How Forgotten is Forgotten? New Questions regarding the Extraterritoriality of the Right to Be Forgotten
Exchange has been a lot of fun — too much fun. There are snaps, instas, and Facebook pictures that prove it. In the age of technology, will my generation ever be able to escape their digital footprint? Recently, I read an article about the right to be forgotten and it got me thinking that the answer to this question may depend on your Google domain.
The Right to Be Forgotten
In May 2014, the Court of Justice of the European Union held European citizens have a right to demand that search engines delist links with information deemed inaccurate, inadequate, irrelevant, or excessive for the purposes of date processing. This ruling came after a Spanish citizen filed a complaint against Google because he wanted a newspaper article regarding past insolvency to be “forgotten.” The Spaniard claimed that Google’s search results infringed on his privacy rights because the matter had been resolved and the reference was now entirely irrelevant. In its ruling the Court held:
- On the applicability of EU data protection rules to search engines: Search engines are controllers of personal data and therefore have certain responsibilities before European law.
- On the territoriality of EU data protection rules: Even if the physical server of a company processing data is located outside the EU, EU rules apply to search engine operators if they have a branch or a subsidiary in a Member State which promotes the selling of advertising space offered by the search engine.
- On the right to be forgotten: Individuals have the right to demand that search engines delist links with personal information about them. However, the Court explicitly clarified that this right is not absolute; the right must be balanced against other fundament rights, such as the freedom of expression and the freedom of press. Thus, a case-by-case assessment is needed considering the type of information in question, its sensitivity for the individual’s private life, and the interest of the public in having access to that information. In the present case, the Court found the right to data protection trumped the economic interest of the search engine.
Since the Ruling
Since the ruling, Google has received 654,232 requests to delist 1,811,832 URLs. Of those requests that have been fully processed, Google has approved 43.2% (661,920 URLs). In the Netherlands alone, the company has received 29,250 requests to delist 102,933 URLs, and approved 46.0% (40,752 URLs). Not surprisingly, the site that has been most impacted to date is Facebook.com.
Extraterritorially
The CJEU’s decision applies only to citizens of the EU. However, recent proceedings have given rise to new questions regarding the extraterritorial reach of the decision.
When Google first began to comply with the CJEU ruling, it only delisted search results across its European website such as google.de in Germany and google.nl in the Netherlands. Following pressure from data protection authorities across Europe, Google began to delist search results on its .com domain from the location of the Member State where the removal request was granted. But European data protection authorities have called for even further measures. Notably, the French Data Protection Authority, Commission Nationale de l’Informatique et des Libertés (CNIL), has insisted on global implementation of delistings.
In March, the CNIL fined Google 100,000 euros for not delisting more widely, arguing that the only way to uphold Europeans’ right to privacy is to apply the right to be forgotten in every country in the world. Google has filed an appeal with France’s highest court, the Conseil d’État in France.
Google argues that no one country should be able to censor the Web internationally.
The Center for Democracy & Technology, Electronic Frontier Foundation, Human Rights Watch and other advocacy groups are backing Google. Many nations, particularly the United States, have very strong domestic freedom of speech laws that are irreconcilable with the right to be forgotten. Kent Walker, Senior Vice President and General Counsel at Google, explains Google’s position:
“[I]f French law applies globally, how long will it be until other countries — perhaps less open and democratic — start demanding that their laws regulating information likewise have global reach? This order could lead to a global race to the bottom, harming access to information that is perfectly lawful to view in one’s own country. For example, this could prevent French citizens from seeing content that is perfectly legal in France. This is not just a hypothetical concern. We have received demands from governments to remove content globally on various grounds — and we have resisted, even if that has sometimes led to the blocking of our services.”
The appeal is set to be heard in the Spring.
Additional Sources:
https://blog.google/topics/google-europe/a-principle-that-should-not-be-forgotten/
http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf
https://www.google.com/transparencyreport/removals/europeprivacy/?hl=en
