Right to request removal of links from an internet search engine and to „be forgotten” in the light of the judgment of the Court of Justice of the European Union of September 24th, 2019 in Case C-507/17, Google Inc.

On September 24^th, 2019. The Court of Justice of the European Union has ruled in Case C-507/17, Google LLC, successor in title to Google Inc. / Commission nationale de l’informatique et des libertés (CNIL), judgment in which it interpreted the provisions of Articles 12(b) and 14(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of October 24^th, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (O.J.E.U. L., 1995 L 281, p. 1), No. 281, p. 31) and Article 17(1) of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation, O.J.U.E. L., 281, p. 31) and Article 17(1) of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation, O.J.U.E. L., 2016, No. 119, p. 1).

According to the Court of Justice judgment, those provisions must be interpreted as meaning that „where a search engine operator accepts a request for removal of links under those provisions, it is obliged to remove those links not from all versions of its search engine but from those versions of its search engine which correspond to all Member States, if necessary in conjunction with the application of measures, which satisfy the requirements laid down by law and which in fact prevent internet users who carry out a search by name in the territory of a Member State on the basis of the data subject’s name from accessing the list of results displayed after that search, or at least seriously discourage them from accessing the links to which that request relates.”

Considering the content of the above judgment, it should be recalled that the right to delete data, including the deletion of links, being an element of the so-called „right to be forgotten„; results directly from the provision of Article 17(1) of the GDPR, according to which the data subject has the right to demand that the controller immediately delete personal data concerning him/her, and the controller is obliged to delete personal data without undue delay if one of the circumstances mentioned in the provision occurs, e. g. personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the rightful revoked consent, or personal data were processed without undue delay, e. g. personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the rightful revoked consent, or personal data were not processed.

The judgment referred to above states that, in so far as a data deletion request is made against a search engine operator, that operator is not obliged to remove links from all versions of its search engine, but only from those versions which correspond to all the Member States of the European Union.

The right to be forgotten is therefore not absolute and is subject to certain limitations, which must be borne in mind when formulating specific claims and demands.