Author: Boyana Boyadzhieva
In its judgment in Case C-460/20, the CJEU ruled that the person operating an internet search engine must de-reference information that the person making the request proves to be manifestly inaccurate. The judgment follows a reference for a preliminary ruling from the German Federal Supreme Court in relation to a legal dispute concerning the exercise of the right to erasure (“right to be forgotten”).
In its interpretation of the legal framework of the GDPR, the CJEU recalls three important considerations:
Under Recital 4, the right to the protection of personal data is not an absolute right but must be considered in relation to its function in society and balanced against other fundamental rights under the principle of proportionality.
According to Recital 39, every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted.
Recital 65 dictates that ‘a data subject should have the right to have personal data concerning him or her rectified and a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information […]’.
Relying on the case law of the European Court of Human Rights, the CJEU adds that for the purposes of striking a balance between the right to respect for private life and the right to freedom of expression and information, a number of relevant criteria must be taken into consideration, such as contribution to a debate of public interest, the degree of the notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, the form and consequences of the publication, the manner and circumstances in which the information was obtained as well and its veracity.
Therefore, although the rights to respect for privacy and protection of personal data generally take precedence over the legitimate interest of internet users who could potentially have an interest in accessing the information in question, this balance may depend on the relevant circumstances in each case, in particular the nature of that information and its sensitivity to the privacy of the data subject, as well as the interest of the public in having that information.
This will be the case where the data subject plays an important role in public life. However, this hypothesis, as noted by the Advocate General, is overridden in all cases where it turns out that even some of the information listed in the request for de-referencing from the search results proves to be inaccurate.
Importantly, the information or part of the information that is referred to in the request de-referencing must not be of a minor nature in relation to the content as a whole.
The Court held the person operating the Internet search engine could not be required to exercise an active fact-finding role to determine whether a request for de-referencing shall be warranted and specified that the burden of proof in that regard lies with the person requesting the de-referencing.
In the event that the person requesting the de-referencing submits relevant and sufficient evidence capable of substantiating his or her request and of establishing the manifest inaccuracy of the information found in the referenced content or, at the very least, of a part – which is not minor in relation to the content as a whole – of that information, the operator of the search engine is required to accede to that request for de-referencing. The same applies where the data subject submits a judicial decision made against the publisher of the website, which is based on the finding that information found in the referenced content – which is not minor in relation to that content as a whole – is, at least prima facie, inaccurate.
In the absence of such a court decision and where the inaccuracy of such information found in the referenced content is not obvious, the operator of the search engine is not required to accede to such a request for de-referencing. In this case, the data subject must be able to bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders that the controller adopt the necessary measures.