The Frankfurt Higher Regional Court has recently decided on a lawsuit brought against a search engine operator. The plaintiff had sued the US based search engine operator for the removal of search results presenting and linking allegedly objectionable content on certain internet pages. The court jumped at this opportunity to provide guidance on the scope and application of Art. 17 GDPR, the right to erasure. It dismissed the claim – with a daring argument (judgment of September 6, 2018, case number 16 U 193/17).
The plaintiff used to work as the managing director of a large registered charity organisation in Hesse with approximately 500 employees and more than 35.000 members. The organisation had a financial deficit of approximately EUR 1 million in the year 2011. Around that time the plaintiff called in sick due to health problems. The press repeatedly reported about the charity organisation’s financial difficulties, partly naming the plaintiff as well as the fact that he was constantly not on duty for health reasons. The plaintiff has been seeking an order against the defendant to refrain from responding to search requests containing his first name and surname with several concrete URLs, which linked to corresponding press reports.
The court’s decision contains several important statements ranging from less surprising ones as for instance the applicability of the GDPR on non-EU search engine operators to the more complicated details of the right to erasure and the weighing of the data subject’s and the processor’s interests.
a) Applicability of the GDPR on search engines offered to customers in the EU
The court started out with the obvious statement that the processing of information conducted by a search engine operator was covered by the term processing of personal data within the meaning of Art. 2 (1) GDPR. It went on to explain that this processing of data was within the territorial scope of the GDPR according to Art. 3 (2) GDPR. According to Art. 3 (2) lit. a) GDPR, the regulation applies to the processing of personal data of data subjects who are in the European Union by a controller or processor not established in the European Union, where the processing activities are related to the offering of goods or services to such data subjects in the Union. The GDPR does not define the terms goods and services. According to the court, these terms need to be given a broad interpretation, in particular in view of the fact that the GDPR does not require monetary compensation of the data subject. In the case at hand the court argued that the search engine services were offered in the German language to users in Germany who according to an uncalled-for consideration of the court, for all intents and purposes, paid for these services by providing their personal information to the search engine operator.
b) Scope of the right to erasure
The court then held that a claim for removal of search results may be covered by Art. 17 GDPR. Before the entering into force of the GDPR, the majority of the German courts had not considered the claim for removal of search results to be covered by a right to the erasure of personal information, but by a distinct legal claim to cease and desist based on tort law. In view of the GDPR, the court abandoned that position. According to the court, under the GDPR, it must be taken into account that the ECJ considered the obligation to remove search results as an obligation to delete personal information within the meaning of Article 12 lit. b) of Directive 95/46/EC (ECJ, judgment of 13 May 2014, C-131/12 – Google Spain). The ECJ ruling was included in the discussions on the wording of Art. 17 GDPR. Against that background, it was not apparent that the legislator intended to exclude claims for removal of search engine results from the scope of Art. 17 GDPR. However, according to the court, the right to erasure was a limited one in the context of search engine operators. The data subject’s right to request removal may be limited to the deletion of specific hits that are displayed upon the entry of specific search terms, e.g. a name. As the case may be, the search engine operator does not need to remove the search hits or the links to websites from the search index completely, but may continue to display them upon the entry of other search terms. In the case at hand, the court nevertheless dismissed the claim.
c) Purpose of data processing of search engine operators
The court discussed whether a right to erasure could possibly have come into existence at all. To this end, it considered whether or not the personal data was no longer necessary in relation to the purposes for which they were collected or otherwise processed, Art. 17 (1) lit. a) GDPR. The court discussed this in two respects: On the one hand, it assessed the legal situation with regards to the search results including the links to the press articles as such and held that the purpose of the presentation of the search results continued to exist, i.e. making the linked websites accessible. On the other hand, the court considered the press articles to which the search results referred. In that respect the court argued that a necessity to keep the personal data only ceased to exist once a legitimate information interest had disappeared. Whether or not this was the case depended on a weighing of the involved parties’ interests, similar to the weighing of interests necessary for assessing a legitimate interest according to Art. 6 (1) lit. f) GDPR. The court did not go into more details at this point as it dismissed the claim for other reasons.
d) Disclosure of data concerning health in the press
According to the court, it needed to be taken into account that there was an unlawful data processing pursuant to Art. 17 (1) lit. d) GDPR insofar as the linked articles contain health data of the plaintiff whose processing is inadmissible pursuant to Art. 9 (1) GDPR. In particular, the information that the plaintiff called in sick and was in a rehabilitation was health related information covered by Art. 9 GDPR. The processing of this data was not justified by the interest to inform the public about the allegation that the plaintiff had tried to elude his responsibility for the charity organisation’s crisis by calling in sick. The court called this a circular argument. It is important to note that the court held that the disclosure of health data had been lawful before the entering into force of the GDPR, i.e. under the Federal Data Protection Act in its version applicable before 25 May 2018. It is also important to note that the court made no distinction between the lawfulness of the information on the websites to which the search results referred and the lawfulness of the information processing in the context of the search results.
