{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-507-17", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-507-17)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-13", "fingerprint": "ewai:eu:a03983", "proof": "sha256:ae7c97e0256fe80817ace5f202d4470c43489e2bb3bba717a99bdcb58a614994", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-507-17", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62017CJ0507", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraphs": [] }, { "title": "24 September 2019 (\n *1\n )", "paragraphs": [ "para_4", "para_5", "para_6", "para_7", "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20", "para_21", "para_22", "para_23", "para_24", "para_25", "para_26", "para_27", "para_28", "para_29", "para_30", "para_31", "para_32", "para_33", "para_34", "para_35", "para_36", "para_37", "para_38", "para_39", "para_40", "para_41", "para_42", "para_43", "para_44", "para_45", "para_46", "para_47", "para_48", "para_49", "para_50", "para_51", "para_52", "para_53", "para_54", "para_55", "para_56", "para_57" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_60" ] }, { "title": "2", "paragraphs": [ "para_62" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "European Union law", "paragraphs": [] }, { "title": "Directive 95/46", "paragraphs": [] }, { "title": "3", "paragraphs": [ "para_67" ] }, { "title": "4", "paragraphs": [] }, { "title": "Recitals 2, 7, 10, 18, 20 and 37 of Directive 95/46 state:", "paragraphs": [ "para_70", "para_71", "para_72" ] }, { "title": "(7)", "paragraphs": [ "para_74", "para_75" ] }, { "title": "(10)", "paragraphs": [ "para_77", "para_78" ] }, { "title": "(18)", "paragraphs": [ "para_80", "para_81" ] }, { "title": "(20)", "paragraphs": [ "para_83", "para_84" ] }, { "title": "(37)", "paragraphs": [ "para_86" ] }, { "title": "5", "paragraphs": [] }, { "title": "Article 2 of that directive provides:", "paragraphs": [ "para_89" ] }, { "title": "(a)", "paragraphs": [ "para_91" ] }, { "title": "(b)", "paragraphs": [ "para_93", "para_94" ] }, { "title": "(d)", "paragraphs": [ "para_96", "para_97" ] }, { "title": "6", "paragraphs": [] }, { "title": "Article 4 of that directive, entitled ‘National law applicable’, provides:", "paragraphs": [ "para_100" ] }, { "title": "(a)", "paragraphs": [ "para_102" ] }, { "title": "(b)", "paragraphs": [ "para_104" ] }, { "title": "(c)", "paragraphs": [ "para_106", "para_107" ] }, { "title": "7", "paragraphs": [ "para_109", "para_110" ] }, { "title": "8", "paragraphs": [] }, { "title": "Article 12 of that directive, entitled ‘Right of access’, provides:", "paragraphs": [ "para_113", "para_114" ] }, { "title": "(b)", "paragraphs": [ "para_116", "para_117" ] }, { "title": "9", "paragraphs": [] }, { "title": "Article 14 of that directive, entitled ‘The data subject’s right to object’, provides:", "paragraphs": [ "para_120" ] }, { "title": "(a)", "paragraphs": [ "para_122", "para_123" ] }, { "title": "10", "paragraphs": [] }, { "title": "Article 24 of Directive 95/46, entitled ‘Sanctions’, provides:", "paragraphs": [ "para_126" ] }, { "title": "11", "paragraphs": [] }, { "title": "Article 28 of that directive, entitled ‘Supervisory authority’, is worded as follows:", "paragraphs": [ "para_129", "para_130" ] }, { "title": "3.   Each authority shall in particular be endowed with:", "paragraphs": [ "para_132", "para_133", "para_134", "para_135", "para_136", "para_137", "para_138", "para_139", "para_140", "para_141", "para_142" ] }, { "title": "Regulation (EU) 2016/679", "paragraphs": [] }, { "title": "12", "paragraphs": [ "para_145" ] }, { "title": "13", "paragraphs": [] }, { "title": "Recitals 1, 4, 9 to 11, 13, 22 to 25 and 65 of that regulation state:", "paragraphs": [ "para_148", "para_149", "para_150" ] }, { "title": "(4)", "paragraphs": [ "para_152", "para_153" ] }, { "title": "(9)", "paragraphs": [ "para_155" ] }, { "title": "(10)", "paragraphs": [ "para_157" ] }, { "title": "(11)", "paragraphs": [ "para_159", "para_160" ] }, { "title": "(13)", "paragraphs": [ "para_162", "para_163" ] }, { "title": "(22)", "paragraphs": [ "para_165" ] }, { "title": "(23)", "paragraphs": [ "para_167" ] }, { "title": "(24)", "paragraphs": [ "para_169" ] }, { "title": "(25)", "paragraphs": [ "para_171", "para_172" ] }, { "title": "(65)", "paragraphs": [ "para_174" ] }, { "title": "14", "paragraphs": [] }, { "title": "Article 3 of Regulation 2016/679, entitled ‘Territorial scope’, is worded as follows:", "paragraphs": [ "para_177", "para_178" ] }, { "title": "(a)", "paragraphs": [ "para_180" ] }, { "title": "(b)", "paragraphs": [ "para_182", "para_183" ] }, { "title": "15", "paragraphs": [ "para_185", "para_186", "para_187" ] }, { "title": "(b)", "paragraphs": [ "para_189" ] }, { "title": "16", "paragraphs": [ "para_191", "para_192" ] }, { "title": "(a)", "paragraphs": [ "para_194" ] }, { "title": "(b)", "paragraphs": [ "para_196" ] }, { "title": "(c)", "paragraphs": [ "para_198" ] }, { "title": "(d)", "paragraphs": [ "para_200" ] }, { "title": "(e)", "paragraphs": [ "para_202" ] }, { "title": "(f)", "paragraphs": [ "para_204", "para_205" ] }, { "title": "3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_208", "para_209" ] }, { "title": "17", "paragraphs": [ "para_211", "para_212" ] }, { "title": "18", "paragraphs": [ "para_214", "para_215" ] }, { "title": "19", "paragraphs": [ "para_217", "para_218", "para_219", "para_220", "para_221", "para_222", "para_223" ] }, { "title": "20", "paragraphs": [] }, { "title": "Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2 thereof:", "paragraphs": [ "para_226", "para_227" ] }, { "title": "(g)", "paragraphs": [ "para_229", "para_230" ] }, { "title": "(i)", "paragraphs": [ "para_232" ] }, { "title": "21", "paragraphs": [ "para_234", "para_235", "para_236", "para_237", "para_238", "para_239", "para_240", "para_241", "para_242", "para_243", "para_244", "para_245", "para_246" ] }, { "title": "22", "paragraphs": [ "para_248", "para_249" ] }, { "title": "23", "paragraphs": [ "para_251", "para_252", "para_253" ] }, { "title": "24", "paragraphs": [ "para_255", "para_256" ] }, { "title": "25", "paragraphs": [ "para_258", "para_259" ] }, { "title": "(a)", "paragraphs": [ "para_261" ] }, { "title": "(b)", "paragraphs": [ "para_263", "para_264" ] }, { "title": "26", "paragraphs": [ "para_266", "para_267" ] }, { "title": "27", "paragraphs": [ "para_269", "para_270", "para_271", "para_272" ] }, { "title": "French law", "paragraphs": [] }, { "title": "28", "paragraphs": [ "para_275" ] }, { "title": "29", "paragraphs": [ "para_277" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "30", "paragraphs": [ "para_280" ] }, { "title": "31", "paragraphs": [ "para_282" ] }, { "title": "32", "paragraphs": [ "para_284" ] }, { "title": "33", "paragraphs": [ "para_286" ] }, { "title": "34", "paragraphs": [ "para_288" ] }, { "title": "35", "paragraphs": [ "para_290" ] }, { "title": "36", "paragraphs": [ "para_292" ] }, { "title": "37", "paragraphs": [ "para_294" ] }, { "title": "38", "paragraphs": [ "para_296" ] }, { "title": "39", "paragraphs": [ "para_298", "para_299", "para_300" ] }, { "title": "(2)", "paragraphs": [ "para_302", "para_303", "para_304" ] }, { "title": "Consideration of the questions referred", "paragraphs": [] }, { "title": "40", "paragraphs": [ "para_307" ] }, { "title": "41", "paragraphs": [ "para_309" ] }, { "title": "42", "paragraphs": [ "para_311" ] }, { "title": "43", "paragraphs": [ "para_313" ] }, { "title": "44", "paragraphs": [ "para_315" ] }, { "title": "45", "paragraphs": [ "para_317" ] }, { "title": "46", "paragraphs": [ "para_319" ] }, { "title": "47", "paragraphs": [ "para_321" ] }, { "title": "48", "paragraphs": [ "para_323" ] }, { "title": "49", "paragraphs": [ "para_325" ] }, { "title": "50", "paragraphs": [ "para_327" ] }, { "title": "51", "paragraphs": [ "para_329" ] }, { "title": "52", "paragraphs": [ "para_331" ] }, { "title": "53", "paragraphs": [ "para_333" ] }, { "title": "54", "paragraphs": [ "para_335" ] }, { "title": "55", "paragraphs": [ "para_337" ] }, { "title": "56", "paragraphs": [ "para_339" ] }, { "title": "57", "paragraphs": [ "para_341" ] }, { "title": "58", "paragraphs": [ "para_343" ] }, { "title": "59", "paragraphs": [ "para_345" ] }, { "title": "60", "paragraphs": [ "para_347" ] }, { "title": "61", "paragraphs": [ "para_349" ] }, { "title": "62", "paragraphs": [ "para_351" ] }, { "title": "63", "paragraphs": [ "para_353" ] }, { "title": "64", "paragraphs": [ "para_355" ] }, { "title": "65", "paragraphs": [ "para_357" ] }, { "title": "66", "paragraphs": [ "para_359" ] }, { "title": "67", "paragraphs": [ "para_361" ] }, { "title": "68", "paragraphs": [ "para_363" ] }, { "title": "69", "paragraphs": [ "para_365" ] }, { "title": "70", "paragraphs": [ "para_367" ] }, { "title": "71", "paragraphs": [ "para_369" ] }, { "title": "72", "paragraphs": [ "para_371" ] }, { "title": "73", "paragraphs": [ "para_373" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "74", "paragraphs": [ "para_376" ] }, { "title": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraphs": [ "para_378", "para_379", "para_380" ] } ], "paragraphs": [ { "text": "62017CJ0507", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraph_id": "para_2" }, { "text": "24 September 2019 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of such data — Directive 95/46/EC — Regulation (EU) 2016/679 — Internet search engines — Processing of data on web pages — Territorial scope of the right to de-referencing)", "paragraph_id": "para_4" }, { "text": "In Case C‑507/17,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 19 July 2017, received at the Court on 21 August 2017, in the proceedings", "paragraph_id": "para_6" }, { "text": "Google LLC , successor in law to Google Inc.,", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "Commission nationale de l’informatique et des libertés (CNIL),", "paragraph_id": "para_9" }, { "text": "in the presence of:", "paragraph_id": "para_10" }, { "text": "Wikimedia Foundation Inc.,", "paragraph_id": "para_11" }, { "text": "Fondation pour la liberté de la presse,", "paragraph_id": "para_12" }, { "text": "Microsoft Corp.,", "paragraph_id": "para_13" }, { "text": "Reporters Committee for Freedom of the Press and Others,", "paragraph_id": "para_14" }, { "text": "Article 19 and Others,", "paragraph_id": "para_15" }, { "text": "Internet Freedom Foundation and Others,", "paragraph_id": "para_16" }, { "text": "Défenseur des droits,", "paragraph_id": "para_17" }, { "text": "THE COURT (Grand Chamber),", "paragraph_id": "para_18" }, { "text": "composed of K. Lenaerts, President, A. Arabadjiev, E. Regan, T. von Danwitz, C. Toader and F. Biltgen, Presidents of Chambers, M. Ilešič (Rapporteur), L. Bay Larsen, M. Safjan, D. Šváby, C.G. Fernlund, C. Vajda and S. Rodin, judges,", "paragraph_id": "para_19" }, { "text": "Advocate General: M. Szpunar,", "paragraph_id": "para_20" }, { "text": "Registrar: V. Giacobbo-Peyronnel, Administrator,", "paragraph_id": "para_21" }, { "text": "having regard to the written procedure and further to the hearing on 11 September 2018,", "paragraph_id": "para_22" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_23" }, { "text": "–", "paragraph_id": "para_24" }, { "text": "Google LLC, by P. Spinosi, Y. Pelosi and W. Maxwell, avocats,", "paragraph_id": "para_25" }, { "text": "–", "paragraph_id": "para_26" }, { "text": "the Commission nationale de l’informatique et des libertés (CNIL), by I. Falque‑Pierrotin, J. Lessi and G. Le Grand, acting as Agents,", "paragraph_id": "para_27" }, { "text": "–", "paragraph_id": "para_28" }, { "text": "Wikimedia Foundation Inc., by C. Rameix‑Seguin, avocate,", "paragraph_id": "para_29" }, { "text": "–", "paragraph_id": "para_30" }, { "text": "the Fondation pour la liberté de la presse, by T. Haas, avocat,", "paragraph_id": "para_31" }, { "text": "–", "paragraph_id": "para_32" }, { "text": "Microsoft Corp., by E. Piwnica, avocat,", "paragraph_id": "para_33" }, { "text": "–", "paragraph_id": "para_34" }, { "text": "the Reporters Committee for Freedom of the Press and Others, by F. Louis, avocat, and by H.