Google do not have to apply the “right to be forgotten” globally: European Court of Justice

The European Court of Justice (ECJ) which is the highest court in the European Union (EU) has ruled that search engines like Google are not under any obligation to apply the “right to be forgotten” globally. This is a major legal victory for Google. It means that Google only needs to remove links from its search results in Europe - and not elsewhere - after receiving an appropriate request.

The ECJ elucidated that this move was attempted at balancing two competing ideas: the right to personal privacy and the right to freedom of information. Although Google shall have to handle any right to be forgotten requests from EU citizens and take appropriate steps to remove information from European versions of its search pages for instance Google.fr or Google.de, it does not need to scrub such information from its non-EU pages (for instance Google.com).

The ECJ ruling on the right to be forgotten stemmed up from an ongoing dispute between Google and French privacy regulator CNIL. In 2015, the CNIL told Google to apply any right to be forgotten takedown requests globally. However Google had refused to comply with this request. Consequently in 2016, the CNIL levied a fine of more than $100,000 against Google. Google protested and appealed to the French Council of State, which in turn took the case to the European Court of Justice. Since the ECJ is the highest court in the EU, this is a final decision on the matter within Europe.

Since Google presents itself as a way for the world to find the information it needs, Google is of the opinion that such right to be forgotten requests are an unnecessary hindrance. In its defense, Google pointed to news organizations such as the BBC, which are not obligated to respond to right to be forgotten requests to which the court agreed.

According to Konstantinos Komaitis, Senior Director, Policy Development and Strategy at the Internet Society, “This is a big victory for the Internet and it limits the reach of EU law. The GDPR affirmed the European Commission’s position as the de facto global regulator in the Internet, raising serious concerns over the unintended consequences the extraterritorial nature of laws can have on the Internet. This case could have further solidified the EU’s status and could have intensified the various regulatory tensions we see globally.”

Google had argued that the obligation could be abused by authoritarian governments trying to cover up human rights abuses were it to be applied outside of Europe. Further, it also argued that it worked hard to implement the right to be forgotten, but that it was unwilling to make this a global, absolute right. Instead, Google developed a geolocation tool that enabled it to figure out where search requests were being carried out, and from which of Google’s search domains. Thus, someone carrying out a search request from the United States would be able to see information that someone carrying out the exact same search request from, say, France or Germany, would not be able to see.

What is the right to be forgotten?

Also known as the “right to erasure”, the rule gives EU citizens the power to demand data about them be deleted. In the case of search engines, Europeans have had the right to request links to pages containing sensitive personal information about them be removed since 2014.