- The CJEU has held that the right to be forgotten applies across the EU, but not worldwide.
- The search engine must also take measures that prevent or discourage access from the EU to the removed results.
- National authorities keep some room to request wider removals under their own law.
On 24 September 2019, the Grand Chamber of the Court of Justice of the European Union delivered its judgment in Google v CNIL, the French data-protection authority. The court concluded that the right to erasure, known as the right to be forgotten, does not oblige search engines to remove links on all worldwide versions of their service, but only on the versions corresponding to the Member States.
The case originated in a dispute with the French authority, which in 2016 fined Google €100,000 for refusing to apply removals to all its extensions. The company argued it was enough to apply them on European domains. The court has sided with Google in essence, but with a nuance that matters: the search engine must take measures to make removals effective within the Union.
What the right to be forgotten is
The right to be forgotten arose from a ruling of the Court of Justice itself in 2014, which recognised that a person can ask a search engine to remove from its results links to information about them that is inaccurate, outdated or no longer relevant. It does not delete the information from the original page, but makes it harder to find when searching that person’s name. Since 2018 the General Data Protection Regulation has set it out expressly, and it must always be balanced against freedom of information.
Until now the discussion was about its geographical reach. The French authority argued that if removal applies only in Europe, anyone could find the link by using a non-European version of the search engine. The court replies that Europe cannot impose on third countries its own balance between privacy and information, which varies greatly from place to place. Google had already introduced in 2016 a geo-blocking system that prevents links removed in the user’s country from being seen there, and the judgment confirms that measures of this kind are part of what is expected of a search engine.
What it means for people and companies
For individuals, it means that an accepted request guarantees that the link will not appear in searches made from the European Union, but not that it disappears elsewhere in the world. For someone suffering real harm from old or inaccurate information, protection is broad within Europe, though limited outside it.
For companies, the judgment has a double effect. If they are holders of personal data that appears in search engines, such as the identity of executives or historical information on directors, they should know how requests are processed. And if they provide search, indexing or analytics services, they need procedures to handle removals and to ensure they are effective in the Union.
What to review
Anyone wanting to request removal should first approach the search engine, with the specific links and the reasons, and may complain to the Spanish Data Protection Agency if not satisfied. Keep screenshots and dates, and bear in mind that not all requests succeed: the public interest, for example in public office or professional activity, may weigh more.
Companies should also include online reputation in their risk management, with monitoring of what is published and a protocol to respond. If you need advice on a specific case, consult a professional specialised in data protection.
The internet has no borders, but the right to be forgotten, for now, does.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
