Until recently, there was some ambiguity over whether the 'right to be forgotten' applied in the EU alone, or extended worldwide. In a landmark decision handed down on 24 September, the European Court of Justice has determined that the obligation on Google to remove content from its search results extends to Europe only and not worldwide. The decision will be a disappointment to individuals with a global reputation, seeking to mitigate the harm caused by out of data and inaccurate coverage.
The 'right to be forgotten' stems from a 2014 ECJ judgment, known as Google Spain. The case related to a post by a newspaper website in 1998, regarding the auction of Mr Mario Gonzalez's property for failure to pay social security debts. Mr Gonzalez settled the debts so the property was never auctioned, but the post continued to appear in Google searches for Mr Gonzalez's name when he brought the claim around 16 years later. Mr Gonzalez sought to have the link removed, and the ECJ ruled that search engine providers might have to de-reference (remove) links where the data is inadequate, irrelevant or excessive. Although there is no requirement for the original post to be removed (so you cannot erase it from the internet completely), individuals are able to make a request to prevent the link being displayed in search results relating to them.
The ECJ has now confirmed in a landmark judgment that this 'right to be forgotten' applies to EU member states alone. The case was brought by Google against CNIL, the French data protection authority, who had imposed a 100,000 euro fine on the search engine provider for refusing to apply de-referencing requests to all of its domain name extensions. CNIL had argued that de-referencing in EU member states alone did not go far enough to protect individual's data and privacy rights, as the de-referenced searches could be accessed via a different domain name.
In its judgment the ECJ stated that "the balance between the right to privacy and protection of personal data, on the one hand, and the freedom ofinformation of internet users on the other, is likely to vary significantly around the world". The ECJ confirmed that whilst de-referencing is required across all EU member states, there is no obligation for an operator to carry out de-referencing across all versions of its search engine (i.e.worldwide). However, search engine providers should use necessary measures to "prevent, or at the very least seriously discourage" internet users accessing links that appear on versions of the search engine outside the EU. The ECJ also confirmed that the door remained open for a supervisory or judicial authority of a EU member state to order worldwide de-referencing, where it had weighed up a data subject's right to privacy and data protection against freedom of information, in light of national standards, and considered de-referencing on all versions of the search engine to be appropriate in the circumstances.