Forget-me-not – The Right to be Forgotten beyond the EU

Shayhan Patelmaster | Senior | Law | +44 207 9809 507 | shayhan.patelmaster@uk.ey.com

In an important judgment issued on 24 September 2019, the Court of Justice of the European Union (CJEU) has clarified what the operator of a search engine must do to remove or restrict access to search results relating to a person who is exercising their right to be forgotten.

In summary, the CJEU held that there is no obligation under EU Law for an operator of a search engine, when actioning a request to exercise a data subject’s right to be forgotten, to carry out the request on all versions of its search engine, as long as the request is carried out in relation to versions of the search engine corresponding to all Member States, using measures which effectively prevent or at least seriously discourage internet users in those Member States from accessing the relevant information.

Right to be Forgotten

The right to be forgotten is set out at Article 17 of the General Data Protection Regulation. Under Article 17, a data subject has the right (in certain circumstances) to compel a data controller to erase personal data concerning him/her without undue delay. The relevant circumstances and limitations are set out in Article 17, for example the right may not be exercised where processing of the relevant data is necessary to exercise the freedom of information of internet users. However, the precise scope of the data controller’s duty is unclear from the wording of Article 17.

Key Facts

On 10 March 2016 the French Data Protection Authority imposed a penalty of 100,000 euros on Google Inc. (Google). Google had refused to comply with a formal notice requiring it, when complying with a request to exercise a right to be forgotten, to amend the relevant search results for all versions of its search engine with all domain extensions. Instead Google amended the relevant search results for the versions of its search engine in EU Member States only.

Google requested that the Conseil d’État annul the decision of 10 March 2016 imposing the penalty on Google. In response to this request, the Conseil d’État decided to refer a number of questions to the CJEU, in order to ascertain whether an operator of a search engine, when actioning a request from a data subject to exercise a right to be forgotten, must:

  • carry out the request on all versions of its search engine;
  • carry out the request on versions of the search engine corresponding to all Member States; or
  • carry out the request on the version of the search engine corresponding to the Member State in which the person exercising their right to be forgotten resides.

Key Findings

The CJEU emphasised that, in a global world, if an internet user outside the EU could access the relevant information regarding a person situated in the EU, this would be likely to have “immediate and substantial effects” on that person situated in the EU.

However, the Court noted that countries outside of the EU take a wide and disparate variety of approaches to the right to be forgotten. The right to be forgotten was not an absolute right but must be balanced against other fundamental rights such as the right to information. This balancing exercise would be approached in different ways by different third countries.

In any event, the Court decided that based on the wording of the relevant “legal texts”, EU Law did not provide for exercise of the right to be forgotten outside of the EU. Therefore it found that there is no obligation under EU Law for an operator of a search engine, when actioning a request to exercise a data subject’s right to be forgotten, to carry out the request on all versions of its search engine, as long as the request is carried out in relation to versions of the search engine corresponding to all Member States, using measures which effectively prevent or at least seriously discourage internet users in those Member States from accessing the relevant information.

Key Points for Search Engine Operators

  • This case is likely to provide some welcome certainty to search engine operators, and operators of similar internet-based services, within the EU as to the precise scope of their duty when complying with a request to exercise a right to be forgotten.
  • The case will also provide relief for search engine operators, and operators of similar internet-based services, who are predominantly based outside of the EU. As a result of this case, the jurisdiction of EU Law in relation to the right to be forgotten is clearer.
  • The CJEU appears to have been guided by the Opinion of the Advocate General, which argued that if a worldwide exercise of the right to be forgotten were permitted, the EU would not be able to define and scope the right to information, let alone balance that right to information against the relevant rights to privacy. An EU-based right to be forgotten, applying worldwide, appears to be unworkable in the eyes of the CJEU and its Advocate General.