Much has been written about the problems surrounding permanence of data once it has been uploaded to the internet – whether it’s a misjudged Twitter comment by a politician from 10 years ago, or a risqué photo from bacchanalian university days which emerges when someone is looking for a job. The difficulty of erasure impinges on a broader philosophical principle – the right to be forgotten – but this term has been most commonly used to describe the stickiness of search results within Google. The specific legal question often asked in this regard is: does Google need to delete search results upon request by individuals?
Back in 2014, a legal principle was established by Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (aka “Google Spain”) whose effect was to force Google (and other search engines) to purge (or, more accurately, de-reference) search results containing personal data in respect of specific requests, as long as the information in question was “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing.” In coming to this landmark decision, the ECJ essentially created what became known as a right to be forgotten (although in fact it was merely interpreting Directive 95/46/EC).
But the global nature of the internet presented a dilemma in respect of the legal principle established by Google Spain: should search result removal be applied on a country by country basis, for the whole of the EU or across the whole world? This question is complicated by the fact that geographical versions of Google search engines can be accessed from different locations (eg Google.fr can be accessed from the UK).
In grappling with these questions, the French privacy regulator (CNIL) argued that Google should de-reference search results globally and imposed a fine, resulting in an ECJ clarification of this point in Google vs Commission nationale de l’informatique et des libertés (CNIL) in September 2019. The ECJ ruled that search results only need to be removed in respect of geographical versions of the Google pertaining to Member States – not globally. However, it also decided that Google should “put in place measures discouraging internet users from gaining access, from one of the Member States, to the links in question which appear on versions of that search engine outside the EU”.
NB: Although this ruling appears to clarify the position on the right to be forgotten, it should be noted that a separate ECJ ruling, Glawischnig-Piesczek v Facebook, held that Member States could order internet platforms to remove illegal content on a worldwide basis.
Image cc by sagesolar on Flickr.
