The EU’s top court has ruled in favour of tech giant Google in a landmark case about the ‘right to be forgotten’, but privacy and legal experts have warned the issue has not been fully resolved.
The European Court of Justice’s (CJEU) decision means that Google does not need to remove links from search results outside of Europe when carrying out an individual’s right to be forgotten.
Go deeper with GlobalData
The right to be forgotten was solidified in European law in 2014 as a human right and allows individuals to request delistings of information they deem to be “inaccurate, inadequate, irrelevant, or excessive”.
For example, a victim of ‘revenge porn’ can request the page to no longer show up in online search results.
It was given greater legal clout under Europe’s General Data Protection Regulation (GDPR), introduced in 2018, where it is known as the right to erasure.
Today’s ruling stems from a 2015 court case in France. CNIL, France’s privacy watchdog, fined Google €100,000 in 2016 for refusing to remove sensitive information from its search results at a global level.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIt argued that the right to be forgotten should be applied globally as people could simply switch to a version of Google from another country and circumvent a person’s right to be forgotten.
Google argued that this would give authoritarian governments the ability to censor human rights abuses.
What was said in the right to be forgotten ruling
The court said that it had to strike a balance between the right to privacy of individuals against the freedom of information for internet users.
In its ruling, the European Court of Justice (CJEU) said:
“Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject… to carry out such a de-referencing on all the versions of its search engine.”
It added that EU law still requires Google and other search engine operators to deli-reference in EU member states when applicable. The court also pointed out that the right to be forgotten ruling does not “prohibit” a search engine from delisting personal data outside of Europe if it wishes to do so.
In a statement after the ruling, Google said:
“Since 2014, we’ve worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people’s rights of access to information and privacy. It’s good to see that the Court agreed with our arguments …”
Google was supported by Microsoft, the Wikimedia Foundation, among others, in the right to be forgotten case.
“The CJEU has just created some massive black holes”
The right to be forgotten ruling is one of the biggest legal tests that the GDPR has faced since being introduced last year.
Privacy and legal experts say it solves one immediate issue but raises further questions about the privacy rights of EU citizens around the world.
“This ruling is bad news for the European lawmakers who envisaged the GDPR to protect the privacy rights and freedoms of all EU citizens without any limit or constraints,” said Jamal Ahmed, a privacy consultant for Kazient Privacy Experts.
“The CJEU has just created some massive black holes and it will be interesting and worrying to see how Google and other organisations react.”
He added that it raises questions for how GDPR should be adhered to outside of Europe and how multi-national organisations should apply it.
Jane Ashford-Thom, reputation protection associate at law firm Harbottle & Lewis said:
“This issue has still not been finally resolved as the Court does not exclude the possibility that individual member states can require a de-referencing to be carried out on all versions of a search engine in the future.”
Local laws in a global world
Roz Sheldon, head of client services at Igniyte, a reputation management company, said that the decision is the only one that “can be made at this point” because of disparities in privacy laws around the world.
“However, in practice, there are other considerations to take into account for the right to be forgotten,” she said. “Many businesses are global and those doing employee checks will be able to view differing regional versions for the individual.”
For example, if an individual applies for a job outside of the EU, a minor offence or negative story ranking on Google outside of Europe could impact their employment prospects, she explained.
Camilla Winlo, director of consultancy at DQM GRC, a data governance and privacy consultancy said:
“The challenge with the CJEU ruling is that only links in the EU will be affected – links outside the EU will not. This means that, whilst the information may become more difficult to find in certain locations, it will not truly be forgotten and could still be accessed if you know where to look.
“This is a problem that we face with local laws in a global world.”
However, Thomas Hughes, executive director of Article 19, a not-for-profit involved in the case, told the Financial Times that the ruling a “victory for global freedom of expression”.
“Courts or data regulators in the UK, France or Germany should not be able to determine the search results that internet users in America, India or Argentina get to see,” he said.
Read more: The Facebook transatlantic data transfer case explained
Lucy Ingham 1:35 P
