CJEU tries to control the tech giants

The Court of Justice of the European Union (CJEU) has been busy. It has released a number of significant judgments or opinions since its new term began in September. Interestingly, out of the 20 since then, five arise out of the operations of the tech giants or the workings of the internet. I will focus on these, since they are likely to continue to have an impact regardless of how Brexit pans out.

As background, the court now has the staffing to stay busy. Its General Court, previously composed of 46 judges, added 7 additional judges in late September, in accordance with an agreed reform programme. At the same time, it inaugurated a new building, presumably to house its growth.

Google appeared in three of the new tech judgements.

In GC and Others v Commission nationale de l’informatique et des libertés (CNIL) (Case C-136/17), a number of people complained to the French data protection authority, CNIL, that data relating to sensitive areas continued to show up in Google searches. These sensitive areas include political opinions, religious or philosophical beliefs, criminal offences, and sex life. There are provisions in the 1995 data protection directive (95/46/EC) which contain prohibitions imposed on data controllers on processing data falling within these categories.

The question for the court was whether these prohibitions apply also to the operator of a search engine like Google. The answer was that they do, and that if there is a request for removal (called de-referencing), a balance must be struck by the search engine between the fundamental rights of the person requesting the de-referencing and those of internet users potentially interested in the information. A large burden is placed on search engines as a result - but they have the resources to cope.

On the same day, the court decided another Google case, again involving CNIL and de-referencing - Google LLC, successor in law to Google Inc. v CNIL (Case C-507/17). CNIL had fined Google €100,000 because Google refused, when granting a de-referencing request, to apply it to all its search engine’s domain name extensions. In other words, it could still be accessed through foreign versions of Google search, but not in any EU member state’s version.

The question for the court was whether – under the same 1995 data protection directive - the de-referencing had to be carried out on all versions of Google, or only on EU member states’ versions, or indeed only on the version where the complainant resided. The court held that Google is not required to carry out a de-referencing on all versions of its search engine. But it is required to carry out that de-referencing on the versions corresponding to all the Member States and to put in place measures discouraging internet users from gaining access, from one of the Member States, to the links in question which appear on versions of that search engine outside the EU. The UK’s position will therefore change once it leaves the EU. 

Finally, and more technically, a German provision prohibiting internet search engines like Google from using news snippets without the publisher’s authorisation must be disregarded in the absence of its prior notification to the European Commission - VG Media Gesellschaft zur Verwertung der Urheber- und Leistungsschutzrechte von Medienunternehmen mbH v Google LLC (Case C-299/17).

Facebook was in the firing line in a Google-like case, but this one was referred to the court under a different directive, the 2003 electronic commerce directive (2000/31/EC). In the case of Eva Glawischnig-Piesczek v Facebook Ireland Limited (Case C-18/18), an Austrian Green politician had been defamed and insulted on a Facebook page. After a successful Austrian court case against Facebook, it disabled access in Austria. Inevitably the case went further up the court chain.

The question before the court was whether a member state’s court could oblige Facebook to remove or block access to the information, whether it was identical or equivalent to the original posting, and whether that order could have world-wide effect. The court said a Member State court could so oblige. If the information was equivalent and not identical, the monitoring and search for the information must be limited to information which remains essentially unchanged compared with the original content, and provided that the differences in wording are not such as to require Facebook to carry out an independent assessment. A world-wide order could be made within the framework of international law.

Once we leave the EU, this option will not be open to UK Facebook users, since the judgment is based on an EU directive.

The last internet-related case decided that storing cookies requires internet users’ active consent, and a pre-ticked checkbox is insufficient - Bundesverband der Verbraucherzentralen und Verbraucherverbände ̶Verbraucherzentrale Bundesverband eV v Planet49 GmbH (Case C-673/17).

The EU’s struggle to regulate the tech giants continues.