Google LCC – CJEU Judgment (France, 2019)

In 2015, the CNIL informed Google that it must remove links from all versions of its search engine throughout the world when implementing an erasure request from a data subject. Google declined to comply, limiting its de-referencing of links obtained via its search engines with domain extensions inside the EU only (e.g. google.de or google.fr), as well as using geo-blocking techniques, which prohibits links from appearing in searches performed in France regardless of the version used. As a consequence, the CNIL imposed a fine of 100.000 EUR on Google due to non-compliance with the data protection legislation. Google filed a request with the Conseil d'État to have the fine annulled. The Conseil d'État subsequently submitted concerns to the Court of Justice, citing "many severe challenges" surrounding the interpretation of the directive. 'Single act of processing': The search engine in this case must be regarded as carrying out a single act of personal data processing, because of the existence of gateways between its various national versions. Following this reasoning the act of processing is carried out within the framework of an establishment of Google in a Union Member State (France in this case). Territorial scope: The fact that the search engine is operated by a company situated in a 'third state' cannot lead to an exemption of the processing of personal data for the purpose of the operation of that search engine (in connection with the advertising and commercial activities) of an establishment of the controller on the territory of a Member State from the obligations and safeguards of Directive 95/46 and Regulation 2016/679 (GDPR). The Court explained that the Directive and GDPR do not indicate that EU legislature has chosen to establish a scope which would go beyond the territory of the Member States and thus ruled that search engine operators are not required under EU law to remove links on all the versions of its search engine. Ruling: It follows that where