Google will not have to apply Europe’s right to be forgotten law globally, the European Union’s top court ruled on September 24. Google only needs to remove links from its search results for 28 member countries of the European Union — and not elsewhere — after receiving an appropriate request to do so.
Why it matters: It ends worries around free speech. Google was concerned that if one country started dictating Google search results for everyone else, it would be a slippery slope: meaning that other countries would start doing it as well.
Where did this case come from? The ruling comes from a dispute between Google and the French Data Privacy Regulator, CNIL. In 2015, CNIL had ordered Google to globally remove some search listings containing damaging or false information about a person. Google refused to do so, and only removed the links in question from its search engine’s EU sub-domains. The company stated that the right to be forgotten does not mean that search listings be removed without any geographical limitations. For this, CNIL tried to impose a €100,000 penalty on Google, which the company appealed to the Court of Justice of the European Union (ECJ).
Who has the Right to be Forgotten (RTBF)? Citizens of the 28 member countries of the European Union. Europeans have had the right to request that links containing sensitive personal information about them be removed from search engines since 2014, when the ECJ passed a ruling. The GDPR, which came into effect in 2018, added further obligations, allowing people to request an organisation “verbally or in writing” to remove such content from search results and required the organisation to respond within a month.
What did the Court of Justice at the European Union say?
The court concluded that there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine.
The court argued that:
- Numerous third states don’t recognise the right to dereferencing or have a different approach
- The right to personal data protection is not an absolute right and must be proportional
- The balance between right to privacy and personal data protection in one hand, and the freedom of information of internet users is likely to vary significantly across the world
The court also said that EU had not defined the scope of de-referencing outside the EU.
How do companies implement Right to be Forgotten? European citizens who find sensitive personal information about themselves online can ask that the search engines delist those results. Google does this by “de-referencing” pages at a regional level and also applies the right to be forgotten on local versions using IP addresses and geo-blocking.
What was Google’s defence? Google had argued that removing search listings globally would damage free speech and provide authoritarian regimes to remove unfavourable listings removed from search engines and internet. Google made two arguments:
- People could use the RTBF to hide information of public interest, “like a politician’s political views, or a public figure’s criminal record” and deplete the public’s right to know.
- Second, it said the EU shouldn’t be allowed to implement its own laws in other countries.
“We—and a wide range of human rights and media organizations, and others, like Wikimedia—believe that this runs contrary to the basic principles of international law: no one country should be able to impose its rules on the citizens of another country, especially when it comes to linking to lawful content. Adopting such a rule would encourage other countries, including less democratic regimes, to try to impose their values on citizens in the rest of the world.”
Google was backed by Microsoft, Wikipedia’s owner the Wikimedia Foundation, and the non-profit Reporters Committee for Freedom of the Press, among others.
How often has RTBF been exercised? According to the 2014 ruling by the European Court of Justice, Google had to delist URLs that are “inadequate, irrelevant, or no longer relevant or excessive”. Ever since then, Google has received nearly 850,000 requests to remove 3.3 million URLs. 45% of these URLs were removed from search results.