Introduction
During the fall of 2019, the European Court of Justice (hereinafter the ECJ or the Court) delivered judgments in two cases addressing the responsibility of internet platform companies for the personal information they control. In Google LLC v. Commission Nationale de l'Informatique et des Libertés (CNIL),Footnote 1 the ECJ considered the geographic scope of its notable recent jurisprudence on the obligations of search engines to implement the “right to be forgotten” set forth in European Union (EU) data protection law.Footnote 2 In Eva Glawischnig-Piesczek v. Facebook Ireland Limited,Footnote 3 the Court examined whether Facebook was obliged under EU law to remove information available on the social network that previously had been found under Austrian law to defame an Austrian politician.
Google LLC v. Commission Nationale de l'Informatique et des Libertes (CNIL)
Background
In 2014, the ECJ's Google Spain judgment had held that a search engine must block results relating to an individual that, as a result of the passage of time, were no longer relevant or were excessive in relation to the purposes for which they had initially been collected.Footnote 4 The judgment did not specify the geographic scope of the search engine's obligation. Since the individual in question was a Spanish national who had complained of results yielded by a search made on Google's Spanish domain, Google initially decided to limit the removal of information to that particular domain. Subsequently, the company broadened its policy to block links to the offending personal information appearing as well on all of its national domains within the European Union.
In 2016, the French national data protection authority (CNIL) decided that a search engine, in response to a valid request for deletion, must remove relevant search results from all of its domains worldwide, lest individuals be able to obtain the blocked results, in circumvention of EU rules, by performing the same search on a domain outside the EU. Google refused to comply with the CNIL ruling and appealed to France's Conseil d'Etat (Council of State), its highest administrative court. The Conseil d'Etat in turn referred the question of the geographic scope of the right to be forgotten to the European Court of Justice.
The ECJ Judgment
The Court of JusticeFootnote 5 first observed that the right to protection of personal data under EU law is a relative right that must be balanced against other fundamental rights, such as the right to information.Footnote 6 It added, crucially, that this balance “is likely to vary significantly around the world.”Footnote 7 The Court then noted that the EU legislation establishing the right to be forgotten, the General Data Protection Regulation (GDPR), does not affirmatively extend the application of this right outside the territory of the European Union.Footnote 8 Consequently, the Court found no obligation under EU law for a search engine to remove results from domains located outside the Union.Footnote 9
The ECJ next turned to the application of the right to be forgotten within the European Union itself. Since an EU regulation such as the GDPR applies directly in all Member States, search engines are obliged to de-reference results that violate the right to be forgotten on all their EU country domains.Footnote 10 However, the Court acknowledged that the precise balance between the right to be forgotten and the right to information may vary even among Member States, since EU law allows them to maintain their own legislation on press and artistic freedoms. In right to be forgotten cases where the proper balance is disputed among EU Member States, their national data protection authorities should consult to resolve the difference.Footnote 11
Conclusions
The Google v. CNIL judgment reflects a careful recalibration by the Court of its bold and widely noted right to be forgotten jurisprudence. On the one hand, the ECJ expands upon Google Spain by affirmatively establishing that a valid request for deletion must result in removal of the result from searches performed on all the search engine's EU domains, and not just the one where the individual is located.Footnote 12
On the other hand, the Court shied away from asserting global reach for de-referencing decisions made under EU law. Such a sweeping assertion of extraterritorial effect could have triggered objection from countries such as the United States with robust freedom of information constitutional jurisprudence. Doing so also could have led to other countries, including authoritarian nations, demanding global application of their own national de-referencing decisions.Footnote 13 As a result, search engines could have faced complex conflict of laws situations. While EU law is often criticized for its extraterritorial ambition, in this instance the ECJ clearly opted to avoid the risk of international conflict over a subject touching upon national constitutional traditions.
Glawischnig-Piesczek v. Facebook Ireland Limited
Background
Ewa Glawischnig-Piesczek, a leading Austrian political figure, brought suit in Austrian court seeking to compel Facebook to remove content harmful to her reputation from the social network. A Facebook user had shared on his personal page an article from an Austrian online news magazine and related user commentary critical of Glawischnig-Piesczek, which separately had been found to defame the politician. The Austrian court ordered Facebook temporarily to cease and desist from publishing the content, pending a judicial determination on whether a permanent injunction was appropriate. On appeal, the Austrian Supreme Court referred to the European Court of Justice several questions regarding the effect of EU law on the Austrian proceeding.
The EU's Directive on Electronic Commerce (hereafter the e-Commerce Directive)Footnote 14 contains several pertinent provisions. Article 14(1) provides an internet platform such as Facebook with a safe harbor from liability for the information it stores at the request of a user, provided it acts expeditiously to remove or disable information found to be illegal.Footnote 15 Article 14(3) clarifies that this immunity does not limit the ability of Member State courts to order service providers to remove or disable access to information. However, Article 15(1) of the e-Commerce Directive precludes Member States, in implementing Article 14, from imposing on an internet platform a general obligation to monitor the information it transmits or stores, or proactively to determine whether the information may be illegal.
The ECJ Judgment
The ECJ's Third Chamber first upheld the authority of the Austrian court to order Facebook to block access to information stored on its platform which is identical to information previously adjudicated as illegal, finding the imposition of such a measure to be squarely within the bounds of Articles 14(1) and (3) of the e-Commerce Directive.Footnote 16 It further held that limiting removal orders to identical content would not be fully effective, because it would leave the door open for social network users to disseminate paraphrased versions of illegal information. The court consequently agreed that the Austrian court could extend the scope of the injunction to equivalent content.Footnote 17
The court had greater difficulty, however, in reconciling its holding under Article 14 that a Member State court may properly order a social network to identify and remove equivalent defamatory content with Article 15's bar on imposing upon it a general obligation to monitor content. In order to identify equivalent information without offending the general monitoring prohibition, the ECJ suggested that social networks use automated search tools focusing on the name of the defamed person and the particular circumstances of the infringement, but avoid conducting an “independent assessment” of that content.Footnote 18
Finally, the ECJ examined whether the e-Commerce Directive limited the geographic scope of the Austrian injunction against Facebook. Article 18 directs Member States to ensure that their national laws enable the rapid issuance of interim measures to terminate infringements.Footnote 19 Although this provision of EU law does not expressly address territorial effect, the Court observed that it contained no limitation on the geographic reach of Member State judicial measures. Consequently, EU law did not preclude a Member State from issuing an injunction with worldwide effect.Footnote 20
Conclusions
In its Glawischnig-Piesczek judgment, the ECJ clarifies that the e-Commerce Directive is not an obstacle to Member States’ efforts, in an era of rapid dispersion of information via social networks, to apply their defamation laws effectively. However, the Court's repeated assertions that case-specific injunctions issued against social networks do not require them to undertake general content moderation may understate the difficulty that companies such as Facebook now face in removing not just information identical to previously sanctioned defamatory content, but also information that conveys the same defamatory message in varying language.