-G. Kamann, C. Schwedler and M. Braun, Rechtsanwälte,", "paragraph_id": "para_35" }, { "text": "–", "paragraph_id": "para_36" }, { "text": "Article 19 and Others, by G. Tapie, avocat, G. Facenna QC, and E. Metcalfe, Barrister,", "paragraph_id": "para_37" }, { "text": "–", "paragraph_id": "para_38" }, { "text": "Internet Freedom Foundation and Others, by T. Haas, avocat,", "paragraph_id": "para_39" }, { "text": "–", "paragraph_id": "para_40" }, { "text": "the Défenseur des droits, by J. Toubon, acting as Agent,", "paragraph_id": "para_41" }, { "text": "–", "paragraph_id": "para_42" }, { "text": "the French Government, by D. Colas, R. Coesme, E. de Moustier and S. Ghiandoni, acting as Agents,", "paragraph_id": "para_43" }, { "text": "–", "paragraph_id": "para_44" }, { "text": "Ireland, by M. Browne, G. Hodge, J. Quaney and A. Joyce, acting as Agents, and by M. Gray, Barrister-at-Law,", "paragraph_id": "para_45" }, { "text": "–", "paragraph_id": "para_46" }, { "text": "the Greek Government, by E.-M. Mamouna, G. Papadaki, E. Zisi and S. Papaioannou, acting as Agents,", "paragraph_id": "para_47" }, { "text": "–", "paragraph_id": "para_48" }, { "text": "the Italian Government, by G. Palmieri, acting as Agent, and by R. Guizzi, avvocato dello Stato,", "paragraph_id": "para_49" }, { "text": "–", "paragraph_id": "para_50" }, { "text": "the Austrian Government, by G. Eberhard and G. Kunnert, acting as Agents,", "paragraph_id": "para_51" }, { "text": "–", "paragraph_id": "para_52" }, { "text": "the Polish Government, by B. Majczyna, M. Pawlicka and J. Sawicka, acting as Agents,", "paragraph_id": "para_53" }, { "text": "–", "paragraph_id": "para_54" }, { "text": "the European Commission, by A. Buchet, H. Kranenborg and D. Nardi, acting as Agents,", "paragraph_id": "para_55" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 10 January 2019,", "paragraph_id": "para_56" }, { "text": "gives the following", "paragraph_id": "para_57" }, { "text": "Judgment", "paragraph_id": "para_58" }, { "text": "1", "paragraph_id": "para_59" }, { "text": "This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ).", "paragraph_id": "para_60" }, { "text": "2", "paragraph_id": "para_61" }, { "text": "The request has been made in proceedings between Google LLC, successor in law to Google Inc., and the Commission nationale de l’informatique et des libertés (French Data Protection Authority, France) (‘the CNIL’) concerning a penalty of EUR 100000 imposed by the CNIL on Google because of that company’s refusal, when granting a de-referencing request, to apply it to all its search engine’s domain name extensions.", "paragraph_id": "para_62" }, { "text": "Legal context", "paragraph_id": "para_63" }, { "text": "European Union law", "paragraph_id": "para_64" }, { "text": "Directive 95/46", "paragraph_id": "para_65" }, { "text": "3", "paragraph_id": "para_66" }, { "text": "According to Article 1(1) thereof, the purpose of Directive 95/46 is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to remove obstacles to the free movement of such data.", "paragraph_id": "para_67" }, { "text": "4", "paragraph_id": "para_68" }, { "text": "Recitals 2, 7, 10, 18, 20 and 37 of Directive 95/46 state:", "paragraph_id": "para_69" }, { "text": "‘(2)", "paragraph_id": "para_70" }, { "text": "Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to … the well-being of individuals;", "paragraph_id": "para_71" }, { "text": "…", "paragraph_id": "para_72" }, { "text": "(7)", "paragraph_id": "para_73" }, { "text": "Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level …", "paragraph_id": "para_74" }, { "text": "…", "paragraph_id": "para_75" }, { "text": "(10)", "paragraph_id": "para_76" }, { "text": "Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms[, signed in Rome on 4 N …", "paragraph_id": "para_77" }, { "text": "…", "paragraph_id": "para_78" }, { "text": "(18)", "paragraph_id": "para_79" }, { "text": "Whereas, in order to ensure that individuals are not deprived of the protection to which they are entitled under this Directive, any processing of personal data in the Community must be carried out in accordance with the law of one of the Member States; …", "paragraph_id": "para_80" }, { "text": "…", "paragraph_id": "para_81" }, { "text": "(20)", "paragraph_id": "para_82" }, { "text": "Whereas the fact that the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive; whereas in these cases, the processing should be governed by the law of the Member State in which the means used are located, and there should be guarantees to ensure that the rights and obligations provided for in this Directive are respected in practice;", "paragraph_id": "para_83" }, { "text": "…", "paragraph_id": "para_84" }, { "text": "(37)", "paragraph_id": "para_85" }, { "text": "Whereas the processing of personal data for purposes of journalism or for purposes of literary [or] artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the …", "paragraph_id": "para_86" }, { "text": "5", "paragraph_id": "para_87" }, { "text": "Article 2 of that directive provides:", "paragraph_id": "para_88" }, { "text": "‘For the purposes of this Directive:", "paragraph_id": "para_89" }, { "text": "(a)", "paragraph_id": "para_90" }, { "text": "“personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …", "paragraph_id": "para_91" }, { "text": "(b)", "paragraph_id": "para_92" }, { "text": "“processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;", "paragraph_id": "para_93" }, { "text": "…", "paragraph_id": "para_94" }, { "text": "(d)", "paragraph_id": "para_95" }, { "text": "“controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …", "paragraph_id": "para_96" }, { "text": "…’", "paragraph_id": "para_97" }, { "text": "6", "paragraph_id": "para_98" }, { "text": "Article 4 of that directive, entitled ‘National law applicable’, provides:", "paragraph_id": "para_99" }, { "text": "‘1.   Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:", "paragraph_id": "para_100" }, { "text": "(a)", "paragraph_id": "para_101" }, { "text": "the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;", "paragraph_id": "para_102" }, { "text": "(b)", "paragraph_id": "para_103" }, { "text": "the controller is not established on the Member State’s territory, but in a place where its national law applies by virtue of international public law;", "paragraph_id": "para_104" }, { "text": "(c)", "paragraph_id": "para_105" }, { "text": "the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.", "paragraph_id": "para_106" }, { "text": "2.   