2020-02-16
Legal Articles

The right to be forgotten… how absolute is it?

Home / Knowledge base / The right to be forgotten… how absolute is it?

Posted by Patrick McCallum on 22 January 2020

Patrick Mccallum - Commercial Contracts Law Solicitor
Patrick McCallum Solicitor

In October 2019, the European Court of Justice decided that the “right to be forgotten” under the General Data Protection Regulation (GDPR) only required Google to delete the relevant user’s personal data on EU versions of Google’s search engine, rather than worldwide.

Whilst the “right to be forgotten” is not an absolute right under the GDPR, the outcome of this judgment curtails individuals’ rights and gives them less control in respect of their global online presence and potentially reputation. This may at first appear unusual given the acknowledgement and acceptance that the worldwide web is indeed worldwide, and that therefore being required to delete data in the EU on request with no requirement to delete the same data outside of the EU may result in an unnatural distinction.

The right to be forgotten

The right to erasure, also known as the “right to be forgotten” is codified under Article 17 of the GDPR. It derives from a 2014 Spanish case involving Google. The right is not absolute and only applies where one of the grounds set out in Article 17(1) applies. The right further does not apply in certain circumstances, as set out under Article 17(3), such as to the extent that the processing is necessary for exercising the right of freedom of expression and information.

The Google decisions

In 2014, the European Court of Justice held that Google was required to delete personal data in respect of a Spanish individual who had made a request to Google “to be forgotten”.

In seeking to comply with this decision, Google deleted all such references on its EU domains (but not across its worldwide versions of the Google search engine). Google’s actions from the 2014 case i.e. to delete only information requested to be deleted from its EU domains only (the distinction not having been made in the original case), were then challenged by the French Data Protection Authority (CNIL), who disagreed with Google’s EU-only approach to the right to be forgotten. This resulted in CNIL issuing a fine to Google of €100,000. The fine was issued further to CNIL requesting that Google de-reference worldwide and Google refusing.

Google’s challenge of the fine resulted in CNIL seeking a direction from the European Court of Justice (ECJ), to clarify what the ECJ considered was necessary in terms of the extent and territorial reach of the required deletions/de-referencing. The accuracy and appropriateness of Google’s approach came before the European Court of Justice in the Autumn of 2019.

Google’s main arguments were that the obligation could be abused by authoritarian governments trying to hide human rights abuses were it to be applied outside of the EU, and that it would be a way to enforce EU privacy laws and standards in countries without similar laws. Other entities joined Google in this action, given the connection with public international law’s principles of courtesy and non-interference and the freedoms of expression and of the press.

The European Court of Justice held that search engine operators are not required under EU law to remove links on all the versions of its search engine. Further, the GDPR does not suggest that there is scope for Member States to go beyond their territory. As such, it held that Google was required to remove all links across all versions in the EU, but not further.

So, what will this mean for companies operating on a more global platform and for individuals seeking to enforce their rights?

As companies that process personal data expand their global reach, there may be increasing tensions between national regulators in place to protect individuals’ rights and companies. The fact that internet users may conduct searches outside of the EU and still be able to access EU de-referenced links after this judgment potentially undermines the right to be forgotten. However, the European Court of Justice arguably did not wish to encroach of non-EU states by extending its remit to these, where the GDPR was not applicable.    

Nevertheless, it is important to note that this judgment is not necessarily the comprehensive, definitive victory for Google as suggested in the press that was publicised towards the end of 2019. In its judgment, the European Court of Justice did not rule out the possibility that certain cases may justify global de-referencing. Indeed, the European Court of Justice stressed that “a supervisory or judicial authority of a Member State remains competent…to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine,” such that while the EU does not strictly require global de-referencing, it equally does not prohibit it.

About the author

Patrick is a solicitor in the commercial team who helps clients with their commercial contracts in both a business-to-business and business-to-consumer context.

Patrick McCallum

Patrick is a solicitor in the commercial team who helps clients with their commercial contracts in both a business-to-business and business-to-consumer context.

Recent articles

30 July 2020 Rethinking the landlord / tenant relationship

We have been following the travails of the high street for over 12 months where changing shopping habits, business rates and rent increases have been contributing to a growing strain on many landlord / tenant relationships.

Read article
30 July 2020 Bankrupts fail in claim to have interests in land revested in them

The claim by Mr and Mrs Brake (Brake v Swift), heard in the High Court in May, to have a cottage and adjacent land revested in them under Section 283A of the Insolvency Act 1986, was set against a background of convoluted litigation extending over a number of years, described by Matthews HHJ as ‘complex’.

Read article
29 July 2020 Remote witnessing of wills – a sign of the times

The law governing how a will is witnessed dates back to 1837 and for good reason. The requirement for two people (neither of whom can inherit from the will they are witnessing) to be physically present at the signing of a will is designed to, among other things, prevent fraud and the exercise of undue influence. That is, until the Covid-19 pandemic struck.

Read article
Contact
How can we help?
01926 732512
CALL BACK