There is a striking contrast between the ECJ's endorsement in Glawischnig-Piesczek of the worldwide effect of an injunction against a social network disseminating defamatory content and its holding in Google v. CNIL that the GDPR does not require a search engine to apply a right to be forgotten de-referencing decision on a global basis. In the former, the Court was content to interpret the e-Commerce Directive's silence on the proper territorial scope of Member State injunctions as an empowerment for them to apply worldwide. In the latter, the ECJ viewed the GDPR's silence on the geographic reach of a de-referencing decision as not requiring its global application.
Differences between the two cases in the state of the governing law may account for the variance in textual interpretation. The injunction issued in Glawischnig-Piesczek is a well-established means of combatting illegal activity such as defamation. By contrast, a de-referencing decision implemented by a search engine, as in Google v. CNIL, concerns the quite new right to be forgotten. Moreover, de-referencing removes personal information that is not illegal, but rather is deemed no longer relevant or necessary. Limiting the ability of individuals located outside the EU to access, via search requests, information that may not be illegal under locally applicable law appears to have been a bridge too far for the Court.
Both cases illustrate the growing effect that EU information and privacy law is having on the operations of internet companies such as Google and Facebook, not only in Europe but also globally. Platform companies likely will have to contend for years with a rising tide of content removal and content moderation questions arising under EU law and related Member State law, as well as under other jurisdictions’ laws.
Reports of Cases
JUDGMENT OF THE COURT (Grand Chamber)
24 September 2019Footnote **
(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of such data — Directive 95/46/EC — Regulation (EU) 2016/679 — Internet search engines — Processing of data on web pages — Territorial scope of the right to de-referencing)
In Case C-507/17,
REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 19 July 2017, received at the Court on 21 August 2017, in the proceedings
Google LLC, successor in law to Google Inc.,
v
Commission nationale de l'informatique et des libertés (CNIL),
in the presence of:
Wikimedia Foundation Inc.,
Fondation pour la liberté de la presse, Microsoft Corp.,
Reporters Committee for Freedom of the Press and Others, Article 19 and Others,
Internet Freedom Foundation and Others, Défenseur des droits,
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, A. Arabadjiev, E. Regan, T. von Danwitz, C. Toader and F. Biltgen, Presidents of Chambers, M. Ilešič (Rapporteur), L. Bay Larsen, M. Safjan, D. Šváby, C.G. Fernlund, C. Vajda and S. Rodin, judges,
Advocate General: M. Szpunar,
Registrar: V. Giacobbo-Peyronnel, Administrator,
having regard to the written procedure and further to the hearing on 11 September 2018, after considering the observations submitted on behalf of:
- Google LLC, by P. Spinosi, Y. Pelosi and W. Maxwell, avocats,
- the Commission nationale de l'informatique et des libertés (CNIL), by I. Falque-Pierrotin, J. Lessi and G. Le Grand, acting as Agents,
- Wikimedia Foundation Inc., by C. Rameix-Seguin, avocate,
- the Fondation pour la liberté de la presse, by T. Haas, avocat,
- Microsoft Corp., by E. Piwnica, avocat,
- the Reporters Committee for Freedom of the Press and Others, by F. Louis, avocat, and by H.-G. Kamann, C. Schwedler and M. Braun, Rechtsanwälte,
- Article 19 and Others, by G. Tapie, avocat, G. Facenna QC, and E. Metcalfe, Barrister,
- Internet Freedom Foundation and Others, by T. Haas, avocat,
- the Défenseur des droits, by J. Toubon, acting as Agent,
- the French Government, by D. Colas, R. Coesme, E. de Moustier and S. Ghiandoni, acting as Agents,
- Ireland, by M. Browne, G. Hodge, J. Quaney and A. Joyce, acting as Agents, and by M. Gray, Barrister-at-Law,
- the Greek Government, by E.-M. Mamouna, G. Papadaki, E. Zisi and S. Papaioannou, acting as Agents,
- the Italian Government, by G. Palmieri, acting as Agent, and by R. Guizzi, avvocato dello Stato,
- the Austrian Government, by G. Eberhard and G. Kunnert, acting as Agents,
- the Polish Government, by B. Majczyna, M. Pawlicka and J. Sawicka, acting as Agents,
- the European Commission, by A. Buchet, H. Kranenborg and D. Nardi, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 10 January 2019,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
2 The request has been made in proceedings between Google LLC, successor in law to Google Inc., and the Commission nationale de l'informatique et des libertés (French Data Protection Authority, France) (‘the CNIL’) concerning a penalty of EUR 100 000 imposed by the CNIL on Google because of that company's refusal, when granting a de-referencing request, to apply it to all its search engine's domain name extensions.
Legal context
European Union law
Directive 95/46
3 According to Article 1(1) thereof, the purpose of Directive 95/46 is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to remove obstacles to the free movement of such data.
4 Recitals 2, 7, 10, 18, 20 and 37 of Directive 95/46 state:
‘(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to … the well-being of individuals;
…
(7) Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level …
…
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [, signed in Rome on 4 November 1950,] and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
…
(18) Whereas, in order to ensure that individuals are not deprived of the protection to which they are entitled under this Directive, any processing of personal data in the Community must be carried out in accordance with the law of one of the Member States; …
…
(20) Whereas the fact that the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive; whereas in these cases, the processing should be governed by the law of the Member State in which the means used are located, and there should be guarantees to ensure that the rights and obligations provided for in this Directive are respected in practice;
…
(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary [or] artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing …’
5 Article 2 of that directive provides:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …
…’
6 Article 4 of that directive, entitled ‘National law applicable’, provides:
‘1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;
(b) the controller is not established on the Member State's territory, but in a place where its national law applies by virtue of international public law;
(c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.
