Another important decision on the protection of individuals from the processing of personal data by search engines was taken on 08/12/2022 by the Court of Justice of the European Union (CJEU) at the request of the Supreme Federal Court of Germany (case C-460/20).

The application was filed as part of a lawsuit between two individuals, on the one hand, and Google LLC, on the other, to remove links to articles that contained a link to the applicants from search results. based on their title and, secondly, removing thumbnail photos of them from image search results. Google’s refusal to comply with the request led the applicants to the German courts and then to the European Court of Justice.

This decision follows previous decisions and in particular Google Spain and Google (case C-131/12) to which it refers, as well as the decisions of 24 September 2019 (case C-136/17) and 24 September 2019 (case C-507/17) showing how search engines operate on the vast Internet.

The long stay of personal data in the digital environment, combined with the ease of access and discovery of information through simple navigation in search engines, makes the past of individuals constantly up-to-date, even if the information itself has no value in terms of timeliness, even more so if it is inaccurate or falsified. Timeless storage of data often hinders the free development of the personality of subjects, deprives them of their right to privacy, and turns the Internet into a register of memory and a reminder of the past.

That is why the EU has established safeguards, in particular with Article 17 of the General Data Protection Regulation (GDPR), which strengthens the informational self-determination of subjects in relation to data posted on the Internet about their faces and solves the problem of erasing their digital past.

High-tech search engines play an important role in accessing and searching for information that is not randomly located on the Internet. The CJEU decision clearly states that the activities of search engines, i.e. searching for information, automatically indexing it, temporarily storing it and finally making it available to Internet users in a certain order of preference, should be characterized as “processing of personal data”. and that the search engine operator should be regarded as the “controller” of said processing.

What does the judgment rendered by the Court of Justice of the European Union provide for?

Through search engines, users can search for third-party data by title from a proposed list of results, get a systematic overview of information available on the Internet about them, including photo thumbnails, and also create detailed or non-profiled search engines.

The Court clarified that the processing of personal data by a search engine is different from that of website publishers and agreed that search engines are required to remove inaccurate data and photographs from their directory results if the request to remove links is submitted by a person exercising their rights under GDPR.

At the same time, the applicant must provide critical, competent and sufficient evidence documenting the obvious unreliability of the information included in the secret content, or at least part of this information, no less important than the content as a whole. . As long as the applicant provides the above information, more specifically the court order issued against the publisher of the website, the search engine operator is obliged to accept the request to remove links. In the case of thumbnail photos from search results, the search engine must check whether their appearance is necessary to exercise the right to freedom of information of Internet users and whether they appear outside the context of publishing a secret website. And in this case, the search engine, having evaluated the above and the information content of the photos, must accept the request for deletion.

The jurisprudence of the Court, like a specific decision, resolves issues that affect the life and actions of EU citizens. once again justifying the protection of personal data.

However, we would like to remind you that a similar issue was decided in a similar way by the Greek judiciaries with judgment no.

* Mr. Georgios Voukelatos is a Legal Counsel “K” specializing in privacy and GDPR matters.