# Google LLC v CNIL - Type: Case Law - Source: CJEU - Identifier: C-507/17 - Date: 2019-09-24 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507&ref=51476 - Canonical: https://overview.legal/posts/51476 - Topics: Territorial scope (GDPR), Right to Object, Right to be Forgotten, Personal Data, Accuracy, Child Consent, Processors, Criminal Data, Controllers, Consent ## Summary Right to delisting does not require global de-referencing under EU law. ## Sections (41) ### ¶900 KB. Apply EUR-Lex Access to European Union law This document is an excerpt from the EUR-Lex website You are here EUROPA EUR-Lex home EUR-Lex - 62017CJ0507 - EN Help Print Menu EU law Treaties Treaties currently in force Founding Treaties Accession Treaties Other treaties and protocols Chronological overview Legal acts Consolidated texts International agreements Preparatory documents EFTA documents Lawmaking procedures Summaries of EU legislation Browse by EU institutions European Parliament European Council Council of the European Union European Commission Court of Justice of the European Union European Central Bank European Court of Auditors European Economic and Social Committee European Committee of the Regions Browse by EuroVoc EU case-law Case-law Reports of cases Directory of case-law Official Journal Access to the Official Journal Official Journal L series daily view Official Journal C series daily view Browse the Official Journal Legally binding printed editions Special edition National law and case-law National transposition National case-law JURE case-law Information Themes in focus EUR-Lex developments Statistics ELI register What is ELI ELI background Why implement ELI Countries implementing ELI Testimonials Implementing ELI Glossary EU budget online Quick search Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care). Search tips Need more search options? Use the Advanced search Document 62017CJ0507 Help Print Text Document information Abstract Case file Permanent link Download notice Save to My items Create an email alert Create an RSS alert ​ Judgment of the Court (Grand Chamber) of > Topics: Statistics ### ¶267 TFEU from the Conseil d’État (Council of State, France), made by decision of ### ¶1 This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of ### ¶12 Regulation (EU) 2016/679 of the European Parliament and of the Council of ### ¶14 Article 3 of Regulation 2016/679, entitled ‘Territorial scope’, is worded as follows: ‘1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. > Topics: Processors, Territorial scope (GDPR), Personal Data, Processing · Applies: gdpr-art-3-en ### ¶16 Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows: ‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). … > Topics: Personal Data, Child Consent, Right to be Forgotten, Controllers · Applies: gdpr-art-6-par-1-en, gdpr-art-8-par-1-en, gdpr-art-9-par-2-en, gdpr-art-21-par-1-en, gdpr-art-21-par-2-en, gdpr-art-17-en ### ¶17 Article 21 of that regulation, entitled ‘Right to object’, provides, in paragraph 1 thereof: ‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’ > Topics: Marketing, Automated Decision-Making, Profiling, Right to Object · Applies: gdpr-art-6-par-1-en, gdpr-art-21-en ### ¶18 Article 55 of Regulation 2016/679, entitled ‘Competence’, which forms part of Chapter VI of that regulation, itself entitled ‘Independent supervisory authorities’, provides, in paragraph 1 thereof: ‘Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.’ > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-55-en ### ¶19 Article 56 of that regulation, entitled ‘Competence of the lead supervisory authority’, states: ‘1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60. > Topics: Controllers, Supervisory Authorities, Supervision, Processors · Applies: gdpr-art-55-en, gdpr-art-56-en, gdpr-art-60-en ### ¶20 Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2 thereof: ‘Each supervisory authority shall have all of the following corrective powers: … (g) to order the … erasure of personal data … pursuant to … [Article] … 17 …; … (i) to impose an administrative fine … in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.’ > Topics: Authority Powers for Fundamental Rights Protection, Right to be Forgotten, Supervisory Authorities, Supervision · Applies: gdpr-art-58-en ### ¶4 Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63. > Topics: Supervision, Supervisory Authorities · Applies: gdpr-art-63-en ### ¶5 Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks. > Topics: Supervisory Authorities, Supervision ### ¶7 The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision. > Topics: Supervisory Authorities, Controllers, Processors, Supervision ### ¶8 By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. > Topics: Supervisory Authorities, Supervision, Controllers ### ¶9 Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. … > Topics: Supervisory Authorities, Supervision ### ¶11 Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply. …’ > Topics: Supervision, Supervisory Authorities · Applies: gdpr-art-66-en ### ¶22 Article 61 of that regulation, entitled ‘Mutual assistance’, states, in paragraph 1 thereof: ‘Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.’ > Topics: Supervision · Applies: gdpr-art-61-en ### ¶23 Article 62 of that regulation, entitled ‘Joint operations of supervisory authorities’, provides: ‘1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved. > Topics: Supervision · Applies: gdpr-art-62-en ### ¶24 Section 2, entitled ‘Consistency’, of Chapter VII of Regulation 2016/679 includes Articles 63 to 67 of that regulation. Article 63, entitled ‘Consistency mechanism’, is worded as follows: ‘In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.’ > Topics: Supervision · Applies: gdpr-art-63-en ### ¶2 For processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. …’ French law > Topics: Personal Data, Controllers, Processors, International Transfer ### ¶28 Directive 95/46 is implemented in French law by loi n o 78-17, du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 of ### ¶29 Article 45 of that law specifies that where the controller fails to fulfil the obligations laid down in that law, the President of the CNIL may serve notice on him to bring the established infringement to an end within a period which the President is to determine. If the controller does not comply with the formal notice served on him, the Select Panel of the CNIL may, after hearing both parties, impose, inter alia, a financial penalty. The dispute in the main proceedings and the questions referred for a preliminary ruling > Topics: Controllers · Applies: gdpr-art-45-en ### ¶30 By decision of ### ¶21 May 2015, the President of the CNIL served formal notice on Google that, when granting a request from a natural person for links to web pages to be removed from the list of results displayed following a search conducted on the basis of that person’s name, it must apply that removal to all its search engine’s domain name extensions. ### ¶31 Google refused to comply with that formal notice, confining itself to removing the links in question from only the results displayed following searches conducted from the domain names corresponding to the versions of its search engine in the Member States. ### ¶32 The CNIL also regarded as insufficient Google’s further ‘geo-blocking’ proposal, made after expiry of the time limit laid down in the formal notice, whereby internet users would be prevented from accessing the results at issue from an IP (Internet Protocol) address deemed to be located in the State of residence of a data subject after conducting a search on the basis of that data subject’s name, no matter which version of the search engine they used. > Topics: Personal Data ### ¶33 By an adjudication of ### ¶10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice within the prescribed period, imposed a penalty on that company of EUR 100000, which was made public. ### ¶34 By application lodged with the Conseil d’État (Council of State, France), Google seeks annulment of that adjudication. ### ¶35 The Conseil d’État notes that the processing of personal data carried out by the search engine operated by Google falls within the scope of the Law of > Topics: Personal Data, Processing ### ¶36 The Conseil d’État also notes that the search engine operated by Google is broken down into different domain names by geographical extensions, in order to tailor the results displayed to the specificities, particularly the linguistic specificities, of the various States in which that company carries on its activities. Where the search is conducted from ‘google.com’, Google, in principle, automatically redirects that search to the domain name corresponding to the State from which that search is deemed to have been made, as identified by the internet user’s IP address. However, regardless of his or her location, the internet user remains free to conduct his or her searches using the search engine’s other domain names. Moreover, although the results may differ depending on the domain name from which the search is conducted on the search engine, it is common ground that the links displayed in response to a search derive from common databases and common indexing. > Topics: IP Address ### ¶37 The Conseil d’État considers that, having regard, first, to the fact that Google’s search engine domain names can all be accessed from French territory and, secondly, to the existence of gateways between those various domain names, as illustrated in particular by the automatic redirection mentioned above, as well as by the presence of cookies on extensions of that search engine other than the one on which they were initially deposited, that search engine, which, moreover, has been the subject of only one declaration to the CNIL, must be regarded as carrying out a single act of personal data processing for the purposes of applying the Law of > Topics: Personal Data, Cookies ### ¶38 Before the Conseil d’État, Google maintains that the penalty at issue is based on a misinterpretation of the provisions of the Law of ### ¶6 January 1978, which transpose Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, on the basis of which the Court, in its judgment of > Applies: gdpr-art-12-en, gdpr-art-14-en ### ¶39 Having noted that this line of argument raises several serious difficulties regarding the interpretation of Directive 95/46, the Conseil d’État has decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: ‘(1) Must the “right to de-referencing”, as established by the [Court] in its judgment of ### ¶3 Moreover, in addition to the obligation mentioned in Question 2, must the “right to de-referencing” as established by the [Court] in its judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the “geo-blocking” technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the “right to de-referencing”, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46], regardless of the domain name used by the internet user conducting the search?’ Consideration of the questions referred > Topics: IP Address ### ¶40 The case in the main proceedings is the result of a dispute between Google and the CNIL as to how a search engine operator, where it establishes that a data subject is entitled to have one or more links to web pages containing personal data concerning him or her removed from the list of results which is displayed following a search conducted on the basis of his or her name, is to give effect to that right to de-referencing. Although Directive 95/46 was applicable on the date the request for a preliminary ruling was made, it was repealed with effect from > Topics: Personal Data ### ¶25 May 2018, from which date Regulation 2016/679 is applicable. ### ¶41 The Court will examine the questions referred in the light of both that directive and that regulation in order to ensure that its answers will be of use to the referring court in any event. ### ¶42 During the proceedings before the Court, Google explained that, following the bringing of the request for a preliminary ruling, it has implemented a new layout for the national versions of its search engine, in which the domain name entered by the internet user no longer determines the national version of the search engine accessed by that user. Thus, the internet user is now automatically directed to the national version of Google’s search engine that corresponds to the place from where he or she is presumed to be conducting the search, and the results of that search are displayed according to that place, which is determined by Google using a geo-location process. ### ¶43 In those circumstances, the questions referred, which must be dealt with together, should be understood as seeking to ascertain, in essence, whether Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 and Article 17(1) of Regulation 2016/679 are to be interpreted as meaning that, where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is required to carry out that de-referencing on all versions of its search engine, or whether, on the contrary, it is required to do so only on the versions of that search engine corresponding to all the Member States, or even only on the version corresponding to the Member State in which the request for de-referencing was made, using, where appropriate, the technique known as ‘geo-blocking’ in order to ensure that an internet user cannot, regardless of the national version of the search engine used, ga > Applies: gdpr-art-17-par-1-en, gdpr-art-12-en, gdpr-art-14-en ## Cited law provisions (39) ### GDPR — gdpr-art-1-par-1-en This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. ### GDPR — gdpr-art-4-par-23-en ‘cross-border processing’ means either: ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-8-par-1-en Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. ### GDPR — gdpr-art-9-par-2-en Paragraph 1 shall not apply if one of the following applies: ### GDPR — gdpr-art-17-par-1-en The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ### GDPR — gdpr-art-21-par-1-en The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. ### GDPR — gdpr-art-21-par-2-en Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. ### GDPR — gdpr-art-60-par-3-en The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views. ### GDPR — gdpr-art-60-par-4-en Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63. ### GDPR — gdpr-art-94-par-1-en Directive 95/46/EC is repealed with effect from 25 May 2018. ### GDPR — gdpr-art-99-par-2-en It shall apply from 25 May 2018. ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-3-en Territorial scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-7-en Conditions for consent ### GDPR — gdpr-art-8-en Conditions applicable to child's consent in relation to information society services ### GDPR — gdpr-art-9-en Processing of special categories of personal data ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-11-en Processing which does not require identification ### GDPR — gdpr-art-12-en Transparent information, communication and modalities for the exercise of the rights of the data subject ### GDPR — gdpr-art-14-en Information to be provided where personal data have not been obtained from the data subject ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-17-en Right to erasure (‘right to be forgotten’) ### GDPR — gdpr-art-19-en The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ### GDPR — gdpr-art-21-en Right to object ### GDPR — gdpr-art-24-en Responsibility of the controller ### GDPR — gdpr-art-28-en Processor ### GDPR — gdpr-art-45-en Transfers on the basis of an adequacy decision ### GDPR — gdpr-art-55-en Competence ### GDPR — gdpr-art-56-en Competence of the lead supervisory authority ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-60-en Cooperation between the lead supervisory authority and the other supervisory authorities concerned ### GDPR — gdpr-art-61-en Mutual assistance ### GDPR — gdpr-art-62-en Joint operations of supervisory authorities ### GDPR — gdpr-art-63-en In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section. ### GDPR — gdpr-art-65-en Dispute resolution by the Board ### GDPR — gdpr-art-66-en Urgency procedure ### GDPR — gdpr-art-85-en Processing and freedom of expression and information --- Generated by overview.legal · https://overview.legal/posts/51476 · 2026-08-22