The internet forgets – but only in Europe

Those who would like to remove unpleasant search engine hits about themselves have had a strong hand for quite some time. Owing to a decision of the European Court of Justice (CJEU) from 2014, Google and others are obliged to erase traditional hits provided that the right to information and expression is less important than the data subject’s right to privacy. To date it had been unclear whether the erasure had to be carried out worldwide. Now the CJEU has commented on this question and set territorial limits on the ‘right to be forgotten’.

Background

On the basis of European data protection law and the Charter of Fundamental Rights, the CJEU had ruled that the erasure of personal search engine hits may be permitted on a case-by-case basis. It said there was a legitimate interest in exerting influence on one’s personal external image and in having the search engine operators remove such links as appear after entering one’s own name but which are no longer current or for other reasons no longer establish a public interest worthy of protection. Even if the linked content which still remains is correct or lawful, erasure of the entry is possible. There was critical discussion afterwards about impending censorship and many unanswered questions which the ruling had left among readers and data subjects.

Apart from problems of practical implementation, in particular it was not settled from whom the links complained about must remain hidden in a territorial respect. European law had been the basis for the judgment. However, the display of personal search results by retrieval queries outside of the EU can have an equally detrimental effect on the right to privacy.

The dispute about this finally culminated in a legal action between Google and the French Data Protection Authority, CNIL. The authority had unsuccessfully called for Google to implement erasure requests on all its platforms and finally imposed a penalty on the search engine operator. Google filed an action against this with the Conseil d’État (Council of State, France), which referred the matter to the CJEU with a request for a preliminary ruling.

The decision of the CJEU (C-507/17)

The Court rejects the most restrictive solution model. The CJEU rejects erasure only within the State where the applicant claims the erasure in view of the GDPR, which applies directly to all Member States and aims to guarantee a uniformly high level of data privacy.

The Court reserves considerable sympathy for a global erasure obligation, however. It says that in the ubiquitous internet the right can only be extensively enforced if hits are withdrawn from the access of all users. However, the Court does not accept the global application of the ‘right to be forgotten’ in view of the limits of the applicable law. It says that the legislator did not choose to extend the underlying data protection rules beyond the territory of the Member States. In addition, the Court says that third countries frequently pursue a different legal approach to the matter and that the necessary decisions on balancing competing interests are taken very differently around the world.

However, this restriction to the territory of the European Union does not only mean that the search results are accessible in third countries. European users can also generally inform themselves via their search portals. In order to ensure effective legal enforcement at least within the European Union, the CJEU therefore requires the search engine operators to take ‘sufficiently effective measures’ to prevent the access to the links concerned. In other words, they are required to hide the contentious display of results in the search engine service of the third countries for users within the European Union via geoblocking.

However, the CJEU has kept open a backdoor for extraterritorial hiding of challenged search results. Since EU law does not provide for worldwide erasure, but also does not forbid it, the national supervision and judicial authorities are authorised, provided that the data subject is overwhelmingly worthy of protection, to have the search engine operator hide links on all its internet portals.

Conclusion

The ‘right to be forgotten’ has reached both legal and technical limits. The decision of the CJEU limits the extent of a claim for erasure to Europe and also cannot eliminate the problem of evasion. Because bypassing IP blocks requires little effort for the savvy internet user today, access to hidden links will remain possible within the European Union. On the other hand, the EU does not therefore impose a misunderstood role model influence on other countries which are seeking global control of information for less democratic motives. The CJEU has stopped short of specifying, however, in what special circumstances a global erasure obligation should nevertheless be possible.