Google wins landmark right to be forgotten case

The EU's top court has ruled that Google does not have to apply the right to be forgotten globally.

It means the firm only needs to remove links from its search results in Europe - and not elsewhere - after receiving an appropriate request.

The ruling stems from a dispute between Google and a French privacy regulator.

In 2015, CNIL ordered the firm to globally remove search result listings to pages containing damaging or false information about a person.

The following year, Google introduced a geoblocking feature that prevents European users from being able to see delisted links.

But it resisted censoring search results for people in other parts of the world. And the firm challenged a 100,000 ($109,901; £88,376) euro fine that CNIL had tried to impose.

"Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject... to carry out such a de-referencing on all the versions of its search engine," the European Court of Justice ruling said.

What is the right to be forgotten?

Also known as the "right to erasure", the rule gives EU citizens the power to demand data about them be deleted.

In the case of search engines, Europeans have had the right to request links to pages containing sensitive personal information about them be removed since 2014.

But the General Data Protection Regulation (GDPR) which came into force in 2018, added further obligations.

Members of the public can make a request to any organisation "verbally or in writing" and the recipient has one month to respond. They then have a range of considerations to weigh up to decide whether they are compelled to comply or not.

Google had argued that the obligation could be abused by authoritarian governments trying to cover up human rights abuses were it to be applied outside of Europe.

"Since 2014, we've worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people's rights of access to information and privacy," the firm said in a statement following the ECJ ruling.

"It's good to see that the court agreed with our arguments."

The tech firm had been supported by Microsoft, Wikipedia's owner the Wikimedia Foundation, the non-profit Reporters Committee for Freedom of the Press, and the UK freedom of expression campaign group Article 19, among others.

ECJ adviser Maciej Szpunar had also concluded that the right to be forgotten be limited to Europe in a non-binding recommendation to the court earlier this year.

• Google fights plan to extend 'right to be forgotten'

• Google backed on limiting search results over right to be forgotten

• The secrets of controlling your internet profile

There has been a lot of interest in the case since, had the ruling gone the other way, it could have been viewed as an attempt by Europe to police a US tech giant beyond the EU's borders.

Those wanting to read the full ruling were frustrated in the hour following its release because the ECJ's own website crashed.

A notice on the court's website said it was "unavailable" just before the ruling was due to be published

The court also issued a related second ruling, which said that links do not automatically have to be removed just because they contain information about a person's sex life or a criminal conviction.

Instead, it ruled that such listings could be kept where "strictly necessary" for people's freedom of information rights to be preserved. However, it indicated a high threshold should be applied and that such results should fall down search result listings over time.

"The obligation to demote search results in some cases is particularly interesting as an example of the courts directly interfering with the algorithms used by big tech companies," commented Peter Church from the law firm Linklaters.

Geoblocked results

Google has applied the right to be forgotten since May 2014, when the ECJ first determined that under some circumstances European citizens could force search firms to delist webpages containing sensitive information about them from queries made using their names.

The idea is to hide sensitive information - such the fact a person once committed a criminal offence or had an extra-marital affair - if the details are judged to be "inadequate, irrelevant or no longer relevant or excessive".

Google has said that since that time it has received more than 845,000 requests to remove a total of 3.3 million web addresses, with about 45% of the links ultimately getting delisted.

This involves both removing the results from its European sites - such as Google.fr, Google.co.uk and Google.de - as well as restricting results from its other sites - such as Google.com - if it detects a search is being carried out from within Europe.

However, this means that users can still circumvent the action if they use a virtual private network (VPN) or other tool to mask their location.

Notably, the ECJ ruling said that delistings must "be accompanied by measures which effectively prevent or, at the very least, seriously discourage an internet user" from being able to access the results from one of Google's non-EU sites.

"It will be for the national court to ascertain whether the measures put in place by Google Inc meet those requirements."

News sites, including the BBC, are exempt from the rule, but may find that links to some of their old articles no longer appear on Google or other search engines.

The right to be forgotten should still apply to the UK if it leaves the EU, with or without a deal, at least in the short to medium-term.

"How it's applied might diverge over time, as UK courts no longer follow ECJ decisions and the Supreme Court in the UK wrestles with these points instead," a spokesman for Linklaters told the BBC.

"But day one, we're going to have a UK version of the GDPR [General Data Protection Regulation], including a right to be forgotten."