In a landmark ruling last week, the Court of Justice of the European Union (CJEU) has held that Google is not required to carry out a de-referencing (effectively, the “right to be forgotten”) on non-EU versions of its search engine.
The case was brought by Google on appeal, having received an initial fine of €100,000 from the French data protection regulator, CNIL, back in 2016 after it had ruled that Google’s self-imposed restriction to only de-reference on European versions of its search engine (as opposed to its global platforms) was unlawful.
However, the CJEU did hold that its ruling should not be implied as releasing search engine operators from the obligation to take measures that prevent or discourage other EU internet users from accessing relevant references to the individual. The CJEU will leave it to the EU member states’ national regulators to assess these measures. The CJEU further recognised that, in limited cases, those measures may still require search engine operators to carry out a de-referencing concerning all versions of that search engine on a global scale.
Whilst the future effect of the CJEU’s ruling on EU member states and individuals is apparent, the impact may still be felt by US-based businesses and individuals in various ways:
- Virtual Territorial Wall: In what is otherwise a borderless Internet, the decision creates a virtual territorial wall which makes de-referenced material inaccessible on search engines within the confines of the EU. Under the decision, the right to be forgotten applies only in EU territories, which means that there is no blanket requirement for operators to remove de-referenced search results across all versions of a search engine that are accessible outside the EU. For example, using the same search criteria, search results in France on Google.fr may differ from search results in the US on Google.com. Thus, potentially disparaging information may be “forgotten” in the EU, but will remain accessible in the US
- In some circumstances, the de-referencing may still be ordered in the US: Whilst de-referenced search results will remain available in the US (for the most part), the decision did not foreclose the possibility that de-referencing may occur across all versions of a search engine. The ruling explicitly stated that the supervisory or judicial authority of any Member State may order an operator to de-reference all of its versions (in the EU and elsewhere) after weighing the data subject’s privacy rights and the right to freedom of information.
- Authentic Internet Experience: Unless a Member State’s supervisory or judicial authority orders an operator to de-reference material across all versions of its search engine, those in the US will continue to have an “authentic” Internet experience because search results will remain unaltered on the US version of a search engine.
- Recognition that the balance between personal privacy and free speech differs between the US and EU: The decision acknowledged and emphasized that the balance between the rights to privacy and free speech on the Internet vary across the globe. The judgement recognises that EU’s trade-offs differ to the approach in other jurisdictions, including the US.
In a separate judgment published on the same day, the CJEU held that a search engine operator, when assessing a de-referencing request, must weigh the rights of the individual requester against the rights of internet users to determine whether to remove sensitive data from search results. In that case, four individuals had appealed the decision by CNIL to take no action against Google for refusing their requests to remove links to web pages containing sensitive data (including search results on criminal proceedings).
The CJEU concluded that the analysis undertaken by a search engine operator should take account of:
- the relevant factors of the specific case;
- the seriousness of the interference with the requester’s fundamental rights to privacy and protection of personal data; and
- whether the inclusion of a web link is “strictly necessary for protecting the freedom of information of internet users” interested in accessing that information.
Specifically, in relation to legal or criminal proceedings, the search engine operator must adjust the list of search results to ensure the “overall picture it gives the internet user reflects the current legal position” of the individual. Outside of the EU, this aspect of the ruling may also have significant implications in the US. For example, it remains unclear whether any algorithm used by an search engine operator to assemble search results in the EU (reflecting the current legal position) will be applied to identical searches run in the US (which are designed to list searches based on the volume of traffic to that particular article, including those that may be outdated).