The Court of Justice of the European Union (CJEU) has clarified the geographical scope of the ’right to be forgotten’ as only applying within the EU.
Since the 2014 judgment of Google Spain v AEPD, EU citizens could request that Google and other search engines de-list search results relating to them that are “inaccurate, inadequate, irrelevant or excessive”. In a decision welcomed by a broad alliance of free speech NGOs, the Court said that the de-listing could not be applied beyond EU borders. Lawyers for these groups highlighted the threat that they felt the Google Spain decision posed to global freedom of expression, given that the mechanism could be manipulated and that such a right is not universally recognised.
The case was a result of a preliminary reference from the French Conseil d'État in a dispute between Google and the French data protection authority, Commission Nationale de l’Informatique et des Libertés (CNIL). Google had been ordered by the CNIL to carry out a de-referencing in accordance with EU law. Google granted the request but refused to apply it globally. As a result, the CNIL fined them €100,000, a decision which Google appealed to the Conseil d'État. The Conseil d'État asked the CJEU to clarify its decision in Google Spain. It asked whether EU rules on data privacy should be interpreted as requiring a search engine to de-list links only within the Member State of the person benefiting from the de-referencing, only within the EU or worldwide.
In coming to its decision, the Court gave some insight into its views on the protection of personal data. It said that data privacy is not an absolute right and must be balanced with other rights such as freedom of information and free speech. It also noted that this balance is not viewed in the same way worldwide and that many third states either do not recognise the right to de-referencing or have a different approach to that right.
The Court, therefore, concluded that there was no obligation under EU law for search engines to carry out de-referencing on all versions of their website. Under EU law, if a de-referencing request is made, a search engine is only required to carry out the de-referencing on versions of the website in the Member States of the EU. However, in these circumstances, the search engine is still required to take sufficient measures to ensure the effective protection of the relevant individual’s fundamental rights. This means that the de-referencing may need to be accompanied by measures that prevent or seriously discourage an internet user within the EU from conducting a search of the de-referenced links via a version of website outside the EU, perhaps by changing a computer’s IP address. It will be up to the national courts to determine whether such measures are sufficient.
The Court also highlighted that, although it doesn’t require global de-referencing, it does not prohibit it either. Member State authorities can still weigh up the data subject’s rights to privacy on the one hand, and the right to freedom of information on the other and, where appropriate, order a de-referencing on all versions of the search engine.
Click here for the full judgment.