used by the internet user conducting the search.
67. In its questions, the referring court establishes an inseparable link between, on the one hand, the domain name of a search engine (34) and, on the other hand, the place from which an internet search on the basis of a person’s name is carried out. (35)
68. So far as the first question for a preliminary ruling is concerned, such a link is natural: if the operator of a search engine makes the results of a search on all of its domain names inaccessible, the links at issue clearly no longer appear, irrespective of the place from which the search is made.
69. On the other hand, if the first question is answered in the negative, as I propose it should be, such a link is no longer inevitable. As the referring court itself observes, it remains open to a person to search on any domain name of the search engine. For example, the extension google.fr is not limited to searches carried out from France.
70. That possibility may nonetheless be limited by what is known as ‘geo-blocking’ technology.
71. Geo-blocking is a technique that limits access to internet content depending on the geographic location of the user. In a system of geo-blocking, the user’s location is determined with the help of geo-location techniques, such as verification of the user’s IP address. Geo-blocking, which is a form of censorship, is deemed to be unjustified in the law of the EU internal market, where it is the subject, in particular, of a regulation designed to prevent professionals carrying out their activities in one Member State from blocking or limiting access by customers from other Member States wishing to carry out cross-border transactions on their online interfaces. (36)
72. Once geo-blocking is accepted, the domain name of the operator of the search engine used is immaterial. I therefore propose to address the third question before the second question.
73. In the judgment in Google Spain and Google, (37) the Court held that the operator of a search engine must ensure, within the framework of its responsibilities, powers and capabilities, that the activity of that search engine meets the requirements of Directive 95/46 in order that the guarantees laid down by that directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved. (38)
74. Once a right to de-referencing is established, it is thus for the operator of a search engine to take all steps available to him to ensure effective and complete de-referencing. (39) That operator must take all the steps which are technically possible. So far as the case before the referring court is concerned, that includes, inter alia, the technique known as ‘geo-blocking’, irrespective of the domain name used by the internet user making the search.
75. De-referencing must be carried out not at national level, as I shall explain below, but at EU level.
76. As Directive 95/46 is intended to ‘ensure a high level of protection in [the Union]’, (40) it seeks to establish a complete system of data protection that transcends national borders. Based on the former Article 100a TEC, (41) it forms part of the logic of the internal market which, if any reminder is needed, is to comprise an area without internal frontiers. (42) It follows that de-referencing at national level would run counter to that harmonisation objective and to the practical effect of the provisions of Directive 95/46. (43)
77. It should be pointed out, moreover, that under Regulation 2016/679 that question would not even arise, since that regulation is, as such, to be ‘directly applicable in all Member States’. (44) Based on Article 16 FEU, Regulation 2016/679 transcends the internal-market approach of Directive 95/46 and is designed to ensure a complete system of personal data protection in the European Union. (45) That regulation refers systematically to the Union, the territory of the Union or the Member States. (46)
78. I therefore propose that the answer to the second and third questions for a preliminary ruling should be that the operator of a search engine is required to delete the links at issue from the results displayed following a search carried out on the basis of the requester’s name in a place located in the European Union. In that context, that operator is required to take all steps available to him to ensure effective and complete de-referencing. That includes, in particular, the technique known as ‘geo-blocking’, from an IP address deemed to be located in one of the Member States subject to Directive 95/46, irrespective of the domain name used by the internet user carrying out the search.
VI. Conclusion
79. Having regard to all of the foregoing considerations, I propose that the Court should answer the questions for a preliminary ruling referred by the Conseil d’État (Council of State, France) as follows:
(1) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the operator of a search engine is not required, when granting a request for de-referencing, to operate that de-referencing on all the domain names of its search engine in such a way that the links at issue no longer appear, regardless of the place from which the search on the basis of the requester’s name is carried out.
(2) The operator of a search engine is required to delete the links at issue from the results displayed following a search carried out on the basis of the requester’s name in a place located in the European Union. In that context, that operator is required to take all steps available to him to ensure effective and complete de-referencing. That includes, in particular, the technique known as ‘geo-blocking’, from an IP address deemed to be located in one of the Member States subject to Directive 95/46, regardless of the domain name used by the internet user conducting the search.