CA - RG n° 22/01814
| CA - RG n° 22/01814 | |
|---|---|
 | |
| Court: | Court of Appeal de Chambéry (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 14 GDPR Article 17(1)(d) GDPR Article 17(3)(a) GDPR Article 82(1) GDPR |
| Decided: | 22.05.2025 |
| Published: | |
| Parties: | Google France Google LLC Google Ireland Limited |
| National Case Number/Name: | RG n° 22/01814 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | French |
| Original Source: | Cour de Cassation (in French) |
| Initial Contributor: | ap |
A court ordered Google to delist a health professional from “Google My Business” within two months and awarded damages in the amount of €50,000.
English Summary
Facts
A dentist (the data subject) found a listing of her on Google My Business (GMB) in 2017, which included personal data, reviews and ratings related to her professional activity. The data subject requested Google France to delete the reviews and remove the reviews function from her listing. After a refusal from Google France and Google LLC, the data subject brought a case to the Chambéry regional court. This court ordered in 2019 Google France, Google LLC and Google Ireland to disclose the authors of the negative reviews. After being unable to remove half of the negative reviews, the data subject brought a request for interim relief to the Paris Regional Court in order to delete the listing. This was refused, and the data subject brought the request to delete to the Court of Chambéry. In 2022 this Court stated that the Google companies did not have a legitimate interest in processing the data subject’s data without her consent. Google had also not complied with the principles of fairness and transparency. Finally, the Court ordered the Google companies to delete the data subject’s listing on GMB. The Google companies were also jointly liable for non-material and procedural damages. The Google companies appealed the case the same year.
The Google companies argued that the processing was justified by the legitimate interest of providing users with the means to evaluate professionals and receive information about their work. Furthermore, Google France argued that the case was inadmissible, as it was not involved in the Google services in question. The data subject argued that Google France operates the services based on case law Google Spain, and requested the Court of appeal to uphold the reasoning of the previous Court.
Holding
The Court first stated that Google France did not have standing in this case, as it was not the operator of the search engine or the owner of the www.google.fr domain. According to the Court, the terms of service refer to Google Ireland, and the correspondence between the data subject and Google France refer systematically to Google LLC. Google LLC and Google Ireland will be referred to as “the Google companies” or “Google”, as they were held jointly liable.
The Google companies processed the data subject’s data without the latter’s consent, based on information from Infobel and the data subject’s internet service provider. These facts from the Chambéry Court were not disputed by Google. The Court did not consider the information sensitive personal data, as it related to the data subject’s professional activities. The Court also considered data collection lawful, as it was obtained from companies that made the information available to it, and the information was also made publicly available by the data subject on her website.
The Court held Google liable for not complying with Article 14 GDPR, as it had not provided the relevant information to the data subject. This is relevant for calculating damages, but not for determining whether the listing should be removed.
The Court then analysed the legitimate interest of the data processing. Here, Google must balance their own rights and interests against those of the data subject. One aspect in this case is that the data subject can, free of charge, respond to notices and check the relevance of the reviews. However, this forces the data subject to create an account, which leads to new processing of data. Furthermore, in reviewing reviews, the data subject may not be able to refer to an individual as her patient, as it would breach her obligations of medical secrecy. Another aspect is the reasonable expectations of the data subject; the Court concluded that there was no reasonable expectation because the data subject did not consent and was not informed of the processing. Therefore, the processing is unlawful under Article 6(1) GDPR.
Since the processing is unlawful, the Court stated that the data subject could request the listing to be deleted under Article 17(1)(d) GDPR. The Court dismissed the arguments of freedom of expression (Article 17(3)(a) GDPR), due to the limitations of the data subject in assessing reviews, as well as the anonymous nature of the reviews and the lack of verification from Google.
In assessing the damages, the Court stated that while the comments were highly negative, Google could only be held liable in their capacity as hosts and not authors. This meant Google was liable if it had unlawfully refused to remove the reviews. The Court did not consider this applicable, as the content of the messages was not manifestly unlawful. The Court also dismissed the previous Court’s conclusions on Google’s parasitic acts. Parasitism is an act where an economic operator (e.g. a company) interferes with another with the aim of taking undue advantage of the latter’s efforts, knowledge, or reputation. Here, the Court argued that the data subject’s professional titles were only used to identify her to the public, and not as a means for further commercial use by Google. Furthermore, the data subject had not proved that the listing had a negative effect on her business.
The Court ordered Google to jointly and severally pay the data subject €50,000 in total- €10,000 for material and moral damages, €20,000 for procedural costs in the first instance, and €20,000 for procedural costs on appeal. In calculating the damages the Court did not take into account economic damage to the data subject. Instead, the Court considered the fact that the data subject had gone through several judicial processes to resolve the situation, and had been deprived of her right to object to the processing (Article 21(1) GDPR). In addition, the data subject suffered moral prejudice from the unverifiable negative reviews, which had not been removed despite multiple requests. The Court also ordered Google to delete the listing within two months of the judgment, subject to fines for noncompliance.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
JavaScript is not enabled in your browser. JavaScript is not enabled in your browser. To allow you to navigate our site correctly, it is necessary that it is enabled. How do I enable JavaScript? Chrome https://support.google.com/chrome Mozilla Firefox https://support.mozilla.org/fr/home Safari https://www.apple.com/support/safari/ Opera https://support.google.com/adsense/answer/12654?hl=fr Internet Explorer https://support.microsoft.com/product/internet-explorer
