CJEU Clarifies GDPR De-Referencing Obligations for Search Engines
The CJEU ruling in C-460/20 establishes that search engines like Google have distinct data processing responsibilities separate from original publishers, meaning they cannot simply defer to a publisher's editorial decisions when handling de-referencing requests under GDPR Article 17. Critically, the burden of demonstrating 'manifest inaccuracy' of information falls on the individual requesting removal, not the search engine. This matters because organizations acting as data processors or controllers must understand their specific legal obligations under GDPR, including the right to erasure, and implement clear, auditable workflows to evaluate and respond to such requests. Failure to properly handle de-referencing requests — or misunderstanding the scope of one's role — exposes organizations to regulatory scrutiny and reputational risk.
Tactical Insight
Immediate actions
- Establish a documented intake process for GDPR Article 17 right-to-erasure and de-referencing requests, including defined response timelines.
- Train legal, compliance, and data teams on the distinction between controller and processor obligations following this ruling.
Policy & Governance improvements
- Develop a formal balancing test framework to evaluate de-referencing requests against freedom of expression rights, ensuring consistent and defensible decision-making.
- Maintain an updated data processing register that clearly documents what content is indexed, why, and under which legal basis per GDPR Article 30.
- Define escalation paths for ambiguous or contested de-referencing cases, including criteria for what constitutes 'manifest inaccuracy.'
Monitoring & Audit measures
- Conduct periodic audits of de-referencing request handling to verify decisions align with current CJEU and national DPA guidance.
- Implement logging of all data subject requests and outcomes to demonstrate accountability and compliance to supervisory authorities.