PH Privacy

The Right to be Forgotten Held to Apply Only to Europe in Landmark European Court of Justice Decision

September 25, 2019

Bianca Ponziani

In a decision published earlier this week, the European Court of Justice (the “ECJ”) held that the geographic scope of the European privacy right referred to as “the right to be forgotten” need only extend across European Union (“EU”) member states.

The underlying dispute goes back to 2015: France’s data protection authority, the Commission nationale de l’informatique et des libertés(“CNIL”), imposed a €100,000 fine on Google Inc., now Google LLC (“Google”), for refusing to comply with a formal notice to scrub or “de-reference” across all versions of its search engine links to web pages containing personal information about a user, rather than across only those versions of Google’s search engine associated with EU member states (e.g., www.google.fr).

Under European law, residents have a “right to erasure” or the “right to be forgotten” upon request if the data at a particular URL are determined to be “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.” The right is not absolute, but it is extensive and has resulted in a number of successful erasure requests within Europe.

The CNIL had argued that de-referencing an individual globally best protects an individual’s right to privacy and was required under European law.  However, the ECJ evoked the principle of proportionality in considering the appropriate balance between the right to the protection of personal data, which is not absolute, and other fundamental rights such as the freedoms of expression and information.  The ECJ also acknowledged that the internet “is a global network without borders,” and there are sometimes conflicting jurisdictional approaches to recognizing—or not recognizing—the right to be forgotten.

The judgment is important as it allows search engines and others to refuse requests to erase information from non-European versions of their engines or databases. The CNIL, while “tak[ing] note” of the ECJ’s judgment, notes certain language in the Court’s decision that, in CNIL’s view, continues to allow it to force global delisting where necessary to “guarantee the rights of the individuals concerned.”
The CNIL promises to release FAQs “in the coming days” that will explain how it plans to respond to the Court’s judgment moving forward.  This is unlikely to be the end of matters, but it also undoubtedly strengthens the hand of non-EU actors facing these requests.