In the circumstances referred to in paragraph 1(c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.’", "paragraph_id": "para_107" }, { "text": "7", "paragraph_id": "para_108" }, { "text": "Article 9 of Directive 95/46, entitled ‘Processing of personal data and freedom of expression’, states:", "paragraph_id": "para_109" }, { "text": "‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’", "paragraph_id": "para_110" }, { "text": "8", "paragraph_id": "para_111" }, { "text": "Article 12 of that directive, entitled ‘Right of access’, provides:", "paragraph_id": "para_112" }, { "text": "‘Member States shall guarantee every data subject the right to obtain from the controller:", "paragraph_id": "para_113" }, { "text": "…", "paragraph_id": "para_114" }, { "text": "(b)", "paragraph_id": "para_115" }, { "text": "as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;", "paragraph_id": "para_116" }, { "text": "…’", "paragraph_id": "para_117" }, { "text": "9", "paragraph_id": "para_118" }, { "text": "Article 14 of that directive, entitled ‘The data subject’s right to object’, provides:", "paragraph_id": "para_119" }, { "text": "‘Member States shall grant the data subject the right:", "paragraph_id": "para_120" }, { "text": "(a)", "paragraph_id": "para_121" }, { "text": "at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;", "paragraph_id": "para_122" }, { "text": "…’", "paragraph_id": "para_123" }, { "text": "10", "paragraph_id": "para_124" }, { "text": "Article 24 of Directive 95/46, entitled ‘Sanctions’, provides:", "paragraph_id": "para_125" }, { "text": "‘The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.’", "paragraph_id": "para_126" }, { "text": "11", "paragraph_id": "para_127" }, { "text": "Article 28 of that directive, entitled ‘Supervisory authority’, is worded as follows:", "paragraph_id": "para_128" }, { "text": "‘1.   Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.", "paragraph_id": "para_129" }, { "text": "…", "paragraph_id": "para_130" }, { "text": "3.   Each authority shall in particular be endowed with:", "paragraph_id": "para_131" }, { "text": "–", "paragraph_id": "para_132" }, { "text": "investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,", "paragraph_id": "para_133" }, { "text": "–", "paragraph_id": "para_134" }, { "text": "effective powers of intervention, such as, for example, that of … ordering the blocking, erasure or destruction of data, [or] of imposing a temporary or definitive ban on processing …", "paragraph_id": "para_135" }, { "text": "…", "paragraph_id": "para_136" }, { "text": "Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.", "paragraph_id": "para_137" }, { "text": "4.   Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.", "paragraph_id": "para_138" }, { "text": "…", "paragraph_id": "para_139" }, { "text": "6.   Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.", "paragraph_id": "para_140" }, { "text": "The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.", "paragraph_id": "para_141" }, { "text": "…’", "paragraph_id": "para_142" }, { "text": "Regulation (EU) 2016/679", "paragraph_id": "para_143" }, { "text": "12", "paragraph_id": "para_144" }, { "text": "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 , and …", "paragraph_id": "para_145" }, { "text": "13", "paragraph_id": "para_146" }, { "text": "Recitals 1, 4, 9 to 11, 13, 22 to 25 and 65 of that regulation state:", "paragraph_id": "para_147" }, { "text": "‘(1)", "paragraph_id": "para_148" }, { "text": "The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (“the Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.", "paragraph_id": "para_149" }, { "text": "…", "paragraph_id": "para_150" }, { "text": "(4)", "paragraph_id": "para_151" }, { "text": "The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …", "paragraph_id": "para_152" }, { "text": "…", "paragraph_id": "para_153" }, { "text": "(9)", "paragraph_id": "para_154" }, { "text": "… Directive 95/46 … has not prevented fragmentation in the implementation of data protection across the Union … Differences in the level of protection … in the Member States may prevent the free flow of personal data throughout the Union. Those differences may therefore constitute an obstacle to the pursuit of economic activities at the level of the Union …", "paragraph_id": "para_155" }, { "text": "(10)", "paragraph_id": "para_156" }, { "text": "In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. …", "paragraph_id": "para_157" }, { "text": "(11)", "paragraph_id": "para_158" }, { "text": "Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.", "paragraph_id": "para_159" }, { "text": "…", "paragraph_id": "para_160" }, { "text": "(13)", "paragraph_id": "para_161" }, { "text": "In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, … and to prov …", "paragraph_id": "para_162" }, { "text": "…", "paragraph_id": "para_163" }, { "text": "(22)", "paragraph_id": "para_164" }, { "text": "Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. …", "paragraph_id": "para_165" }, { "text": "(23)", "paragraph_id": "para_166" }, { "text": "In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where th …", "paragraph_id": "para_167" }, { "text": "(24)", "paragraph_id": "para_168" }, { "text": "The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Un …", "paragraph_id": "para_169" }, { "text": "(25)", "paragraph_id": "para_170" }, { "text": "Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State’s diplomatic mission or consular post.", "paragraph_id": "para_171" }, { "text": "…", "paragraph_id": "para_172" }, { "text": "(65)", "paragraph_id": "para_173" }, { "text": "A data subject should have … a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’", "paragraph_id": "para_174" }, { "text": "14", "paragraph_id": "para_175" }, { "text": "Article 3 of Regulation 2016/679, entitled ‘Territorial scope’, is worded as follows:", "paragraph_id": "para_176" }, { "text": "‘1.   