2. In the circumstances referred to in paragraph 1(c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.’
7 Article 9 of Directive 95/46, entitled ‘Processing of personal data and freedom of expression’, states:
‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’
8 Article 12 of that directive, entitled ‘Right of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
…
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
…’
9 Article 14 of that directive, entitled ‘The data subject's right to object’, provides:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
…’
10 Article 24 of Directive 95/46, entitled ‘Sanctions’, provides:
‘The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.’
11 Article 28 of that directive, entitled ‘Supervisory authority’, is worded as follows:
‘1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
…
3. Each authority shall in particular be endowed with:
- investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,
- effective powers of intervention, such as, for example, that of … ordering the blocking, erasure or destruction of data, [or] of imposing a temporary or definitive ban on processing …
…
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
…
6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.
The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.
…’
Regulation (EU) 2016/679
12 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and Corrigendum OJ 2018 L 127, p. 2), which is based on Article 16 TFEU, is applicable, pursuant to Article 99(2) thereof, from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date.
13 Recitals 1, 4, 9 to 11, 13, 22 to 25 and 65 of that regulation state:
‘(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (“the Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.
…
(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, … the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information [and] freedom to conduct a business …
…
(9) … Directive 95/46 … has not prevented fragmentation in the implementation of data protection across the Union … Differences in the level of protection … in the Member States may prevent the free flow of personal data throughout the Union. Those differences may therefore constitute an obstacle to the pursuit of economic activities at the level of the Union …
(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. …
(11) Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.
…
(13) In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, … and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. …
…
(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. …
(23) In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. …
(24) The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
(25) Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State's diplomatic mission or consular post.
…
(65) A data subject should have … a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’
14 Article 3 of Regulation 2016/679, entitled ‘Territorial scope’, is worded as follows:
‘1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.’
15 Article 4(23) of that regulation defines the concept of ‘cross-border processing’ as follows:
‘(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
‘(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State’.
16 Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:
‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
…
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
…’
17 Article 21 of that regulation, entitled ‘Right to object’, provides, in paragraph 1 thereof:
‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’
18 Article 55 of Regulation 2016/679, entitled ‘Competence’, which forms part of Chapter VI of that regulation, itself entitled ‘Independent supervisory authorities’, provides, in paragraph 1 thereof:
‘Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.’
19 Article 56 of that regulation, entitled ‘Competence of the lead supervisory authority’, states:
‘1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.
2. By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
3. In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.
4. Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).
5. Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.
6. The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.’
20 Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2 thereof:
‘Each supervisory authority shall have all of the following corrective powers:
…
(g) to order the … erasure of personal data … pursuant to … [Article] … 17 …;
…
(i) to impose an administrative fine … in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.’
21 Under Chapter VII of Regulation 2016/679, entitled ‘Cooperation and consistency’, Section I, entitled ‘Cooperation’, includes Articles 60 to 62 of that regulation. Article 60, entitled ‘Cooperation between the lead supervisory authority and the other supervisory authorities concerned’, provides:
‘1. The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.
2. The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.
3. The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.
4. Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.
5. Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.
6. Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.
7. The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.
8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.
9. Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. …
10. After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.
11. Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.
…’
22 Article 61 of that regulation, entitled ‘Mutual assistance’, states, in paragraph 1 thereof:
‘Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.’
23 Article 62 of that regulation, entitled ‘Joint operations of supervisory authorities’, provides:
‘1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.
2. Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. …’
24 Section 2, entitled ‘Consistency’, of Chapter VII of Regulation 2016/679 includes Articles 63 to 67 of that regulation. Article 63, entitled ‘Consistency mechanism’, is worded as follows:
‘In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.’
25 Article 65 of that regulation, entitled ‘Dispute resolution by the Board’, provides, in paragraph 1 thereof:
‘In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:
(a) where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;
(b) where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;
…’
26 Article 66 of that regulation, entitled ‘Urgency procedure’, provides, in paragraph 1 thereof:
‘In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.’
27 Article 85 of Regulation 2016/679, entitled ‘Processing and freedom of expression and information’, states:
‘1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
…’
French law
28 Directive 95/46 is implemented in French law by loi no 78–17, du 6 janvier 1978, relative à l'informatique, aux fichiers et aux libertés (Law No 78–17 of 6 January 1978 on information technology, data files and civil liberties), in the version applicable to the events in the main proceedings (‘the Law of 6 January 1978’).
29 Article 45 of that law specifies that where the controller fails to fulfil the obligations laid down in that law, the President of the CNIL may serve notice on him to bring the established infringement to an end within a period which the President is to determine. If the controller does not comply with the formal notice served on him, the Select Panel of the CNIL may, after hearing both parties, impose, inter alia, a financial penalty.
The dispute in the main proceedings and the questions referred for a preliminary ruling
30 By decision of 21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person's name, it must apply that removal to all its search engine's domain name extensions.
31 Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States.
32 The CNIL also regarded as insufficient Google's further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject's name, no matter which version of the search engine they used.
33 By an adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of EUR 100 000, which was made public.
34 By application lodged with the Conseil d’État (Council of State, France), Google seeks annulment of that adjudication.
35 The Conseil d’État notes that the processing of personal data carried out by the search engine operated by Google falls within the scope of the Law of 6 January 1978, in view of the activities of promoting and selling advertising space carried on in France by its subsidiary Google France.
36 The Conseil d’État also notes that the search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries on its activities. Where the search is conducted from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the State from which that search is deemed to have been made, as identified by the internet user's IP address. However, regardless of his or her location, the internet user remains free to conduct his or her searches using the search engine's other domain names. Moreover, although the results may differ depending on the domain name from which the search is conducted on the search engine, it is common ground that the links displayed in response to a search derive from common databases and common indexing.
37 The Conseil d’État considers that, having regard, first, to the fact that Google's search engine domain names can all be accessed from French territory and, secondly, to the existence of gateways between those various domain names, as illustrated in particular by the automatic redirection mentioned above, as well as by the presence of cookies on extensions of that search engine other than the one on which they were initially deposited, that search engine, which, moreover, has been the subject of only one declaration to the CNIL, must be regarded as carrying out a single act of personal data processing for the purposes of applying the Law of 6 January 1978. As a result, the processing of personal data by the search engine operated by Google is carried out within the framework of one of its installations, Google France, established on French territory, and is therefore subject to the Law of 6 January 1978.
