The Right to Be Forgotten is Taking Shape: CJEU Judgments in GC and Others (C-136/17) and Google v CNIL (C-507/17)

On 24 September 2019, the Court of Justice of the European Union issued two judgments further delineating the scope of the right to be forgotten in the context of search engines. In GC and Others (C-136/17), the Court decided that a search engine operator must only verify the lawfulness of its processing of sensitive data ex post , i.e. upon receiving a request for de-referencing. While lowering the level of protection of the right to data protection, this decision has to be understood as an act that brings the processing of sensitive data by search engines out of the grey area caused by the Court’s decision in Google Spain and Google (C-131/12) and into the sphere of legality. In Google v CNIL (C-507/17), the Court had to determine the territorial scope of the right to be forgotten. It established a general rule of EU-wide de-referenc-ing in connection with measures preventing or at least seriously discouraging access to non-EU search results. This leaves space for non-EU States to find their own balance between data protection and freedom of information. Both decisions can be considered a balancing act of the Court in attempting to reconcile the often very diverg-ing rights and interests of the involved subjects, this time mostly at the expense of the right to data protection.