The geographical scope of the “Right to be Forgotten.” A review of the CJEU case Google vs. CNIL

Photo by Christian Wiediger on Unsplash

The territorial scope of European rules

What are the boundaries of the “right to be forgotten”? What is the territorial scope of legal systems in the digital world?

A few months ago, the Court of Justice of the European Union (CJEU) ended a 5-year dispute between Google and the French Data Protection Authority (CNIL) about an order to remove links from search results all over the world due to a “right to be forgotten” request. In this case, the European court agreed with the search engine’s arguments and limited the scope of the removal to Europe.

The CJEU has also canceled a 100,000 euros fine imposed on Google by the French authority for not removing the links globally.

The “right to be forgotten”

In May 2014, another CJEU ruling (C-131/12, EU: C: 2014: 317) recognized a “right to delist”, which means that European citizens and residents are entitled to ask search engine operators like Google to block results linking to their names that could be considered “inappropriate, irrelevant, no longer relevant or excessive”.

That rule applies even if the source publication is lawful, as long as there is no predominant public interest in accessing the information (e.g.: role played by the person in public life).

Nevertheless, one of the gaps in the 2014 ruling relates to the scope of the removal. In which domains should that happen: complainant’s country? All European versions? Global removal?

Google’s approach was to keep the geographical limitation to the European Union, as any other interpretation could violate international law principles such as courtesy and non-interference.

That could also impose a disproportionate limitation on public liberties: freedom of expression, information, communication and press, as those are also protected in the Charter of Fundamental Rights of the European Union.

On the other hand, the French authority argued that only the removal of the information from all versions of a search engine could fully respond to the goal of Directive 95/46, and the GDPR, which is to ensure a high level of protection of personal data throughout the EU.

Preliminary questions to the European Court

The French “Conseil d’État” (acting as Supreme Court of Contentious-Administrative) has raised three questions to the CJEU:

1. Would a search engine operator be obliged to proceed with such removal with respect to all of the (country code) domains used by its tool?
2. If not, would they only be obliged to remove the controversial links from the results in the domain name corresponding to the State from where the request was submitted or, more generally, for the domain names used for all of the Member States?
3. As a complement to the previous obligation, should you also block the results, by using the technique called “geo-blocking”, for an IP address supposedly located in the claimant’s State of residence, or even more generally, for IP addresses deemed to be located in one of the Member States subject to the Data Protection Regulation, regardless of the domain name used by the Internet user conducting the search?

Different sensibilities in other parts of the world

The solution introduced by the CJEU of limiting “RTBF” removals to the European versions of Google is the result of a balancing individual rights to data protection and a collective right to freedom of information.

The court recalls that the rights are not absolute and that the balance between these values “can vary significantly in different parts of the world.”

They also emphasize that the European regulatory framework doesn’t imply that the scope of legislation should go beyond EU boundaries.

However, the CJEU recalls that although EU law doesn’t currently require that the removal takes place from all versions of a search engine, it also doesn’t prohibit such a practice either, depending on standards of protection of fundamental rights at each Member State.

In sum, there’s still an open window for similar disputes to happen in the future. According to the data published at Google’s transparency report, they’ve received almost 900,000 removal requests to date based on the “right to be forgotten.” 45% of the URLs requested for this reason ended up being blocked in Europe.