This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.", "paragraph_id": "para_177" }, { "text": "2.   This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:", "paragraph_id": "para_178" }, { "text": "(a)", "paragraph_id": "para_179" }, { "text": "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or", "paragraph_id": "para_180" }, { "text": "(b)", "paragraph_id": "para_181" }, { "text": "the monitoring of their behaviour as far as their behaviour takes place within the Union.", "paragraph_id": "para_182" }, { "text": "3.   This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.’", "paragraph_id": "para_183" }, { "text": "15", "paragraph_id": "para_184" }, { "text": "Article 4(23) of that regulation defines the concept of ‘cross-border processing’ as follows:", "paragraph_id": "para_185" }, { "text": "‘(a)", "paragraph_id": "para_186" }, { "text": "processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or", "paragraph_id": "para_187" }, { "text": "(b)", "paragraph_id": "para_188" }, { "text": "processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State’.", "paragraph_id": "para_189" }, { "text": "16", "paragraph_id": "para_190" }, { "text": "Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:", "paragraph_id": "para_191" }, { "text": "‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:", "paragraph_id": "para_192" }, { "text": "(a)", "paragraph_id": "para_193" }, { "text": "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;", "paragraph_id": "para_194" }, { "text": "(b)", "paragraph_id": "para_195" }, { "text": "the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;", "paragraph_id": "para_196" }, { "text": "(c)", "paragraph_id": "para_197" }, { "text": "the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);", "paragraph_id": "para_198" }, { "text": "(d)", "paragraph_id": "para_199" }, { "text": "the personal data have been unlawfully processed;", "paragraph_id": "para_200" }, { "text": "(e)", "paragraph_id": "para_201" }, { "text": "the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;", "paragraph_id": "para_202" }, { "text": "(f)", "paragraph_id": "para_203" }, { "text": "the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).", "paragraph_id": "para_204" }, { "text": "…", "paragraph_id": "para_205" }, { "text": "3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:", "paragraph_id": "para_206" }, { "text": "(a)", "paragraph_id": "para_207" }, { "text": "for exercising the right of freedom of expression and information;", "paragraph_id": "para_208" }, { "text": "…’", "paragraph_id": "para_209" }, { "text": "17", "paragraph_id": "para_210" }, { "text": "Article 21 of that regulation, entitled ‘Right to object’, provides, in paragraph 1 thereof:", "paragraph_id": "para_211" }, { "text": "‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer …", "paragraph_id": "para_212" }, { "text": "18", "paragraph_id": "para_213" }, { "text": "Article 55 of Regulation 2016/679, entitled ‘Competence’, which forms part of Chapter VI of that regulation, itself entitled ‘Independent supervisory authorities’, provides, in paragraph 1 thereof:", "paragraph_id": "para_214" }, { "text": "‘Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.’", "paragraph_id": "para_215" }, { "text": "19", "paragraph_id": "para_216" }, { "text": "Article 56 of that regulation, entitled ‘Competence of the lead supervisory authority’, states:", "paragraph_id": "para_217" }, { "text": "‘1.   Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.", "paragraph_id": "para_218" }, { "text": "2.   By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.", "paragraph_id": "para_219" }, { "text": "3.   In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in …", "paragraph_id": "para_220" }, { "text": "4.   Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).", "paragraph_id": "para_221" }, { "text": "5.   Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.", "paragraph_id": "para_222" }, { "text": "6.   The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.’", "paragraph_id": "para_223" }, { "text": "20", "paragraph_id": "para_224" }, { "text": "Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2 thereof:", "paragraph_id": "para_225" }, { "text": "‘Each supervisory authority shall have all of the following corrective powers:", "paragraph_id": "para_226" }, { "text": "…", "paragraph_id": "para_227" }, { "text": "(g)", "paragraph_id": "para_228" }, { "text": "to order the … erasure of personal data … pursuant to … [Article] … 17 …;", "paragraph_id": "para_229" }, { "text": "…", "paragraph_id": "para_230" }, { "text": "(i)", "paragraph_id": "para_231" }, { "text": "to impose an administrative fine … in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.’", "paragraph_id": "para_232" }, { "text": "21", "paragraph_id": "para_233" }, { "text": "Under Chapter VII of Regulation 2016/679, entitled ‘Cooperation and consistency’, Section I, entitled ‘Cooperation’, includes Articles 60 to 62 of that regulation. Article 60, entitled ‘Cooperation between the lead supervisory authority and the other supervisory authorities concerned’, provides:", "paragraph_id": "para_234" }, { "text": "‘1.   The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.", "paragraph_id": "para_235" }, { "text": "2.   The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.", "paragraph_id": "para_236" }, { "text": "3.   The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.", "paragraph_id": "para_237" }, { "text": "4.   Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.", "paragraph_id": "para_238" }, { "text": "5.   Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.", "paragraph_id": "para_239" }, { "text": "6.   Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.", "paragraph_id": "para_240" }, { "text": "7.   The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.", "paragraph_id": "para_241" }, { "text": "8.   By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.", "paragraph_id": "para_242" }, { "text": "9.   Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. …", "paragraph_id": "para_243" }, { "text": "10.   After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. Th …", "paragraph_id": "para_244" }, { "text": "11.   Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.", "paragraph_id": "para_245" }, { "text": "…’", "paragraph_id": "para_246" }, { "text": "22", "paragraph_id": "para_247" }, { "text": "Article 61 of that regulation, entitled ‘Mutual assistance’, states, in paragraph 1 thereof:", "paragraph_id": "para_248" }, { "text": "‘Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.’", "paragraph_id": "para_249" }, { "text": "23", "paragraph_id": "para_250" }, { "text": "Article 62 of that regulation, entitled ‘Joint operations of supervisory authorities’, provides:", "paragraph_id": "para_251" }, { "text": "‘1.   The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.", "paragraph_id": "para_252" }, { "text": "2.   Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. …’", "paragraph_id": "para_253" }, { "text": "24", "paragraph_id": "para_254" }, { "text": "Section 2, entitled ‘Consistency’, of Chapter VII of Regulation 2016/679 includes Articles 63 to 67 of that regulation. Article 63, entitled ‘Consistency mechanism’, is worded as follows:", "paragraph_id": "para_255" }, { "text": "‘In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.’", "paragraph_id": "para_256" }, { "text": "25", "paragraph_id": "para_257" }, { "text": "Article 65 of that regulation, entitled ‘Dispute resolution by the Board’, provides, in paragraph 1 thereof:", "paragraph_id": "para_258" }, { "text": "‘In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:", "paragraph_id": "para_259" }, { "text": "(a)", "paragraph_id": "para_260" }, { "text": "where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevan …", "paragraph_id": "para_261" }, { "text": "(b)", "paragraph_id": "para_262" }, { "text": "where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;", "paragraph_id": "para_263" }, { "text": "…’", "paragraph_id": "para_264" }, { "text": "26", "paragraph_id": "para_265" }, { "text": "Article 66 of that regulation, entitled ‘Urgency procedure’, provides, in paragraph 1 thereof:", "paragraph_id": "para_266" }, { "text": "‘In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referr …", "paragraph_id": "para_267" }, { "text": "27", "paragraph_id": "para_268" }, { "text": "Article 85 of Regulation 2016/679, entitled ‘Processing and freedom of expression and information’, states:", "paragraph_id": "para_269" }, { "text": "‘1.   Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.", "paragraph_id": "para_270" }, { "text": "2.   For processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (t …", "paragraph_id": "para_271" }, { "text": "…’", "paragraph_id": "para_272" }, { "text": "French law", "paragraph_id": "para_273" }, { "text": "28", "paragraph_id": "para_274" }, { "text": "Directive 95/46 is implemented in French law by loi n o  78-17, du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 of 6 January 1978 on information technology, data files and civil liberties), in the version applicable to the events in the main proceedings (‘the Law of 6 January 1978’).", "paragraph_id": "para_275" }, { "text": "29", "paragraph_id": "para_276" }, { "text": "Article 45 of that law specifies that where the controller fails to fulfil the obligations laid down in that law, the President of the CNIL may serve notice on him to bring the established infringement to an end within a period which the President is to determine. If the controller does not comply with the formal notice served on him, the Select Panel of the CNIL may, after hearing both parties, impose, inter alia, a financial penalty.", "paragraph_id": "para_277" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_278" }, { "text": "30", "paragraph_id": "para_279" }, { "text": "By decision of 21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, it must apply that removal to all its search engine’s domain name extensions.", "paragraph_id": "para_280" }, { "text": "31", "paragraph_id": "para_281" }, { "text": "Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States.", "paragraph_id": "para_282" }, { "text": "32", "paragraph_id": "para_283" }, { "text": "The CNIL also regarded as insufficient Google’s further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject’s name, no matter which version of the search engine they used.", "paragraph_id": "para_284" }, { "text": "33", "paragraph_id": "para_285" }, { "text": "By an adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of EUR 100000, which was made public.", "paragraph_id": "para_286" }, { "text": "34", "paragraph_id": "para_287" }, { "text": "By application lodged with the Conseil d’État (Council of State, France), Google seeks annulment of that adjudication.", "paragraph_id": "para_288" }, { "text": "35", "paragraph_id": "para_289" }, { "text": "The Conseil d’État notes that the processing of personal data carried out by the search engine operated by Google falls within the scope of the Law of 6 January 1978, in view of the activities of promoting and selling advertising space carried on in France by its subsidiary Google France.", "paragraph_id": "para_290" }, { "text": "36", "paragraph_id": "para_291" }, { "text": "The Conseil d’État also notes that the search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries …", "paragraph_id": "para_292" }, { "text": "37", "paragraph_id": "para_293" }, { "text": "The Conseil d’État considers that, having regard, first, to the fact that Google’s search engine domain names can all be accessed from French territory and, secondly, to the existence of gateways between those various domain names, as illustrated in particular by the automatic redirection mentioned …", "paragraph_id": "para_294" }, { "text": "38", "paragraph_id": "para_295" }, { "text": "Before the Conseil d’État, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of 6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in its ju …", "paragraph_id": "para_296" }, { "text": "39", "paragraph_id": "para_297" }, { "text": "Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Conseil d’État has decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_298" }, { "text": "‘(1)", "paragraph_id": "para_299" }, { "text": "Must the “right to de-referencing”, as established by the [Court] in its judgment of 13 May 2014, [Google Spain and Google ( C‑131/12 , EU:C:2014:317 ),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted a …", "paragraph_id": "para_300" }, { "text": "(2)", "paragraph_id": "para_301" }, { "text": "In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue …", "paragraph_id": "para_302" }, { "text": "3.", "paragraph_id": "para_303" }, { "text": "Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at iss …", "paragraph_id": "para_304" }, { "text": "Consideration of the questions referred", "paragraph_id": "para_305" }, { "text": "40", "paragraph_id": "para_306" }, { "text": "The case in the main proceedings is the result of a dispute between Google and the CNIL as to how a search engine operator, where it establishes that a data subject is entitled to have one or more links to web pages containing personal data concerning him or her removed from the list of results whic …", "paragraph_id": "para_307" }, { "text": "41", "paragraph_id": "para_308" }, { "text": "The Court will examine the questions referred in the light of both that directive and that regulation in order to ensure that its answers will be of use to the referring court in any event.", "paragraph_id": "para_309" }, { "text": "42", "paragraph_id": "para_310" }, { "text": "During the proceedings before the Court, Google explained that, following the bringing of the request for a preliminary ruling, it has implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national vers …", "paragraph_id": "para_311" }, { "text": "43", "paragraph_id": "para_312" }, { "text": "In those circumstances, the questions referred, which must be dealt with together, should be understood as seeking to ascertain, in essence, whether Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679 are to be interpret …", "paragraph_id": "para_313" }, { "text": "44", "paragraph_id": "para_314" }, { "text": "As a preliminary point, it should be borne in mind that the Court has held that Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the cond …", "paragraph_id": "para_315" }, { "text": "45", "paragraph_id": "para_316" }, { "text": "The Court has also stated that, when appraising the conditions for the application of those same provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him or her personally should, at that point in time, no longer be linked to …", "paragraph_id": "para_317" }, { "text": "46", "paragraph_id": "para_318" }, { "text": "In the context of Regulation 2016/679, that right of a data subject to de-referencing is now based on Article 17 of that regulation, which specifically governs the ‘right to erasure’, also referred to, in the heading of that article, as the ‘right to be forgotten’.", "paragraph_id": "para_319" }, { "text": "47", "paragraph_id": "para_320" }, { "text": "Pursuant to Article 17(1) of Regulation 2016/679, a data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase personal data without undue delay where one of the grounds listed in that …", "paragraph_id": "para_321" }, { "text": "48", "paragraph_id": "para_322" }, { "text": "It follows from Article 4(1)(a) of Directive 95/46 and Article 3(1) of Regulation 2016/679 that both that directive and that regulation permit data subjects to assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not.", "paragraph_id": "para_323" }, { "text": "49", "paragraph_id": "para_324" }, { "text": "In that regard, the Court has held that the processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to …", "paragraph_id": "para_325" }, { "text": "50", "paragraph_id": "para_326" }, { "text": "In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Union are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that …", "paragraph_id": "para_327" }, { "text": "51", "paragraph_id": "para_328" }, { "text": "That being so, the fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establi …", "paragraph_id": "para_329" }, { "text": "52", "paragraph_id": "para_330" }, { "text": "In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the pur …", "paragraph_id": "para_331" }, { "text": "53", "paragraph_id": "para_332" }, { "text": "By its questions, the referring court seeks to determine the territorial scope which must be conferred on a de-referencing in such a situation.", "paragraph_id": "para_333" }, { "text": "54", "paragraph_id": "para_334" }, { "text": "In that regard, it is apparent from recital 10 of Directive 95/46 and recitals 10, 11 and 13 of Regulation 2016/679, which was adopted on the basis of Article 16 TFEU, that the objective of that directive and that regulation is to guarantee a high level of protection of personal data throughout the European Union.", "paragraph_id": "para_335" }, { "text": "55", "paragraph_id": "para_336" }, { "text": "It is true that a de-referencing carried out on all the versions of a search engine would meet that objective in full.", "paragraph_id": "para_337" }, { "text": "56", "paragraph_id": "para_338" }, { "text": "The internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual’s name ubiquitous (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C‑131/12 , EU:C:2014:317 , paragraph  80 , and of 17 October 2017, Bolagsupplysningen and Ilsjan, C‑194/16 , EU:C:2017:766 , paragraph  48 ).", "paragraph_id": "para_339" }, { "text": "57", "paragraph_id": "para_340" }, { "text": "In a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.", "paragraph_id": "para_341" }, { "text": "58", "paragraph_id": "para_342" }, { "text": "Such considerations are such as to justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.", "paragraph_id": "para_343" }, { "text": "59", "paragraph_id": "para_344" }, { "text": "That being said, it should be emphasised that numerous third States do not recognise the right to de-referencing or have a different approach to that