Google has won a long-standing battle with the European Union (EU), after the European Court of Justice (ECJ) ruled the company can limit the scope of the “right-to-be-forgotten” (RTBF) regulation to searches made within the EU.
Today’s announcement was largely expected, given that an adviser to the EU’s top court backed Google’s case in January. (ECJ judges typically follow the advice given by the advocate general.) But now it’s official, meaning Google and others will only have to delist search results from search engines inside the EU’s perimeters.
“The Court concludes that, currently, there is no obligation under EU law for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine,” the ECJ said in a press release.
The story so far
The RTBF ruling dates back to 2014 and was intended to help people and companies delist specific web pages that contain irrelevant, out-of-date, or potentially “damaging” information. In the intervening years, Google has received millions of de-indexing requests, though it reports less than 45% have been fulfilled. Initially, RTBF applied to all EU countries, meaning any constituent member could file a request for a web page to be de-indexed from European versions of search engines — such as Google.fr (France) or Google.co.uk (U.K.). However, in 2015 France’s privacy watchdog ordered Google to expand the RTBF’s scope to include all of its search properties around the world, meaning that if someone searched for a phrase on Google.com or Google.ca, the results would still not show up.
In 2016, Google was fined $110,000 by French officials for not complying with its ruling, which kickstarted a three-year appeals process during which Google took the case all the way through to Europe’s highest court in Luxembourg. “As a matter of both law and principle, we disagree with this demand [to hide results globally],” said Google’s global general counsel, Kent Walker, in a statement at the time. “We comply with the laws of the countries in which we operate.”
Elsewhere in Europe, Google continues to face the wrath of regulators. Back in January, France hit the tech giant with a $57 million fine for failing to comply with the EU’s General Data Protection Regulation (GDPR) regulations, and an additional $1.69 billion fine over alleged AdSense antitrust abuses. And last year Google was hit with a record $5 billion fine by EU antitrust regulators over the way it bundled its services on Android, effectively forcing phone makers to preinstall certain Google apps to gain access to others.
Today’s announcement represents not only a rare victory for Google in Europe, but also for freedom of speech advocates who argued that this case was pivotal for the future of the global web. Indeed, a number of organizations have come out in support of Google since the beginning of this case, including Microsoft — which has had its own de-indexing battles to contend with in Europe — and Wikipedia’s parent, the Wikimedia Foundation. At the crux of the issue has been whether one country (or group of countries) should be able to dictate what content is available to people elsewhere in the world.
“No single nation should attempt to control what information the entire world may access,” said Wikimedia’s legal counsel, Aeryn Palmer, in a 2016 statement. “This case would fundamentally undermine the Wikimedia vision of a world where every single human being can freely share in the sum of all knowledge.”
Although today’s ruling is good news for Google and its ilk, it doesn’t necessary mean there won’t be similar cases in the future. The ECJ noted that although search engine operators are not required to carry out a de-referencing on all local versions of their search engine, they are not prohibited from doing so. Effectively, local jurisdictions within the EU are still free to weigh a person or company’s right to privacy against the right to freedom of information on a case-by-case basis.
“The authorities of the member states remain competent to weigh up, in the light of national standards of protection of fundamental rights, a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other. And after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine,” ECJ’s statement reads.
In other words, Google, Microsoft, and others could still find themselves having to fight global right-to-be-forgotten requests down the line. But today’s ruling does set a precedent, one that may discourage EU member states — or individuals — from pursuing such a course of action.
You can't solo security COVID-19 game security report: Learn the latest attack trends in gaming. Access here