38 Before the Conseil d’État, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of 6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in its judgment of 13 May 2014, Google Spain and Google (C-131/12, EU:C:2014:317), recognised a ‘right to de-referencing’. Google argues that this right does not necessarily require that the links at issue are to be removed, without geographical limitation, from all its search engine's domain names. In addition, by adopting such an interpretation, the CNIL disregarded the principles of courtesy and non-interference recognised by public international law and disproportionately infringed the freedoms of expression, information, communication and the press guaranteed, in particular, by Article 11 of the Charter.
39 Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Conseil d’État has decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Must the “right to de-referencing”, as established by the [Court] in its judgment of 13 May 2014, [Google Spain and Google (C-131/12, EU:C:2014:317),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester's name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]?
(2) In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester's name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States …?
(3) Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester's name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46], regardless of the domain name used by the internet user conducting the search?’
Consideration of the questions referred
40 The case in the main proceedings is the result of a dispute between Google and the CNIL as to how a search engine operator, where it establishes that a data subject is entitled to have one or more links to web pages containing personal data concerning him or her removed from the list of results which is displayed following a search conducted on the basis of his or her name, is to give effect to that right to de-referencing. Although Directive 95/46 was applicable on the date the request for a preliminary ruling was made, it was repealed with effect from 25 May 2018, from which date Regulation 2016/679 is applicable.
41 The Court will examine the questions referred in the light of both that directive and that regulation in order to ensure that its answers will be of use to the referring court in any event.
42 During the proceedings before the Court, Google explained that, following the bringing of the request for a preliminary ruling, it has implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national version of the search engine accessed by that user. Thus, the internet user is now automatically directed to the national version of Google's search engine that corresponds to the place from where he or she is presumed to be conducting the search, and the results of that search are displayed according to that place, which is determined by Google using a geo-location process.
43 In those circumstances, the questions referred, which must be dealt with together, should be understood as seeking to ascertain, in essence, whether Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679 are to be interpreted as meaning that, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is required to carry out that de-referencing on all versions of its search engine, or whether, on the contrary, it is required to do so only on the versions of that search engine corresponding to all the Member States, or even only on the version corresponding to the Member State in which the request for de-referencing was made, using, where appropriate, the technique known as ‘geo-blocking’ in order to ensure that an internet user cannot, regardless of the national version of the search engine used, gain access to the links concerned by the de-referencing in the context of a search conducted from an IP address deemed to be located in the Member State of residence of the person benefiting from the right to de-referencing or, more broadly, in any Member State.
44 As a preliminary point, it should be borne in mind that the Court has held that Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person's name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 88).
45 The Court has also stated that, when appraising the conditions for the application of those same provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him or her personally should, at that point in time, no longer be linked to his or her name by a list of results displayed following a search made on the basis of his or her name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his or her fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject's name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his or her fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 99).
46 In the context of Regulation 2016/679, that right of a data subject to de-referencing is now based on Article 17 of that regulation, which specifically governs the ‘right to erasure’, also referred to, in the heading of that article, as the ‘right to be forgotten’.
47 Pursuant to Article 17(1) of Regulation 2016/679, a data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase personal data without undue delay where one of the grounds listed in that provision applies. Article 17(3) of that regulation specifies that Article 17(1) does not apply to the extent that processing is necessary for one of the reasons listed in the former provision. Those reasons include, in particular, under Article 17(3)(a) of that regulation, the exercise of the right of, inter alia, freedom of information of internet users.
48 It follows from Article 4(1)(a) of Directive 95/46 and Article 3(1) of Regulation 2016/679 that both that directive and that regulation permit data subjects to assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not.
49 In that regard, the Court has held that the processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 60).
50 In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Union are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that search engine is, at the same time, the means enabling those activities to be performed, the display of the list of results being accompanied, on the same page, by the display of advertising linked to the search terms (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraphs 56 and 57).
51 That being so, the fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establishment of the controller on the territory of a Member State escaping the obligations and guarantees laid down by Directive 95/46 and Regulation 2016/679 (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 58).
52 In the present case, it is apparent from the information provided in the order for reference, first, that Google's establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that, in those circumstances, that act of processing is carried out within the framework of Google's establishment in French territory. It thus appears that such a situation falls within the territorial scope of Directive 95/46 and Regulation 2016/679.
53 By its questions, the referring court seeks to determine the territorial scope which must be conferred on a de-referencing in such a situation.
54 In that regard, it is apparent from recital 10 of Directive 95/46 and recitals 10, 11 and 13 of Regulation 2016/679, which was adopted on the basis of Article 16 TFEU, that the objective of that directive and that regulation is to guarantee a high level of protection of personal data throughout the European Union.
55 It is true that a de-referencing carried out on all the versions of a search engine would meet that objective in full.
56 The internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual's name ubiquitous (see, to that effect, judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 80, and of 17 October 2017, Bolagsupplysningen and Ilsjan, C-194/16, EU:C:2017:766, paragraph 48).
57 In a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.
58 Such considerations are such as to justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.
59 That being said, it should be emphasised that numerous third States do not recognise the right to de-referencing or have a different approach to that right.
60 Moreover, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect, judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C-92/09 and C-93/09, EU:C:2010:662, paragraph 48, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, point 136). Furthermore, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.
61 While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679, struck a balance between that right and that freedom so far as the Union is concerned (see, to that effect, today's judgment, GC and Others (De-referencing of sensitive data), C-136/17, paragraph 59), it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.
62 In particular, it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in paragraph 54 above is met, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended to impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.
63 Moreover, although Regulation 2016/679 provides the supervisory authorities of the Member States, in Articles 56 and 60 to 66 thereof, with the instruments and mechanisms enabling them, where appropriate, to cooperate in order to come to a joint decision based on weighing a data subject's right to privacy and the protection of personal data concerning him or her against the interest of the public in various Member States in having access to information, it must be found that EU law does not currently provide for such cooperation instruments and mechanisms as regards the scope of a de-referencing outside the Union.
64 It follows that, currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.
65 Having regard to all of the foregoing, a search engine operator cannot be required, under Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, to carry out a de-referencing on all the versions of its search engine.
66 Regarding the question whether such a de-referencing is to be carried out on the versions of the search engine corresponding to the Member States or only on the version of that search engine corresponding to the Member State of residence of the person benefiting from the de-referencing, it follows from, inter alia, the fact that the EU legislature has now chosen to lay down the rules concerning data protection by way of a regulation, which is directly applicable in all the Member States, which has been done, as is emphasised by recital 10 of Regulation 2016/679, in order to ensure a consistent and high level of protection throughout the European Union and to remove the obstacles to flows of personal data within the Union, that the de-referencing in question is, in principle, supposed to be carried out in respect of all the Member States.
