The “right to be forgotten” is not an absolute right

The « right to be forgotten » is not an absolute right. It has to be balanced against the freedom of information and expression, which is particularly protected in the case of a media organisation.

Tribunal judiciaire de Paris, 17th Chamber, judgment of 30 June 2021, M.X./ 2 Minutes France

The facts and the procedure

Mr X, former President, from December 2002 to August 2004, of the « Racing Club de Paris », the football section of the Racing Club de France, was convicted for his management of the club. He was found guilty of complicity in breach of trust, receiving goods obtained with the help of a breach of trust, and abuse of corporate assets, and was sentenced on 12 June 2009 by the Nanterre Criminal Court to two years’ suspended imprisonment and a fine of 20,000 euros. In a ruling handed down on 16 February 2011, the Versailles Court of Appeal partially overturned the first instance judgment[1].

On 15 June 2009, an article was published on the website of the newspaper ’20 Minutes’, entitled « Il détournait de l’argent pour un club » (He embezzled money for a club).

Mr X noted that the article was still present in the local news section of Parisian life and was not listed or identified in the online newspaper’s archives, that it conveyed outdated information due to the Versailles Court of Appeal’s ruling that partially overturned the judgment referred to. Mr X then gave notice to ’20 Minutes’ to delete the article in question or at least to make it anonymous and to take the necessary steps within 72 hours to ensure that it was no longer indexed by search engines in accordance with Articles 17 and 21 of the GDPR. He based his action on the fact that the personal data processed is obsolete, outdated, and irrelevant to readers, given the age of the facts (over 15 years). He also criticised the newspaper for not mentioning the partial acquittal and the reduction in the prison sentence from which he benefited. An update of the article published on 15 November 2019 was the only response from the media. The plaintiff sued ’20 Minutes’ before the Paris judicial court.

The parties’ arguments

Mr X relies on Articles 17 and 21 of the GDPR[2] and Articles 51 and 56 of the Act of 6 January 1978 on Data Processing, Data Files and Individual Liberties, clarified by the case law of the CJEU. He considers that the mention of his conviction falls under the heading of sensitive personal data and that, in view of the particular gravity of the interference in his right to privacy and to the protection of his personal data, the data controllers should justify how keeping the article online is strictly necessary to protect the freedom of information of Internet users.

On the basis of Article 17 of the GDPR (Article 51 of the Act of 6 January 1978), which establishes a « right to be forgotten », he requested the deletion of his personal data, considering that they were not necessary for the exercise of the right to information and freedom of expression. Referring to Article 21 (Article 56 of the Act of 6 January 1978), he objects to the processing of his personal data without providing legitimate and compelling reasons for doing so.

Finally, he reiterated his request for dereferencing on all search engines and further intended to rely on the fact that the operator of a search engine must, as a matter of principle and in accordance with the case law of the CJEU and the Court of Cassation, dereference links dealing with a person’s sensitive data, such as criminal convictions, unless the inclusion of the disputed links in the list of results proves to be strictly necessary for freedom of information and expression.

’20 Minutes France’ emphasised the freedom of expression affirmed by Article 10 of the European Convention on Human Rights (ECHR), a freedom that can only be restricted when there is a compelling social need. It adds that the right to erasure and the right to object do not apply when the data processing in question is necessary for the exercise of freedom of expression, as is clear from the provisions of Recital 65 and Article 17(3) of the GDPR, as well as from the exemptions provided for in Article 80 of the French ‘Loi Informatique et Libertés (Data Protection Act)[3].

The court’s position

The Paris judicial court rules in favour of freedom of information. The GDPR (recitals 4 and 65) « is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons; » « The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. » The GDPR reconciles the « right to be forgotten » (Art. 17) with the right to privacy, the right to freedom of expression and information guaranteed by Article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR)[4].

Article 21 of the GDPR also provides for a reconciliation with the right to freedom of expression and information. If the data controller is a media organisation, using this text to require it to remove personal data from an article, thereby depriving the article of any interest, would be likely to exceed the restrictions that can be placed on the freedom of the press.

A press publisher is not a search engine

‘SAS 20 Minutes’ is a press publisher and carries out a journalistic activity consisting of implementing freedom of expression, particularly in the context of articles that may be posted on its website. The provisions on the « right to be forgotten » do not apply if the processing of personal data « is necessary for the exercise of the right to freedom of expression. » The activity of a press publisher is not comparable to that of a search engine whose main interest is not to publish the initial information on the person concerned. The role of the latter is to make it possible, on the one hand, to identify any information available on that person and, on the other hand, to establish a profile of that person. The case law of the Court of Justice of the European Union applies to search engines and is therefore inoperative in this case[5].

The GDPR cannot be used to block press articles

As the court pointed out, the right to protection of personal data cannot make press content published on the Internet disappear at the first request. The mention of identification details and the mention of criminal convictions are part of the citizen’s right to information. The criminal conviction of an official who chaired a well-known sports club is part of the recurrent subject of the relationship between sport and money. Its mention therefore contributes to informing the public. The age of the article contributes to the formation of democratic opinion and enables the reader to be informed, not only on the basis of current events, but also on the basis of older information that remains relevant to the subject of general interest. The non-inclusion of the criminal conviction on the second section of the criminal record does not remove the informative value of the press article. This public interest would also be compromised by anonymisation requested by the complainant, which would exceed the restrictions that can be placed on the freedom of the press.

The court found that keeping the article online did not constitute a disproportionate infringement of his right to privacy. The criminal conviction referred to in the article has already been pronounced in open court and has been the subject of various press articles. It has not been widely circulated, appearing in the 4th position of a Google search with the mention that it has not been commented on or shared. But with his appeal to the court, the complainant will undoubtedly experience the « Streisand effect », of which this comment is just one manifestation…

[1]The Court of Appeal found Mr X guilty of the offences of breach of trust and handling stolen goods and ordered the exclusion of his conviction from the second section of his criminal record, reducing his suspended prison sentence to one year and increasing the fine to 30,000 euros.

[2] European General Data Protection Regulation (EU) No. 2016/679 of 27 April 2016

[3] Processing of personal data for the purposes of journalism and literary and artistic expression.

[4] Article 11 of the Charter of Fundamental Rights of the European Union.

[5]The right to dereference—or « right to be forgotten »—is one of the consequences of the CJEU ruling of 13 May 2014, Google Spain and Google (C-131/12). If it does not remove the material that the complainant believes violates their privacy, it removes the links to the web pages that the search engine offers. The CJEU (Grand Chamber) judgment of 24 September 2019 (C-136/17, GC, AF, BH, ED v Commission nationale de l’informatique et des libertés-CNIL) held that information relating to legal proceedings must be dereferenced if it no longer corresponds to the current situation, once it is found that the rights of the individual prevail over those of the Internet user. However, in the case of maintenance justified by the freedom of information of Internet users, the search engine must arrange the list of results « in such a way that the resulting overall picture for the Internet user reflects the current judicial situation. »