The case at stake concerned the dispute between the French Data Protection Authority (CNIL) and Google Inc. in relation to the order, addressed to the firm, to remove allegedly harmful or false information about a person from all its domain name extensions.
The company refused to implement the order, confining itself to implementing a geo-blocking measure that prevented European users from being able to access the links at hand, but the content of those links remained accessible from the rest of the world. These measures were not considered to be adequate by the CNIL, which consequently imposed a €100.000 fine on Google.
Before going into the court’s arguments, it is worth highlighting the major impact that the ruling on the right to be forgotten has had for European citizens from 2014 to date. Known also as the “right to erasure”, it expressly appears in Recitals 65 and 66, as well as in Article 17 of the General Data Protection Regulation 2016/679 (GDPR), and grants individuals the right to obtain from the controller the de-listing of their personal data, if certain circumstances are met.
In particular, the right to be forgotten is considered as being the right of the data’s subject to no longer allow the flow of personal information which, although legitimately published during a given period of time, are no longer of public interest or no longer represent his/her personal identity.
According to Google, since it started to implement the 2014 ECJ decision, it has already received more than 800,000 requests to remove a total of about 3.3 million links, and it is reasonable to expect that these numbers may increase. The impact of this right has been so significant that the Article 29 Working Party (replaced by the European Data Protection Board on 25 May, 2018) drew up guidelines containing criteria by which to guide the European national authorities in their decision-making on issues relating to the exercise of this right. As to the territorial extension of the right to be forgotten, the Article 29 Working Party suggested – in its guidelines – that any de-listing order should have been implemented globally (on any domain, .com included), i.e., beyond the EU borders
The ECJ has issued a decision which goes in the opposite direction.
Firstly, it emphasized that many non-EU States do not recognize the right to de-referencing, or they have a different approach to it, further stating that the right to the protection of personal data, which is not absolute, must be balanced against other fundamental rights, and that this balance may vary considerably around the world.
Secondly, the court pointed out that the European legislator, when balancing the rights in question, did so with exclusive reference to the European Union, and a different conclusion is also not reachable by the wording of the provisions contained in either Directive 95/46 and/or the GDPR. In addition, the GDPR itself does not provide for cooperation instruments and mechanisms relating to the removal of information outside the EU, as occurs for the Member States.
In its statement, the ECJ concluded that “currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject […] to carry out such a de-referencing on all the versions of its search engine.”
However, the court’s decision in no way excludes the possibility that a person have his or her information globally removed. Indeed, it specifies that the weighing of a data subject’s right to the protection of personal data, on the one hand, and the right to freedom of information, on the other, falls within the competence of each Member State’s supervisory and judicial authorities, and that such authorities, where appropriate, may require the search engine operator to remove the information from all its domain name extensions.
Nevertheless, the legal grounds on which the European national authorities will base these requests remain unclear, given that the ECJ has made it evident that no European legislation provides for such an extension outside the EU.