67 However, it should be pointed out that the interest of the public in accessing information may, even within the Union, vary from one Member State to another, meaning that the result of weighing up that interest, on the one hand, and a data subject's rights to privacy and the protection of personal data, on the other, is not necessarily the same for all the Member States, especially since, under Article 9 of Directive 95/46 and Article 85 of Regulation 2016/679, it is for the Member States, in particular as regards processing undertaken solely for journalistic purposes or for the purpose of artistic or literary expression, to provide for the exemptions and derogations necessary to reconcile those rights with, inter alia, the freedom of information.
68 It follows from, inter alia, Articles 56 and 60 of Regulation 2016/679 that, for cross-border processing as defined in Article 4(23) of that regulation, and subject to Article 56(2) thereof, the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid down in those provisions, in order to reach a consensus and a single decision which is binding on all those authorities and with which the controller must ensure compliance as regards processing activities in the context of all its establishments in the Union. Moreover, Article 61(1) of Regulation 2016/679 obliges the supervisory authorities, in particular, to provide each other with relevant information and mutual assistance in order to implement and to apply that regulation in a consistent manner throughout the Union, and Article 63 of that regulation specifies that it is for this purpose that provision has been made for the consistency mechanism set out in Articles 64 and 65 thereof. Lastly, the urgency procedure provided for in Article 66 of Regulation 2016/679 permits the immediate adoption, in exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, of provisional measures intended to produce legal effects on its own territory with a specified period of validity which is not to exceed three months.
69 That regulatory framework thus provides the national supervisory authorities with the instruments and mechanisms necessary to reconcile a data subject's rights to privacy and the protection of personal data with the interest of the whole public throughout the Member States in accessing the information in question and, accordingly, to be able to adopt, where appropriate, a de-referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject's name.
70 In addition, it is for the search engine operator to take, if necessary, sufficiently effective measures to ensure the effective protection of the data subject's fundamental rights. Those measures must themselves meet all the legal requirements and have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject's name (see, by analogy, judgments of 27 March 2014, UPC Telekabel Wien, C-314/12, EU:C:2014:192, paragraph 62, and of 15 September 2016, McFadden, C-484/14, EU:C:2016:689, paragraph 96).
71 It is for the referring court to ascertain whether, also having regard to the recent changes made to its search engine as set out in paragraph 42 above, the measures adopted or proposed by Google meet those requirements.
72 Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (see, to that effect, judgments of 26 February 2013, Åkerberg Fransson, C-617/10, EU:C:2013:105, paragraph 29, and of 26 February 2013, Melloni, C-399/11, EU:C:2013:107, paragraph 60), a data subject's right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.
73 In the light of all of the foregoing, the answer to the questions referred is that, on a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject's name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
Costs
74 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation), where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject's name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
[Signatures]
Reports of Cases
JUDGMENT OF THE COURT (Third Chamber)
3 October 2019Footnote **
(Reference for a preliminary ruling — Information society — Free movement of services — Directive 2000/31/EC — Liability of intermediary service providers — Article 14(1) and (3) — Hosting services provider — Possibility of requiring the service provider to terminate or prevent an infringement — Article 18(1) — Personal, material and territorial limits on the scope of an injunction — Article 15(1) — No general obligation to monitor)
In Case C-18/18,
REQUEST for a preliminary ruling under Article 267 TFEU from the Oberster Gerichtshof (Supreme Court, Austria), made by decision of 25 October 2017, received at the Court on 10 January 2018, in the proceedings
Eva Glawischnig-Piesczek
v
Facebook Ireland Limited,
THE COURT (Third Chamber),
composed of A. Prechal, President of the Chamber, F. Biltgen, J. Malenovský (Rapporteur), C.G. Fernlund and L.S. Rossi, Judges,
Advocate General: M. Szpunar,
Registrar: D. Dittert, Head of Unit,
having regard to the written procedure and further to the hearing on 13 February 2019, after considering the observations submitted on behalf of:
- Ms Glawischnig-Piesczek, by M. Windhager and W. Niklfeld, Rechtsanwälte,
- Facebook Ireland Limited, by G. Kresbach, K. Struckmann and A. Tauchen, Rechtsanwälte,
- the Austrian Government, by G. Hesse, G. Kunnert and A. Jurgutyte-Ruez, acting as Agents,
- the Latvian Government, by I. Kucina, E. Petrocka-Petrovska and V. Soņeca, acting as Agents,
- the Portuguese Government, by L. Inez Fernandes and M. Figueiredo, acting as Agents, and T. Rendas, Legal Adviser.
- the Finnish Government, by J. Heliskoski, acting as Agent,
- the European Commission, by G. Braun, F. Wilman, S.L. Kalėda, and P. Costa de Oliveira, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 4 June 2019, gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Article 15(1) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the internal market (‘Directive on electronic commerce’) (OJ 2000 L 178, p. 1).
2 The request has been made in proceedings between Ms Eva Glawischnig-Piesczek and Facebook Ireland Limited whose registered address is in Ireland, concerning the publication on the page of a hosted user on the social network Facebook of a message containing statements harmful to the reputation of Ms Glawischnig-Piesczek.
Legal context
EU law
3 Recitals 6, 7, 9, 10, 40, 41, 45 to 48, 52, 58 and 60 of Directive 2000/31 state:
‘(6) … by dealing only with certain specific matters which give rise to problems for the internal market, this Directive is fully consistent with the need to respect the principle of subsidiarity as set out in Article 5 of the Treaty.
(7) In order to ensure legal certainty and consumer confidence, this Directive must lay down a clear and general framework to cover certain legal aspects of electronic commerce in the internal market.
…
(9) The free movement of information society services can in many cases be a specific reflection in Community law of a more general principle, namely freedom of expression as enshrined in Article 10(1) of the [European] Convention for the Protection of Human Rights and Fundamental Freedoms, [signed in Rome on 4 November 1950,] which has been ratified by all the Member States; for this reason, directives covering the supply of information society services must ensure that this activity may be engaged in freely in the light of that Article, subject only to the restrictions laid down in paragraph 2 of that Article and in Article 46(1) of the Treaty; this Directive is not intended to affect national fundamental rules and principles relating to freedom of expression.
