Just for EU, just for EU, just for EU: Forget about enforcing Right To Be Forgotten outside member states
Top court receives advice paraphrasing M People*
European Right To Be Forgotten (RTBF) rulings should not apply globally, but block results across all EU states, the bloc's top court has been told.
In an opinion issued today, advocate general Maciej Szpunar advised the Court of Justice of the European Union to limit the scope of delisting requirements on search engines.
This goes against the French data protection agency (CNIL), which is attempting to broaden RTBF so that it applies globally, rather than just in the country where the request was made.
In 2015, the agency fined Google some €100,000 for failing to apply a Right To Be Forgotten decision globally.
Google settles Right To Be Forgotten case on eve of appeal hearingREAD MORE
The search giant appealed against this in the French courts, on the grounds that this right should be balanced with rights to freedom of expression and to information, and the case was heard by the CJEU last year.
The advocate general's opinion – which isn't binding but is often followed by the court – said that search engine operators should not be required to carry out delisting on all the domain names of its search engine globally.
Szpunar said he was not in favour of giving the provisions of EU law such a broad interpretation that they would have effects beyond the 28 member states.
However, once an order has been made within the bloc, the company must "take every measure available to it to ensure full and effective de-referencing within the EU". This includes using geo-blocking based on the IP address of the person performing the search.
Google had done this for French IP addresses for the case in question, so anyone searching from France, regardless of whether they used google.com or google.fr, was blocked from seeing the result – a move the CNIL said was insufficient.
Emphasising the balance between the fundamental rights to be forgotten, to access information, and to data protection and privacy, Szpunar set out the potential risks of worldwide delisting.
If it was allowed, "the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and to privacy", a summary (PDF) of the decision said.
This is made even more difficult to weigh up as the public interest in accessing information will vary from one non-EU country to another, and global delisting would prevent people in those states from accessing information.
Moreover, it could result in EU citizens being prevented from accessing information based on decisions made in countries outside of the bloc.
Szpunar did not rule out the possibility that some situations might require a search engine to take de-referencing actions on a global basis, but said the situation at issue "does not justify this".
Free speech campaigners welcomed the opinion. Article 19 executive director Thomas Hughes said that EU data regulators "should not be able to determine the search results that internet users around the world get to see".
Hughes said he hoped the CJEU would follow Szpunar's opinion when it issues its judgment later this year.
"The Court must limit the scope of the 'Right To Be Forgotten' in order to protect global freedom of expression and prevent Europe from setting a precedent for censorship that could be exploited by other countries."
The Forget-Me Four
Szpunar has also today issued a second opinion (PDF) on the right to be forgotten in another case involving Google and the CNIL, assessing a search engine's responsibilities when it comes to sensitive data.
This is in a case brought by four individuals over the CNIL's refusal to put Google on formal notice to carry out delisting requests for search results for their names.
Szpunar proposed that the court should rule that a search engine operator must accede to a request for the de-referencing links on which sensitive data appears.
However, he said, the firm must ensure the protection of the right to access information and the right to freedom of information.
The Right To Be Forgotten applies to a search result that is deemed "inadequate, irrelevant or no longer relevant, or excessive" and – as of 10 January 2019 – Google had delisted 1.1 million URLs, approving about 44 per cent of requests. ®
* Hear the divine stylings of Heather Small here...
Sponsored: Becoming a Pragmatic Security Leader