Advisor to Europe’s top court favors regional limit to ‘right to be forgotten’

Google will be cheered by the view of an influential advisor to Europe’s top court vis-a-vis the territorial scope of the so-called ‘Right to be Forgotten’.

Since a 2014 Court of Justice decision, search engines operating in Europe have been required to accept and review requests from private citizens to delist outdated or irrelevant search results associated with their name, balancing decisions against any public right to know.

Google has been carrying out these delistings on regional European subdomains, rather than globally. But in 2016 the French data protection agency, CNIL, fined it for failing to delist results globally — arguing that regional delistings were not strong enough to comply with the law.

Google filed an appeal against the CNIL’s order for global delisting and a French court later decided to refer questions vis-a-vis the scope of the rtbf to the Court of Justice of the EU.

The CJEU heard the case last fall, with Google arguing that global delistings would damage free speech, and enable authoritarian regimes to get stuff they don’t like scrubbed off the Internet.

On the flip side those who advocate for global delistings argue without them there’s a trivial workaround to the rtbf.

Although the intent of the rtbf ruling was never to remove information from the Internet but rather to allow old and erroneous data to sediment (rather than be artificially kept in public view by algorithms). And given most web users don’t look past the first page (or even the first few) search results regional delistings seems a fair enough balance — at least as things stand.

That balanced view is also now the published opinion of an influential advisor to Europe’s top court.

Advocate general Maciej Szpunar’s opinion, released today — ahead of the court making its own judgement on the matter — proposes that the regional rtbf should be limited in scope to local sub-domains, rather than being applied globally as the French data protection agency has been pushing for for several years.

In a press release summarizing the AG’s opinion, the court writes that Szpunar believes “a distinction must be made depending on the location from which the search is performed” and that “[h]e is therefore not in favour of giving the provisions of EU law such a broad interpretation that they would have effects beyond the borders of the 28 Member States”.

“[I]f worldwide de-referencing were permitted, the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and to privacy,” it continues.

“This is all the more so since such a public interest in accessing information will necessarily vary from one third State to another depending on its geographic location. There would be a risk, if worldwide de-referencing were possible, that persons in third States would be prevented from accessing information and, in turn, that third States would prevent persons in the EU Member States from accessing information.”

That said, the AG is not ruling out the possibility that “in certain situations” a search engine operator may need to delist something “at the worldwide level”.

Rather, the court emphasizes, “he takes the view that the situation at issue in the present case does not justify this”.

So his current advice to the court is summarized as follows:

… the search engine operator is not required, when acceding to a request for de-referencing, to carry out that de-referencing on all the domain names of its search engine in such a way that the links in question no longer appear, irrespective of the location from which the search on the basis of the requesting party’s name is performed.

At the same time the AG emphasizes that — for valid requests — search engines must “take every measure available to it to ensure full and effective de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an IP address deemed to be located in one of the Member States, irrespective of the domain name used by the internet user who performs the search”.

While the AG’s opinion is not binding on the CJEU the court tends to take a similar view so it’s a good indicator of where the final judgement will land, likely in three to six months’ time.

We reached out to Google for comment and a spokesperson emailed us the following statement, attributed to Peter Fleischer, its senior privacy counsel:

Public access to information, and the right to privacy, are important to people all around the world, as demonstrated by the number of global human rights, media and other organisations that have made their views known in this case. We’ve worked hard to ensure that the right to be forgotten is effective for Europeans, including using geolocation to ensure 99% effectiveness.

The search giant, which remains massively dominant in the European market, publishes a report detailing the proportion of requests it accepts and declines here, which shows both a steady growth in requests and that Google continues to grant only a minority of delisting requests.

Since the original 2014 rtbf decision, the EU has doubled down on the right — extending the principle by baking it into an updated data protection framework, the GDPR, which came into force in May last year and gives EU citizens rights to ask data controllers to rectify or delete their personal information.