(10) In accordance with the principle of proportionality, the measures provided for in this Directive are strictly limited to the minimum needed to achieve the objective of the proper functioning of the internal market; where action at Community level is necessary, and in order to guarantee an area which is truly without internal frontiers as far as electronic commerce is concerned, the Directive must ensure a high level of protection of objectives of general interest, in particular the protection of minors and human dignity, consumer protection and the protection of public health; …
…
(40) Both existing and emerging disparities in Member States’ legislation and case-law concerning liability of service providers acting as intermediaries prevent the smooth functioning of the internal market, in particular by impairing the development of cross-border services and producing distortions of competition; service providers have a duty to act, under certain circumstances, with a view to preventing or stopping illegal activities; this Directive should constitute the appropriate basis for the development of rapid and reliable procedures for removing and disabling access to illegal information; …
(41) This Directive strikes a balance between the different interests at stake and establishes principles upon which industry agreements and standards can be based.
…
(45) The limitations of the liability of intermediary service providers established in this directive do not affect the possibility of injunctions of different kinds; such injunctions can in particular consist of orders by courts or administrative authorities requiring the termination or prevention of any infringement, including the removal of illegal information or the disabling of access to it.
(46) In order to benefit from a limitation of liability, the provider of an information society service, consisting of the storage of information, upon obtaining actual knowledge or awareness of illegal activities has to act expeditiously to remove or to disable access to the information concerned; the removal or disabling of access has to be undertaken in the observance of the principle of freedom of expression and of procedures established for this purpose at national level; this Directive does not affect Member States’ possibility of establishing specific requirements which must be fulfilled expeditiously prior to the removal or disabling of information.
(47) Member States are prevented from imposing a monitoring obligation on service providers only with respect to obligations of a general nature; this does not concern monitoring obligations in a specific case and, in particular, does not affect orders by national authorities in accordance with national legislation.
(48) This Directive does not affect the possibility for Member States of requiring service providers, who host information provided by recipients of their service, to apply duties of care, which can reasonably be expected from them and which are specified by national law, in order to detect and prevent certain types of illegal activities.
…
(52) The effective exercise of the freedoms of the internal market makes it necessary to guarantee victims effective access to means of settling disputes; damage which may arise in connection with information society services is characterised both by its rapidity and by its geographical extent; in view of this specific character and the need to ensure that national authorities do not endanger the mutual confidence which they should have in one another, this Directive requests Member States to ensure that appropriate court actions are available; Member States should examine the need to provide access to judicial procedures by appropriate electronic means.
…
(58) This Directive should not apply to services supplied by service providers established in a third country; in view of the global dimension of electronic commerce, it is, however, appropriate to ensure that the Community rules are consistent with international rules; this Directive is without prejudice to the results of discussions within international organisations (amongst others WTO, OECD, Uncitral) on legal issues.
…
(60) In order to allow the unhampered development of electronic commerce, the legal framework must be clear and simple, predictable and consistent with the rules applicable at international level so that it does not adversely affect the competitiveness of European industry or impede innovation in that sector.’
4 Article 14 of Directive 2000/31, entitled ‘Hosting’, states:
‘1. Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:
(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent;
or
(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.
…
3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States’ legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.’
5 Article 15(1) of that directive provides:
‘Member States shall not impose a general obligation on providers, when providing the services covered by Articles 12, 13 and 14, to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.’
6 Article 18(1) of that directive provides:
‘Member States shall ensure that court actions available under national law concerning information society services’ activities allow for the rapid adoption of measures, including interim measures, designed to terminate any alleged infringement and to prevent any further impairment of the interests involved.’
Austrian law
7 In accordance with Paragraph 1330(1) of the Allgemeines Bürgerliches Gesetzbuch (General Civil Code), anyone who has sustained actual harm or loss of profit owing to damage to his reputation is entitled to claim compensation. Under subparagraph 2 of that paragraph, the same is to apply when a person reports facts prejudicial to the reputation, material situation and future prospects of a third party which he knew or ought to have known to be inaccurate. In that case, a denial and publication of that denial may be required.
8 According to Paragraph 78(1) of the Urheberrechtsgesetz (Law on copyright), images representing a person must not be displayed publicly or disseminated in another way that makes them accessible to the public if such publication or dissemination harms the legitimate interests of the person concerned or, where that person has deceased without having authorised or ordered such publication, the legitimate interests of a close relative.
9 Under Paragraph 18(1) of the E-Commerce-Gesetz (Law on electronic commerce), hosting services providers are under no general obligation to monitor the information which they store, transmit or make available, or actively to seek facts or circumstances indicating illegal activity.
The dispute in the main proceedings and the questions referred for a preliminary ruling
10 Ms Eva Glawischnig-Piesczek was a member of the Nationalrat (National Council, Austria), chair of the parliamentary party ‘die Grünen’ (The Greens) and federal spokesperson for that party.
11 Facebook Ireland operates a global social media platform (‘Facebook Service’) for users located outside the United States of America and Canada.
12 On 3 April 2016, a Facebook Service user shared on that user's personal page an article from the Austrian online news magazine oe24.at entitled ‘Greens: Minimum income for refugees should stay’, which had the effect of generating on that page a ‘thumbnail’ of the original site, containing the title and a brief summary of the article, and a photograph of Ms Glawischnig-Piesczek. That user also published, in connection with that article, a comment which the referring court found to be harmful to the reputation of the applicant in the main proceedings, and which insulted and defamed her. This post could be accessed by any Facebook user.
13 By letter of 7 July 2016, Ms Glawischnig-Piesczek, inter alia, asked Facebook Ireland to delete that comment.
14 Because Facebook Ireland did not withdraw the comment in question, Ms Glawischnig-Piesczek brought an action before the Handelsgericht Wien (Commercial Court, Vienna, Austria) which, by interim order of 7 December 2016, directed Facebook Ireland, with immediate effect and until the proceedings relating to the action for a prohibitory injunction have been finally concluded, to cease and desist from publishing and/or disseminating photographs showing the applicant [in the main proceedings] if the accompanying text contained the assertions, verbatim and/or using words having an equivalent meaning as that of the comment referred to in paragraph 12 above.
15 Facebook Ireland disabled access in Austria to the content initially published.
16 On appeal, the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria) upheld the order made at first instance as regards the identical allegations. However, it also held that the dissemination of allegations of equivalent content had to cease only as regards those brought to the knowledge of Facebook Ireland by the applicant in the main proceedings, by third parties or otherwise.
