Right to be forgotten…in Europe

Today (24 September 2019) the EU’s top court, the European Court of Justice, has ruled that the landmark “right to be forgotten” European law does not need to be applied globally.

The right to be forgotten principally regulates the obligation to erase data when certain circumstances arise with the idea being that sensitive information, such as criminal offences or affairs, can be hidden if the details are deemed to be “inadequate, irrelevant or no longer relevant or excessive”.

The ruling comes from a dispute between CNIL, a French data privacy regulator, and Google. The outcome means that Google only needs to remove links from its search results in Europe and not elsewhere.

In 2015, CNIL had ordered Google to globally remove search result listings to pages containing harmful or false information about a person. CNIL also tried to impose a €100,000 (£88,376) fine on Google on the basis that the firm had not censored search results outside of Europe. In 2016 a geo-blocking feature was introduced by Google which stopped European users being able to see delisted links, this was done by removing links from their European domains such as Google.co.uk and Google.fr as well as detecting when a search is being carried out from within Europe.

Following today’s ruling, Google’s senior privacy counsel has said “Since 2014, we’ve worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people’s rights of access to information and privacy. It’s good to see that the court agreed with our arguments.” Since the law was bought in 5 years ago, Google says it has received 845,501 “right to be forgotten” requests to remove a total of 3.3 million web addresses, with almost half of these requests leading to links being delisted.

Google, the world’s most popular search engine, has previously warned of the dangers of overreach by Europe, with previous blog posts stating that no one country should be able to impose its rules on another country and that there needs to be a balance between personal data and the public interest.

Despite the court’s ruling that there was no obligation under EU law for search engine operators to extend the law beyond EU member states, it was emphasised that measures must be put in place by to discourage internet users from going outside of the EU to find the information.

The right to be forgotten should still apply when the UK leaves the EU (with or without a deal), with a UK version of the GDPR being in force from day one, which will include a right to be forgotten.

If you have any questions about the right to be forgotten and the ruling’s impact on you or your business please contact our technology specialists.