In what Google is presenting as a major legal victory, the highest court in the European Union – the European Court of Justice (ECJ) – has ruled that search engine operators such as Google do not have to apply the “right to be forgotten” globally. While Google must still handle any right to be forgotten requests from EU citizens and take appropriate steps to remove information from European versions of its search pages (e.g. Google.fr or Google.de), it does not need to scrub such information from its non-EU pages (such as Google.com). In making the ruling, the European Court of Justice explained that it was attempting to balance two competing ideas: the right to personal privacy and the right to freedom of information.
The court case at the heart of the “right to be forgotten” ruling
The European Court of Justice ruling on the right to be forgotten stems from an ongoing dispute between Google and French privacy regulator CNIL. Back in 2015, the CNIL told Google to apply any right to be forgotten takedown requests globally. Later, in 2016 when Google had refused to comply with this request, the CNIL levied a fine of more than $100,000 against Google. As might be imagined, Google protested this course of action, and appealed to the French Council of State, which in turn took the case to the European Court of Justice. Since the ECJ is the highest court in the EU, this is a final decision on the matter within Europe.
For the past three years, Google has been marshalling its forces and building its arguments in defense of its current policy of only applying “right to be forgotten” requests from Internet users to its European search domains. According to Google, the right to be forgotten is a local right, and not an absolute right. In other words, Google is more than willing to recognize the right of the EU to make rules for its 28 member states and apply rules locally to those 28 nations. This is Google’s obligation under EU law if it would like to operate within the borders of the EU. However, Google is not willing to let the EU determine policy for the rest of the world, which it would, in essence, be doing if it required Google to handle right to be forgotten requests globally.
Google vs. the right to be forgotten
Google has attempted to frame its decision-making process about the right to be forgotten in Europe in the context of two competing rights: the right to personal privacy and the right to freedom of access to information. In an extreme case, argued Google, an authoritarian government might attempt to “cover up” human rights abuses or other serious offenses simply by removing links or scrubbing search results. Google saw its policy as a way to strike a sensible balance between two important rights.
Since Google presents itself as a way for the world to find the information it needs, it felt that it was being unnecessarily hampered by right to be forgotten requests. In its defense, Google pointed to news organizations such as the BBC, which are not obligated to respond to right to be forgotten requests. Obviously, the court agreed with Google in this matter.
And, truth be told, Google did attract the support and sympathy of a number of high-profile backers, including Microsoft, the Wikimedia Foundation (the owner of Wikipedia), the UK rights group Article 19, and the nonprofit organization Reporters Committee for Freedom of the Press. Konstantinos Komaitis, Senior Director, Policy Development and Strategy at the Internet Society, comments on the ruling: “This is a big victory for the Internet and it limits the reach of EU law. The GDPR affirmed the European Commission’s position as the de facto global regulator in the Internet, raising serious concerns over the unintended consequences the extraterritorial nature of laws can have on the Internet. This case could have further solidified the EU’s status and could have intensified the various regulatory tensions we see globally.”
Google argued that it worked hard to implement the right to be forgotten, but that it was unwilling to make this a global, absolute right. Instead, Google developed a very clever geolocation tool that enabled it to figure out where search requests were being carried out, and from which of Google’s search domains. Thus, someone carrying out a search request from America would be able to see information that someone carrying out the exact same search request from, say, France or Germany, would not be able to see.
Personal privacy in the era of the Internet
Complicating matters, of course, is the fact that nation-states have borders, while the Internet does not. Google’s compromise solution – in which it shows sensitive information in some nations but not in others – is filled with all kinds of loopholes and problems. For example, someone using a Virtual Private Network (VPN) is able to hide their identity and geolocation from the network, and thus access web pages that might be “hidden,” “banned” or “deleted” in other nations. It’s for this reason, for example, that China has outlawed the use of VPN apps within its borders – it would make it far too easy for a Chinese citizen to get access to Western media stories. In the same way, an EU user could use an VPN to bypass Google’s European search results.
Also, consider just how easy it would be for someone in Europe to get the information they are looking to find simply by traveling to a place like New York City – once they’ve cleared European airspace, they would suddenly get access to information that was once blocked for them. And, for that matter, what will happen to the UK if it decides to move ahead with a full Brexit and depart the EU? Since the right to be forgotten went into effect when the UK was still part of the EU, would it still apply in a post-Brexit world?
Going forward, it will be interesting to see how other nations deal with the fundamental tension between the right to privacy and the right to freedom of information. For example, within the U.S. there was growing concern that the EU would be able to control the actions of a U.S. company beyond the EU’s borders, and it is likely that, if Google’s appeal had failed with the European Court of Justice, it might have turned to backers within the U.S. government for support. That would have set into motion a potential legal showdown between the U.S and Europe that might have had consequences for U.S.-EU trade agreements or U.S.-EU diplomatic relations.
Around the world, the perceived balance between personal privacy right and freedom of speech varies. For now, at least, Google can walk away with a legal victory since it has no obligation under EU law to make the right to be forgotten a universal right.