17 The Handelsgericht Wien (Commercial Court, Vienna) and the Oberlandesgericht Wien (Higher Regional Court, Vienna) based their decisions on Paragraph 78 of the Law on copyright and Paragraph 1330 of the General Civil Code, on the ground, inter alia, that the published comment contained statements which were excessively harmful to the reputation of Ms Glawischnig-Piesczek and, in addition, gave the impression that she was involved in unlawful conduct, without providing the slightest evidence in that regard.
18 Each of the parties in the main proceedings lodged appeals on a point of law at the Oberster Gerichtshof (Supreme Court, Austria).
19 Having been called on to adjudicate whether the cease and desist order made against a host provider which operates a social network with a large number of users may also be extended to statements with identical wording and/or having equivalent content of which it is not aware, the Oberster Gerichtshof (Supreme Court) states that, in accordance with its own case-law, such an obligation must be considered to be proportionate where the host provider was already aware that the interests of the person concerned had been harmed on at least one occasion as a result of a user's post and the risk that other infringements may be committed is thus demonstrated.
20 However, considering that the dispute before it raises questions of the interpretation of EU law, the Oberster Gerichtshof (Supreme Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Does Article 15(1) of Directive [2000/31] generally preclude any of the obligations listed below of a host provider which has not expeditiously removed illegal information, specifically not just this illegal information within the meaning of Article 14(1)(a) of [that] directive, but also other identically worded items of information:
– worldwide;
– in the relevant Member State;
– of the relevant user worldwide;
– of the relevant user in the relevant Member State?
(2) In so far as Question 1 is answered in the negative: does this also apply in each case for information with an equivalent meaning?
(3) Does this also apply for information with an equivalent meaning as soon as the operator has become aware of this circumstance?’
Consideration of the questions referred
The first and second questions
21 By its first and second questions, which it is appropriate to examine together, the referring court asks, in essence, whether Directive 2000/31, in particular Article 15(1), must be interpreted as meaning that it precludes a court of a Member State from:
- ordering a host provider to remove information which it stores, the content of which is identical to the content of information which was previously declared to be illegal, or to block access to that information, irrespective of who requested the storage of that information;
- ordering a host provider to remove information which it stores, the content of which is equivalent to the content of information which was previously declared to be illegal, or to block access to that information, and
- extending the effects of that injunction worldwide.
22 As a preliminary point, it is common ground that Facebook Ireland provides the services of a host provider for the purposes of Article 14 of Directive 2000/31.
23 In that respect, it should be recalled that Article 14(1) of that directive is intended to exempt the host provider from liability where it satisfies one of the two conditions listed in that provision, that is to say, not having knowledge of the illegal activity or information, or acting expeditiously to remove or to disable access to that information as soon as it becomes aware of it.
24 In addition, it is apparent from Article 14(3) of Directive 2000/31, read in conjunction with recital 45, that that exemption is without prejudice to the power of the national courts or administrative authorities to require the host provider concerned to terminate or prevent an infringement, including by removing the illegal information or by disabling access to it.
25 It follows that, as the Advocate General stated in point 32 of his Opinion, a host provider may be the addressee of injunctions adopted on the basis of the national law of a Member State, even if it satisfies one of the alternate conditions set out in Article 14(1) of Directive 2000/31, that is to say, even in the event that it is not considered to be liable.
26 Furthermore, Article 18 of Directive 2000/31, which is part of Chapter III of that directive entitled ‘Implementation’, provides in paragraph 1 that Member States must ensure that court actions available under national law concerning information society services’ activities allow for the rapid adoption of measures, including interim measures, designed to terminate any alleged infringement and to prevent any further impairment of the interests involved.
27 In the present case, as follows from paragraph 13 above and from the actual wording of the questions raised, Facebook Ireland, first of all, did have knowledge of the illegal information at issue. Next, that company did not act expeditiously to remove or to disable access to that information, as laid down in Article 14(1) of Directive 2000/31. In the end, the applicant in the main proceedings brought an action before a national court for an injunction like the one referred to in Article 18.
28 Recital 52 of that directive states that the specific character arising from the fact that the damage which may arise in connection with information society services is characterised both by its rapidity and by its geographical extent, and also by the need to ensure that national authorities do not endanger the mutual confidence which they should have in one another, led the legislature of the European Union to request Member States to ensure that appropriate court actions are available.
29 Thus, when implementing Article 18(1) of Directive 2000/31, Member States have a particularly broad discretion in relation to the actions and procedures for taking the necessary measures.
30 Moreover, given that those measures, according to a number of linguistic versions of that provision, including the English, Spanish and French-language versions, are expressly intended to terminate ‘any’ alleged infringement and to prevent ‘any’ further impairment of the interests involved, no limitation on their scope can, in principle, be presumed for the purposes of their implementation. That interpretation is not called into question by the fact that other linguistic versions of that provision, including the German version, provide that those measures are intended to terminate ‘an alleged infringement’ and to prevent ‘further impairment of the interests involved’.
31 Article 15(1) of Directive 2000/31 states that Member States must not impose a general obligation on providers, when providing the services covered by Articles 12, 13 and 14, to monitor the information which they transmit or store, or a general obligation actively to seek facts or circumstances indicating illegal activity.
32 It is by taking all of those provisions into consideration that the Court will reply to the questions raised by the referring court.
33 In the first place, the referring court asks, in essence, whether Article 15(1) of Directive 2000/31 precludes a court of a Member State from ordering a host provider to remove or block access to information which it stores, the content of which is identical to the content of information which was previously declared to be illegal.
34 In that regard, although Article 15(1) prohibits Member States from imposing on host providers a general obligation to monitor information which they transmit or store, or a general obligation actively to seek facts or circumstances indicating illegal activity, as is clear from recital 47 of that directive, such a prohibition does not concern the monitoring obligations ‘in a specific case’.
35 Such a specific case may, in particular, be found, as in the main proceedings, in a particular piece of information stored by the host provider concerned at the request of a certain user of its social network, the content of which was examined and assessed by a court having jurisdiction in the Member State, which, following its assessment, declared it to be illegal.
36 Given that a social network facilitates the swift flow of information stored by the host provider between its different users, there is a genuine risk that information which was held to be illegal is subsequently reproduced and shared by another user of that network.