right.", "paragraph_id": "para_345" }, { "text": "60", "paragraph_id": "para_346" }, { "text": "Moreover, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect, judgment of 9 November 2010, Volk …", "paragraph_id": "para_347" }, { "text": "61", "paragraph_id": "para_348" }, { "text": "While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679, struck a balance between that right and that freedom so far as the Union is concerned (see, to that effect, today’s judgment, GC and Others\n (De-referencing of sensitive data) , C‑136/17, paragraph 59), it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.", "paragraph_id": "para_349" }, { "text": "62", "paragraph_id": "para_350" }, { "text": "In particular, it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in paragraph 54 above …", "paragraph_id": "para_351" }, { "text": "63", "paragraph_id": "para_352" }, { "text": "Moreover, although Regulation 2016/679 provides the supervisory authorities of the Member States, in Articles 56 and 60 to 66 thereof, with the instruments and mechanisms enabling them, where appropriate, to cooperate in order to come to a joint decision based on weighing a data subject’s right to p …", "paragraph_id": "para_353" }, { "text": "64", "paragraph_id": "para_354" }, { "text": "It follows that, currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.", "paragraph_id": "para_355" }, { "text": "65", "paragraph_id": "para_356" }, { "text": "Having regard to all of the foregoing, a search engine operator cannot be required, under Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, to carry out a de-referencing on all the versions of its search engine.", "paragraph_id": "para_357" }, { "text": "66", "paragraph_id": "para_358" }, { "text": "Regarding the question whether such a de-referencing is to be carried out on the versions of the search engine corresponding to the Member States or only on the version of that search engine corresponding to the Member State of residence of the person benefiting from the de-referencing, it follows f …", "paragraph_id": "para_359" }, { "text": "67", "paragraph_id": "para_360" }, { "text": "However, it should be pointed out that the interest of the public in accessing information may, even within the Union, vary from one Member State to another, meaning that the result of weighing up that interest, on the one hand, and a data subject’s rights to privacy and the protection of personal d …", "paragraph_id": "para_361" }, { "text": "68", "paragraph_id": "para_362" }, { "text": "It follows from, inter alia, Articles 56 and 60 of Regulation 2016/679 that, for cross-border processing as defined in Article 4(23) of that regulation, and subject to Article 56(2) thereof, the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid …", "paragraph_id": "para_363" }, { "text": "69", "paragraph_id": "para_364" }, { "text": "That regulatory framework thus provides the national supervisory authorities with the instruments and mechanisms necessary to reconcile a data subject’s rights to privacy and the protection of personal data with the interest of the whole public throughout the Member States in accessing the informati …", "paragraph_id": "para_365" }, { "text": "70", "paragraph_id": "para_366" }, { "text": "In addition, it is for the search engine operator to take, if necessary, sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. Those measures must themselves meet all the legal requirements and have the effect of preventing or, at the very least …", "paragraph_id": "para_367" }, { "text": "71", "paragraph_id": "para_368" }, { "text": "It is for the referring court to ascertain whether, also having regard to the recent changes made to its search engine as set out in paragraph 42 above, the measures adopted or proposed by Google meet those requirements.", "paragraph_id": "para_369" }, { "text": "72", "paragraph_id": "para_370" }, { "text": "Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Membe …", "paragraph_id": "para_371" }, { "text": "73", "paragraph_id": "para_372" }, { "text": "In the light of all of the foregoing, the answer to the questions referred is that, on a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, where a search engine operator grants a request for de- …", "paragraph_id": "para_373" }, { "text": "Costs", "paragraph_id": "para_374" }, { "text": "74", "paragraph_id": "para_375" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_376" }, { "text": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraph_id": "para_377" }, { "text": "On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such …", "paragraph_id": "para_378" }, { "text": "[Signatures]", "paragraph_id": "para_379" }, { "text": "(\n *1\n ) Language of the case: French.", "paragraph_id": "para_380" } ], "word_count": 10282, "cites": [ "C-131/12", "C-194/16", "C-92/09", "C-93/09", "C-136/17", "C-314/12", "C-484/14", "C-617/10", "C-399/11" ], "cited_by": [], "sha256": "cab28a8ee30a3906ae35cc7c0f7582601ccbe2d599fa325f4d2244cb1378c331", "source_url": "https://publications.europa.eu/resource/celex/62017CJ0507.ENG.xhtml.ECR_62017CJ0507_EN_01.html", "fetched_at": "2026-10-02T21:43:57.153+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-507-17", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-507-17", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-507-17", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-507-17" }, "hash": "sha256:ae7c97e0256fe80817ace5f202d4470c43489e2bb3bba717a99bdcb58a614994", "version": "legal-2026-10-13", "expires": "2026-10-14T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-13+legal-2026-10-13+2026-10-13T12:55:18", "content_hash": "sha256:ae7c97e0256fe80817ace5f202d4470c43489e2bb3bba717a99bdcb58a614994", "revalidate_after": "2026-10-13T14:25:13.507Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-507-17", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-507-17" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-507-17" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-507-17" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "access_class": "public", "access_view": "public" }