The European Court of Justice, the EU's top court, has decided that Google does not have to apply the right to be forgotten outside of EU member states.
In 2016, Google was fined €100,000 (or around $110,000) by France’s privacy watchdog CNIL for failing to delist search results globally, and not just in Europe. The requests were made as part of the EU’s so-called “right to be forgotten,” which says that internet search providers have a responsibility to remove outdated information that is “inadequate, irrelevant or no longer relevant or excessive.”
The French government was concerned that people could use tools like a VPN to search outside of France and still find the links that had been removed, but Google argued that each country should have the right to manage digital information in its own way.
Google had argued that the obligation could be abused by authoritarian governments trying to cover up human rights abuses were it to be applied outside of Europe.
Google's position was supported by Microsoft, Wikipedia’s owner the Wikimedia Foundation, and the non-profit Reporters Committee for Freedom of the Press, among others.
In its decision, the EU Court of Justice held that:
"where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request."
The decision confirms that the "right to be forgotten" does not extend beyond the EU member states. Any other ruling would have resulted in one country's data protection authorities being able to impose limits on which information a users globally can access.
At the same time, the ruling states that search engines must seriously discourage internet users from going to the non-EU version of their platform. The Advocate General on that point suggested geoblocking as a potential solution:
74. Once a right to de-referencing is established, it is thus for the operator of a search engine to take all steps available to him to ensure effective and complete de-referencing. (39) That operator must take all the steps which are technically possible. So far as the case before the referring court is concerned, that includes, inter alia, the technique known as ‘geo-blocking’, irrespective of the domain name used by the internet user making the search.
78. I therefore propose that the answer to the second and third questions for a preliminary ruling should be that the operator of a search engine is required to delete the links at issue from the results displayed following a search carried out on the basis of the requester’s name in a place located in the European Union. In that context, that operator is required to take all steps available to him to ensure effective and complete de-referencing. That includes, in particular, the technique known as ‘geo-blocking’, from an IP address deemed to be located in one of the Member States subject to Directive 95/46, irrespective of the domain name used by the internet user carrying out the search.
