EU court: Right to be forgotten doesn't apply outside EU

The European Court of Justice (ECJ), Europe's top court, has decided that the "right to be forgotten" rules do not apply outside the European Union.

In accordance with Tuesday's landmark victory for the US company, Google will not be required to delete links to sensitive personal data upon request worldwide.

The ruling comes after the French data watchdog CNIL fined Google €100,000 ($109,790) in 2016 for declining upon request to delete sensitive information from global internet search results under the "right to be forgotten" rules.

The French regulator had wanted the "right to be forgotten" rules applied to all of Google's domains worldwide and not just in Europe.

However, the ECJ ruled that "there is no obligation under EU law, for a search engine operator who grants a request for dereferencing made by a data subject... to carry out such a dereferencing on all the versions of its search engine." 

Tuesday's decision means that, beyond the EU, people do not have the right to control what appears when their name is searched online.

Read more: Has Google's data collection gone too far?

No 'right to be forgotten' outside EU

Following the watchdog's fine, Google appealed to France's highest court, the Council of State, which in turn referred to the ECJ.

The case stems from the EU court's 2014 ruling that people have the right to control such information and be able to delete links to outdated or humiliating personal information appearing in searches within the EU bloc. 

The court also said on Tuesday that search engine operators such as Google must put in place measures to discourage internet users from going beyond European borders to obtain information.

Dereferencing must "if necessary, be accompanied by measures that effectively prevent or, at the very least, seriously discourage internet users" from accessing "via a version of this engine and outside the EU, the links that are the subject of the request," the court added.

Read more: France fines Google nearly €1 billion in 'historic' tax fraud

Privacy protection vs. freedom of expression

In a second case on Tuesday, the court maintained that in the context of a request for dereferencing, "a balance must be struck between the fundamental rights of the person" concerned and "those of internet users potentially interested by such information."

The French Council had sought further advice from the EU court after the French watchdog did not instruct Google to remove specific links from search engines based on the names of four individuals.

These included the placing under investigation of a male politician, a satirical photomontage of a female politician, the conviction of a person for sexual assaults against minors as well as an article referencing a person as a public relations officer for the Church of Scientology.

The watchdog had refused to force Google to remove links to articles relating to a person convicted of pedophilia or satirical policy content, among others. 

In response, the EU court stated that "human rights generally prevail over freedom of information" but that this balance may vary depending on "the nature of the information in question," "its sensitivity to the individual's private life" or "the public interest."

In its "right to be forgotten" legal dispute with Google, the watchdog had argued that for dereferencing to be effective, the rule must be applied to all versions of the search engine worldwide.

Read more: Google unveils 'unprecedented' iPhone security flaw

A 'sensible balance'

In a statement after Tuesday's ruling, Google expressed satisfaction with the court's decision.

"Since 2014, we've worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people's rights of access to information and privacy. It's good to see that the Court agreed with our arguments."

mvb/ng (Reuters, AFP)

Every day, DW's editors send out a selection of the day's hard news and quality feature journalism. Sign up for the newsletter here.