The Court of Justice of the European Union Issues a Ruling on the Right to be Forgotten

Written by: Chase Langhorne, Esq.

On September 24 the Court of Justice of the European Union (CJEU) issued a landmark ruling on GDPR’s “right to be forgotten.” The case was brought by Google challenging an order, and subsequent fine, issued by the French Data Protection Authority (CNIL), over Google’s choice not to comply with CNIL’s order globally. The CNIL ordered Google to remove search engine results containing personal data of people in the EU from search results worldwide. Instead, Google implemented a “geo-blocking” feature for users in the EU that delisted certain results from the view of EU users, but not from users outside the EU. Since Google did not remove the results globally the CNIL issued Google a €100,000 fine. Google then took the case to the French Conseil d’État (Council of State), which referred the case to the CJEU.

The question before the CJEU was whether or not GDPR’s right to be forgotten, as it relates to internet search engine results, could be applied globally. The CJEU made it very clear that the question of territorial application of GDPR’s right to be forgotten was being analyzed for this specific set of facts and did not indicate that this was a blanket ruling regarding the global application GDPR’s right to be forgotten. The CJEU agreed with Google that users outside of the EU had a right to the freedom of information that may otherwise be required to be limited in the EU by GDPR’s right to be forgotten.

It is important to note that the CJEU applied this ruling to this specific set of facts and conducted a balancing test that balanced a user’s right to be forgotten with the public’s right to freedom of information. It is unlikely that this will be seen as a basis for international organizations to ignore GDPR requirements in countries outside of the EU. The CJEU went on to state that there is no evidence to indicate the EU legislature has intended to extend rights to individuals beyond the territory of EU member states.

This is a rare win for international tech companies who have been increasingly regulated since the passage of GDPR. The next step is for the French Council of State to decide the case Google has brought in light of the CJEU’s ruling. The CNIL has issued a statement saying it will issue FAQs explaining the practical implications of the CJEU’s ruling.