Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)

National data protection authorities: Although EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, but “it also does not prohibit such a practice”. The CNIL and the french courts are competent to weigh up, “in the light of national standards of protection of fundamental rights whether a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other” whether Google should carry out a de-referencing concerning all versions of the Google engine. (¶¶70–72)

In addition, it is for the search engine operator to take, if necessary, sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. Those measures must themselves meet all the legal requirements and have the effect of preventing or, at the very least, seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name (see, by analogy, judgments of 27 March 2014, UPC Telekabel Wien, C‑314/12, EU:C:2014:192, paragraph 62, and of 15 September 2016, McFadden, C‑484/14, EU:C:2016:689, paragraph 96).

It is for the referring court to ascertain whether, also having regard to the recent changes made to its search engine as set out in paragraph 42 above, the measures adopted or proposed by Google meet those requirements.

Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (see, to that effect, judgments of 26 February 2013, Åkerberg Fransson, C‑617/10, EU:C:2013:105, paragraph 29, and of 26 February 2013, Melloni, C‑399/11, EU:C:2013:107, paragraph 60), a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.