On 24 September 2019, the CJEU handed down a major new judgment concerning the application of the right to be forgotten in data protection law, considering how that right was to apply in the context of sensitive personal data (or, under the GDPR, special category data) returned by online search engine results: Case C-136/17 GC & others v CNIL (EU:C:2019:773).
The CJEU rejected suggestions of a strict interpretative approach to data protection law in relation to sensitive personal data, and where the operator of a search engine receives a request for de-referencing relating to a link to a web page on which sensitive data are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data, ascertain whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search. The CJEU emphasised that the search engine was responsible only for the referencing and display of search results, and not the substantive content of the third party webpages to which it provided access.
Christopher Knight acted, as sole counsel, for the United Kingdom, which had argued for the necessity of a balancing exercise to be carried out when considering sensitive personal data, in accordance with Article 29 Working Party guidelines. The judgment of the CJEU is available here.