37 In those circumstances, in order to ensure that the host provider at issue prevents any further impairment of the interests involved, it is legitimate for the court having jurisdiction to be able to require that host provider to block access to the information stored, the content of which is identical to the content previously declared to be illegal, or to remove that information, irrespective of who requested the storage of that information. In particular, in view of the identical content of the information concerned, the injunction granted for that purpose cannot be regarded as imposing on the host provider an obligation to monitor generally the information which it stores, or a general obligation actively to seek facts or circumstances indicating illegal activity, as provided for in Article 15(1) of Directive 2000/31.
38 In the second place, the referring court asks, in essence, whether Article 15(1) of Directive 2000/31 precludes a court of a Member State from ordering a host provider to remove information which it stores, the content of which is equivalent to the content of information which was previously declared to be illegal, or to block access to that information.
39 It is apparent from the information set out in the order for reference that, in using the words ‘information with an equivalent meaning’, the referring court intends to refer to information conveying a message the content of which remains essentially unchanged and therefore diverges very little from the content which gave rise to the finding of illegality.
40 In that regard, it should be made clear that the illegality of the content of information does not in itself stem from the use of certain terms combined in a certain way, but from the fact that the message conveyed by that content is held to be illegal, when, as in the present case, it concerns defamatory statements made against a specific person.
41 It follows therefore that, in order for an injunction which is intended to bring an end to an illegal act and to prevent it being repeated, in addition to any further impairment of the interests involved, to be capable of achieving those objectives effectively, that injunction must be able to extend to information, the content of which, whilst essentially conveying the same message, is worded slightly differently, because of the words used or their combination, compared with the information whose content was declared to be illegal. Otherwise, as the referring court made clear, the effects of such an injunction could easily be circumvented by the storing of messages which are scarcely different from those which were previously declared to be illegal, which could result in the person concerned having to initiate multiple proceedings in order to bring an end to the conduct of which he is a victim.
42 However, it must also be observed that, in this context, as is apparent from Article 15(1) of Directive 2000/31 and as was observed in paragraph 34 above, a court of a Member State may not, first, grant an injunction against a host provider requiring it to monitor generally the information which it stores or, second, require that host provider actively to seek facts or circumstances underlying the illegal content.
43 In that regard, it should be pointed out in particular that, as is apparent from recital 41 of Directive 2000/31, in adopting that directive, the EU legislature wished to strike a balance between the different interests at stake.
44 Thus, Article 15(1) of Directive 2000/31 implies that the objective of an injunction such as the one referred to in Article 18(1) of that directive, read in conjunction with recital 41, consisting, inter alia, of effectively protecting a person's reputation and honour, may not be pursued by imposing an excessive obligation on the host provider.
45 In light of the foregoing, it is important that the equivalent information referred to in paragraph 41 above contains specific elements which are properly identified in the injunction, such as the name of the person concerned by the infringement determined previously, the circumstances in which that infringement was determined and equivalent content to that which was declared to be illegal. Differences in the wording of that equivalent content, compared with the content which was declared to be illegal, must not, in any event, be such as to require the host provider concerned to carry out an independent assessment of that content.
46 In those circumstances, an obligation such as the one described in paragraphs 41 and 45 above, on the one hand — in so far as it also extends to information with equivalent content — appears to be sufficiently effective for ensuring that the person targeted by the defamatory statements is protected. On the other hand, that protection is not provided by means of an excessive obligation being imposed on the host provider, in so far as the monitoring of and search for information which it requires are limited to information containing the elements specified in the injunction, and its defamatory content of an equivalent nature does not require the host provider to carry out an independent assessment, since the latter has recourse to automated search tools and technologies.
47 Thus, such an injunction specifically does not impose on the host provider an obligation to monitor generally the information which it stores, or a general obligation actively to seek facts or circumstances indicating illegal activity, as provided for in Article 15(1) of Directive 2000/31.
48 In the third place, although the referring court does not provide any explanations in that regard in the grounds for its order for reference, the wording of the questions which it addressed to the Court suggests that its doubts also concern the issue whether Article 15(1) of Directive 2000/31 precludes injunctions such as those referred to in paragraphs 37 and 46 above from being able to produce effects which extend worldwide.
49 In order to answer that question, it must be observed that, as is apparent, notably from Article 18(1), Directive 2000/31 does not make provision in that regard for any limitation, including a territorial limitation, on the scope of the measures which Member States are entitled to adopt in accordance with that directive.
50 Consequently, and also with reference to paragraphs 29 and 30 above, Directive 2000/31 does not preclude those injunction measures from producing effects worldwide.
51 However, it is apparent from recitals 58 and 60 of that directive that, in view of the global dimension of electronic commerce, the EU legislature considered it necessary to ensure that EU rules in that area are consistent with the rules applicable at international level.
52 It is up to Member States to ensure that the measures which they adopt and which produce effects worldwide take due account of those rules.
53 In the light of all the foregoing, the answer to the first and second questions is that Directive 2000/31, in particular Article 15(1), must be interpreted as meaning that it does not preclude a court of a Member State from:
- ordering a host provider to remove information which it stores, the content of which is identical to the content of information which was previously declared to be unlawful, or to block access to that information, irrespective of who requested the storage of that information;
- ordering a host provider to remove information which it stores, the content of which is equivalent to the content of information which was previously declared to be unlawful, or to block access to that information, provided that the monitoring of and search for the information concerned by such an injunction are limited to information conveying a message the content of which remains essentially unchanged compared with the content which gave rise to the finding of illegality and containing the elements specified in the injunction, and provided that the differences in the wording of that equivalent content, compared with the wording characterising the information which was previously declared to be illegal, are not such as to require the host provider to carry out an independent assessment of that content, or
- ordering a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law.
The third question
54 In the light of the reply given to the first and second questions, it is not necessary to consider the third question referred.
Costs
55 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Third Chamber) hereby rules:
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), in particular Article 15(1), must be interpreted as meaning that it does not preclude a court of a Member State from:
– ordering a host provider to remove information which it stores, the content of which is identical to the content of information which was previously declared to be unlawful, or to block access to that information, irrespective of who requested the storage of that information;
– ordering a host provider to remove information which it stores, the content of which is equivalent to the content of information which was previously declared to be unlawful, or to block access to that information, provided that the monitoring of and search for the information concerned by such an injunction are limited to information conveying a message the content of which remains essentially unchanged compared with the content which gave rise to the finding of illegality and containing the elements specified in the injunction, and provided that the differences in the wording of that equivalent content, compared with the wording characterising the information which was previously declared to be illegal, are not such as to require the host provider to carry out an independent assessment of that content, and
– ordering a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law.
[Signatures]