According to Art. 4 (2) GDPR processing includes, inter alia, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available of personal data. Therefore, the definition of processing covers the compilation of search results including links to the websites at least as an otherwise making available of personal data. In that respect, i.e. in the context of processing, it is irrelevant whether or not the search results themselves contain the critical personal data, e.g. the data concerning health. The situation is more difficult to assess with respect to the (personal) information affected by the right to erasure. The court did not discuss the scope of the right to erasure under these – typical – circumstances of the case. In particular, the court did not draw a distinction between the erasure of critical information itself, as for instance of health data as such, and of other information relating to this critical information, such as the search result data set, which does not necessarily contain personal data at all. Based on the definition of Art. 4 (2) GDPR, one may treat such search results as personal information due to their purpose of establishing access to the personal data hosted on another website. However, this certainly does not go without saying, and clarification by the court would have been very welcome.
e) The twist: The weighing of the conflicting interests and the application of the notice-and-take-down-procedure to the right to erasure
Taking into account the court’s above assessment, the rest of the decision is not easy to understand. Given that the (continuing) disclosure of health data was unlawful under Art. 9 GDPR, the outcome of the case may seem straightforward. In fact, it is not.
According to Art. 17 (3) lit. a) GDPR, the court must weigh the conflicting interests, i.e. the plaintiff’s interest in enforcing his right to erasure, in particular to have links to his health data erased, and the defendant’s freedom of expressing opinion and information. Or on a more abstract level: on the one hand the plaintiff’s right to respect for private life in accordance with Art. 2 (1) in conjunction with Art. 1 (1) of the German Constitution, Art. 8 (1) of the European Convention on Human Rights, and Art. 7, Article 8 of the EU Charter of Fundamental Rights; on the other hand, the defendant’s right and the defendant’s customers’ freedom of communication in accordance with Art. 5 (1) of the German Constitution, Art. 10 (1) of the European Convention on Human Rights and Art. 11 of the EU Charter of Fundamental Rights. This weighing of interests must be exercised even if the processing of personal data was unlawful within the meaning of Art. 17 (1) lit. d), which is one of the scenarios where the right to erasure comes into existence. Interestingly, the court did not discuss the question of whether or not this weighing of interests is possible and necessary at all in cases of a continuing violation of Art. 9 GDPR, i.e. in cases of unlawful processing of health data (advocating against the weighing of interests in such cases Worms, in: Beck Online Commentary of the Data Protection Law, 25. Ed. [August 2018], Art. 17 GDPR mn. 80).
The court did not only weigh the conflicting interests but went on to argue that, according to the case law of the German Federal Court of Justice, search engine operators are only subject to specific obligations to remove search results if they have been notified of an infringement of personal rights that is obvious and clearly recognisable at first glance. A similar argument had been made by the Hamburg Higher Regional Court recently in passing (judgement of 10 July 2018, 7 U 125/14). According to the Frankfurt court, such notice was necessary in order to enable the search engine operator to identify in the large number of indexed internet pages those that infringe the rights of third parties. For example, an infringement of personal rights may be obvious in the case of child pornography, an instigation of violence against persons, obvious confusion of persons, the existence of a legally binding decision against the primary infringer, the lapse of any information interest over time or hate speech. According to the court, this standard applied by the Federal Court of Justice to a claim for cease and desist under tort law must apply to the right to erasure, too.
According to the court, the press articles were lawful when they were published. Therefore, the defendant did not have reason to spot an infringement of personal rights that was obvious and clearly recognisable at first glance in the press articles. Moreover, the defendant acted lawfully in linking the press articles to the list of search results in spite of the disclosure of health data contained therein. In this respect, it must be taken into account that without search engines the internet would no longer be usable due to the flood of data and thus the use of the internet as a whole is dependent on the existence and availability of search engines. With regard to press articles taken up by the search engine, the interest of the authors protected in Art. 5 (1) of the German Constitution also needed to be taken into account.
The court’s reasoning does not become entirely clear. In particular, it remains unclear why exactly the court dismissed the claim. Parts of the reasoning read as if the court holds the press articles to be lawful. Other parts of the reasoning suggest that the court required an infringement of personal rights that was obvious and clearly recognisable at first glance. Such requirement, however, has not been laid down in Art. 17 GDPR.
One might argue that the unlawful processing of personal data does not trigger a claim for erasure as long as the aggrieved person has not informed the search engine operator, as otherwise the operation of search engines services would become virtually impossible. This position may find support in Art. 17 (3) lit. a) GDPR according to which no claim for erasure comes into existence as long as the processing is necessary for exercising the freedom of expression of opinion and information. It may also be based on Art. 17 (1) GDPR according to which the erasure shall be effected without undue delay. One may argue that undue delay can only occur if the data processor, i.e. the search engine operator, has concrete and secure knowledge of the facts that establish a data subject’s right to erasure.
The argument becomes more difficult as soon as the search engine operator is on notice. The notice-and-take-down procedure was conceived to handle cases where the service provider does not have a primary obligation to identify possibly infringing content. However, the case at hand does not concern such secondary liability, but a distinct GDPR claim directed, as the court rightfully points out, specifically to the search engine operator.
The claim to erasure pursuant to Art. 17 (1) GDPR is not limited to cases where the unlawfulness of the data processing or even the preponderance of the data subject’s interests is readily apparent. Based on the Frankfurt Higher Regional Court’s approach, a data subject will never be in the position to enforce his or her claim to erasure against a search engine operator as long as the claim is not a clear-cut one. This might overcomplicate the enforcement of the data subject’s right to erasure against search engine operators. It is understandable that the court has sought a way to protect the business model of search engine operators against data protection claims for erasure. However, the legal basis of such protection may need to be reconsidered.
