One of the interesting novelties that the General Data Protection Regulation (AVG or GDPR) has brought with it is the “right to be forgotten” or “right to oblivion” of article 17, paragraph 2 GDPR. The right to forget gives data subjects the possibility to have their personal data removed not only by a data controller but also to demand all reasonable technical measures to “delete every link to or copy of that personal data”. Article 17 (2) of the GDPR is the writing down of a principle that has been under development in the case law of the European Court of Justice for some time.
It is a right also where internet search engines like Google are not particularly happy. Their main raison d’être is to make data retrievable, and de-blinking or deleting harms their business model and is also costly and time-consuming.
One of the interesting aspects of this right to be forgotten is the question of the territorial scope of the right: do search engines like Google have to remove search results only within the EU or on a worldwide level? This question is currently being examined by the European Court of Justice and the Advocate-General published his advise on 10 January 2019.
French government vs. Google
The European Court of Justice has been charged with a case for some time now in which the Court will have to give its answer to a preliminary question originating in France.
The French data protection authority, CNIL, ordered Google back in 2015 to remove from all versions (both within the EU and on the non-EU versions) of its Chrome search engine results that are based on a search for results that are the object of a “right to be forgotten” request by the data subject.
Google has refused to accept this requirement and has only removed the links from the search results that appear after a search on the European versions of its search engine. Anyone searching for an EU version of Chrome will in other words no longer find the results, but those looking for the US version of Chrome will still be able to see them.
Google had proposed to make it impossible to use the “geoblocking” technology to access the “erased” results from an EU-based IP address via a non-EU version of Chrome, but that was not enough for the CNIL, which maintained its demand for the global removal of data and imposed a penalty of 100,000 euros on Google in 2016.
Google then requested the French Conseil d’État to annul that decision at the time, after which the Conseil d’État made a series of preliminary questions to the European Court of Justice.
Opinion of the Advocate-General of 10 January 2019
The European Court of Justice has not yet taken its final decision, but on 10 January the Opinion of the Advocate-General in this case was made public.
Advocate General Maciej Szpunar is of the opinion that a distinction should be may be made according to the place from which a search is carried out. Searches made outside the territory of the European Union fall outside EU law and therefore do not qualify for removal of links from the search results, which places a considerable limitation on the possible extraterritorial effect of European data protection law. In the eyes of the Advocate-General this is the logical consequence of the very nature of the internet, which has no geographical boundaries.
According to the Advocate General, the fundamental right to be forgotten must be weighed against the legitimate interest of the public in gaining access to the information sought. If links were to be removed worldwide, Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31), according to the Advocate General, are not in a position to define and record a right to receive information and even less to weigh that right against the other fundamental rights on data protection and respect for private life.
This is all the more true since the public interest in gaining access to information will necessarily vary according to the geographical location, from one third country to another. Where it is possible to remove links globally, there is a danger that persons in third countries may be prevented from accessing information and that third countries, on the basis of reciprocity, prevent access to information by persons in the Member States of the Union.
The Advocate General therefore advises the Court to rule that the operator of a search engine is not obliged to impose on the operator of a search engine the obligation to remove worldwide results, when invoking the right to be forgotten.
On the other hand, the Advocate-General emphasizes that once a right to removal of links within the Union has been established, the operator of a search engine must take all possible measures to ensure the effective and complete removal of the links within the territory of the European Union, also through the technique of “geoblocking”, from an IP address that is considered to be located in one of the Member States, regardless of the domain name entered by the internet user carrying out the search.
Waiting for the Court’s decision …
The Opinion of the Advocate-General does not bind the Court of Justice. The Advocates-General have the task, in complete independence, to offer the Court a legal solution for the specific dispute. The judges of the Court then decide independently whether or not they will follow the advice of the Advocate-General. It goes without saying that in most cases the Court follows the advice of the Advocate-General, which is well-founded. It remains to be seen whether the Court has the same opinion as its Advocate-General in a few weeks or months, but the chances are that this will indeed be the case.
