On 24 September 2019 the Court of Justice of the European Union (ECJ) issued two decisions concerning Google: Cases C-507/17 (Google v CNIL) and C-136/17 (GC v CNIL) . See comments to Case C-507/17 here. Apparently, both decisions are a success for Google. Not a complete success in Case C-507/17, however. And not a complete success in case C-136/17, either. Let’s see why.
In C-136/17 (GC v CNIL) the claimants sought the de-listing of Google results, following searches of their names, linking to articles published in France regarding criminal proceedings against them. Google denied the de-listing because in its view the public right to know overrode here the right to be forgotten. The CNIL did entertain the complaint and the parties sued in front of the Council of State (“Conseil d’Etat”) which referred 4 interpretative questions to the ECJ, including whether the prohibition imposed on controllers on processing special category personal data applies to the operator of a search engine. See here for general comment on the case.
I want to focus on a particular point, which is the downside of the case for Google and other organizations processing personal data): the category of “criminal data” which is broadened y the ECJ. See Question no. 4 of the Decision.
“whether the provisions of Directive 95/46 must be interpreted as meaning that
– first, information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46, and
– second, the operator of a search engine is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and, having regard to the progress of the proceedings, no longer corresponds to the current situation?”
Directive 46/1995 Article Article 8 (The processing of special categories of data) provides:
Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.
Member States may provide that data relating to administrative sanctions or judgments in civil cases shall also be processed under the control of official authority.
The ECJ notes that the GDPR has a similar provision: Article 10 of Regulation 2016/679 “Processing of personal data relating to criminal convictions and offences:
‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’
There is no definition of “criminal data” in the Directive or the GDPR.
The ECJ points out that
… it must be stated, as the Advocate General observed in point 100 of his Opinion and as submitted inter alia by the French Government, Ireland, the Italian and Polish Governments and the Commission, that information concerning legal proceedings brought against an individual, such as information relating to the judicial investigation and the trial and, as the case may be, the ensuing conviction, is data relating to ‘offences’ and ‘criminal convictions’ within the meaning of the first subparagraph of Article 8(5) of Directive 95/46 and Article 10 of Regulation 2016/679, regardless of whether or not, in the course of those legal proceedings, the offence for which the individual was prosecuted was shown to have been committed.
The ECJ concludes as follows:
… the provisions of Directive 95/46 must be interpreted as meaning that
– first, information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46, and
– second, the operator of a search engine is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and, having regard to the progress of the proceedings, no longer corresponds to the current situation, in so far as it is established in the verification of the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 that, in the light of all the circumstances of the case, the data subject’s fundamental rights guaranteed by Articles 7 and 8 of the Charter override the rights of potentially interested internet users protected by Article 11 of the Charter.
This broad category of “criminal data” was the case in UK and in France, but not so in Germany or The Netherlands (among others).
For more information, Francesca Giannoni-Crystal