TU and RE v Google LLC.

• Jurisdiction: European Union
• Court: Court of Justice (European Union)
• ECLI: ECLI:EU:C:2022:962
• Docket Number: C-460/20
• Celex Number: 62020CJ0460
• Date: 08 December 2022

Provisional text

JUDGMENT OF THE COURT (Grand Chamber)

8 December 2022 (*)

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive 95/46/EC – Article 12(b) – Point (a) of the first paragraph of Article 14 – Regulation (EU) 2016/679 – Article 17(3)(a) – Operator of an internet search engine – Research carried out on the basis of a person’s name – Displaying a link to articles containing allegedly inaccurate information in the list of search results – Displaying, in the form of thumbnails, photographs illustrating those articles in the list of results of an image search – Request for de-referencing made to the operator of the search engine – Weighing-up of fundamental rights – Articles 7, 8, 11 and 16 of the Charter of Fundamental Rights of the European Union – Obligations and responsibilities of the operator of the search engine in respect of processing a request for de-referencing – Burden of proof on the person requesting de-referencing)

In Case C‑460/20,

REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesgerichtshof (Federal Court of Justice, Germany), made by decision of 27 July 2020, received at the Court on 24 September 2020, in the proceedings

TU,

RE

v

Google LLC

THE COURT (Grand Chamber),

composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Prechal, K. Jürimäe, C. Lycourgos, P.G. Xuereb, L.S. Rossi and D. Gratsias, Presidents of Chambers, M. Ilešič (Rapporteur), F. Biltgen, N. Piçarra, N. Jääskinen, N. Wahl, I. Ziemele and J. Passer, Judges,

Advocate General: G. Pitruzzella,

Registrar: D. Dittert, Head of Unit,

having regard to the written procedure and further to the hearing on 24 January 2022,

after considering the observations submitted on behalf of:

– TU and RE, by M. Siegmann and T. Stöber, Rechtsanwälte,

– Google LLC, by B. Heymann, J. Spiegel and J. Wimmers, Rechtsanwälte,

– the Greek Government, by S. Charitaki, A. Magrippi and M. Tassopoulou, acting as Agents,

– the Austrian Government, by G. Kunnert, A. Posch and J. Schmoll, acting as Agents,

– the Romanian Government, by E. Gane and L. Liţu, acting as Agents,

– the European Commission, by A. Bouchagiar, F. Erlbacher, H. Kranenborg and D. Nardi, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 7 April 2022,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 17(3)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’) and Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L281, p.31), read in the light of Articles 7, 8, 11 and 16 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

2 The request has been made in proceedings between TU and RE, of the one part, and Google LLC, of the other part, concerning a request seeking, first, that articles in which they are identified be de-referenced from the results of a search carried out on the basis of their names and, second, that photographs representing them, displayed in the form of preview images (‘thumbnails’), be removed from the results of an image search.

Legal context

Directive 95/46

3 Article 1 of Directive 95/46, entitled ‘Object of the Directive’, provided in paragraph 1 thereof:

‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.’

4 Article 2 of that directive, entitled ‘Definitions’, provided:

‘For the purposes of this Directive:

(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …

(b) “processing of personal data” (“processing”): shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, …

(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …’

5 In Section I of Chapter II of that directive, entitled ‘Principles relating to data quality’, Article 6 was worded as follows:

‘1. Member States shall provide that personal data must be:

…

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;

…’

6 In Section V of Chapter II of that directive, entitled ‘The data subject’s right of access to data’, Article 12 thereof, itself entitled ‘Right of access’, stated:

‘Member States shall guarantee every data subject the right to obtain from the controller:

…

(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;

…’

7 In Section VII of Chapter II of Directive 95/46, entitled ‘The data subject’s right to object’, the first paragraph of Article 14 of that directive provided:

‘Member States shall grant the data subject the right:

(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;

…’

The GDPR

8 As provided in Article 94(1) thereof, the GDPR repealed Directive 95/46 with effect from 25 May 2018. By virtue of Article 99(2), the GDPR applies from that date.

9 Recitals 4, 39 and 65 of that regulation state:

‘4. The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

…

39. … Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. …

65. A data subject should have the right to have personal data concerning him or her rectified and a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’

10 In Chapter I of that regulation, entitled ‘General provisions’, Article 4 thereof, itself entitled ‘Definitions’, is worded as follows:

‘For the purposes of this Regulation:

(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); …

(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means …

(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …’

11 In Chapter II of that regulation, entitled ‘Principles’, Article 5, itself entitled ‘Principles relating to the processing of personal data’, provides:

‘1. Personal data shall be:

…

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);

…

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’

12 Section 3 of Chapter III of the GDPR, entitled ‘Rectification and erasure’, includes, inter alia, Articles 16 and 17 of that regulation.

13 Article 16 of the GDPR, entitled ‘Right of rectification’, provides:

‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’

14 Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:

‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise...