# Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) - Type: Case Law - Source: CJEU - Date: 2019-09-24 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507&ref=6125 - Canonical: https://overview.legal/posts/6125 - Topics: Territorial scope (GDPR), Controllers, Personal Data, Processing, Direct Marketing, Data Controller, Profiling, Pseudonymization ## Summary Territorial scope of EU data protection law: The present case falls within the territorial scope of GDPR because “it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inte ## Sections (6) ### ¶48 It follows from Article 4(1)(a) of Directive 95/46 and Article 3(1) of Regulation 2016/679 that both that directive and that regulation permit data subjects to assert their right to de-referencing against a search engine operator who has one or more establishments in the territory of the Union in the context of activities involving the processing of personal data concerning those data subjects, regardless of whether that processing takes place in the Union or not. > Topics: Personal Data, Processing · Applies: gdpr-art-3-par-1-en, gdpr-art-4-par-1-en ### ¶49 In that regard, the Court has held that the processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that search engine and which orientates its activity towards the inhabitants of that Member State (judgment of > Topics: Personal Data, Processing, Controllers ### ¶50 In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Union are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that search engine is, at the same time, the means enabling those activities to be performed, the display of the list of results being accompanied, on the same page, by the display of advertising linked to the search terms (see, to that effect, judgment of ### ¶51 That being so, the fact that the search engine is operated by an undertaking that has its seat in a third State cannot result in the processing of personal data carried out for the purposes of the operation of that search engine in the context of the advertising and commercial activity of an establishment of the controller on the territory of a Member State escaping the obligations and guarantees laid down by Directive 95/46 and Regulation 2016/679 (see, to that effect, judgment of > Topics: Personal Data, Processing, Controllers ### ¶52 In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that, in those circumstances, that act of processing is carried out within the framework of Google’s establishment in French territory. It thus appears that such a situation falls within the territorial scope of Directive 95/46 and Regulation 2016/679. > Topics: Territorial scope (GDPR), Personal Data, Processing ### ¶13 May 2014, [Google Spain and Google ( C‑131/12 , EU:C:2014:317 ),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first paragraph of Article 14] of Directive [95/46], be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46]? (2) In the event that Question 1 is answered in the negative, must the “right to de-referencing”, as established by the [Court] in the judgment cited above, be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States …? > Topics: Territorial scope (GDPR) · Applies: gdpr-art-12-en, gdpr-art-14-en ## Cited law provisions (4) ### GDPR — gdpr-art-3-par-1-en This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-12-en Transparent information, communication and modalities for the exercise of the rights of the data subject ### GDPR — gdpr-art-14-en Information to be provided where personal data have not been obtained from the data subject --- Generated by overview.legal · https://overview.legal/posts/6125 · 2026-08-22