Google wins landmark case: Right to be forgotten only applies in EU

Be careful what you put online, we constantly tell kids: the internet never forgets.

Well, unless you’re European, that is. In Europe, people have the right to ask the internet to develop select amnesia when it comes to what Google Search captures and retains in its expansive maw.

It’s called the right to be forgotten (RTBF): a right bestowed in 2014 when the European Court of Justice (ECJ) ruled that people are entitled to having the internet forget them.

Since 2015, Google and the French data privacy regulator, CNIL, have been wrestling over how wide a net that implies. Does the amnesia only include results returned to Europeans? Or does it pertain to Google’s worldwide list of domains?

On Tuesday, the ECJ ruled in Google’s favor: RTBF is EU-only, it decreed.

Recap

In June 2015, the French data protection agency told Google that it doesn’t care if a URL’s got .fr, .uk or .com glued to the end. If a European makes a legitimate request to be forgotten in search results, make it so on all your search engines in all countries, it said.

Google’s response came a month later: Ain’t happening, it said. Google filed an informal appeal saying that it would defy CNIL, that the ECJ’s ruling wasn’t global in nature, and that any move to make it so would be “a troubling development that risks serious chilling effects on the web”.

In September 2015, CNIL rejected Google’s appeal, saying that its decision didn’t mean that CNIL was trying to apply French law extraterritorially:

It simply requests full observance of European legislation by non-European players offering their services in Europe.

In February 2016, facing fines from the CNIL, Google gave in, extending RTBF to all its domains. It did what EU privacy regulators had been asking it to do and what France legally forced it to do: it submerged RTBF search results on all domains, making it impossible for people to simply hop off the .fr version of Google to go find the material on another Google domain – say, Google.com.

That same year, Google introduced a geoblocking feature that prevented European users from being able to see delisted links. But it also challenged the 100,000 ($109,901; £88,376) euro fine that CNIL had tried to impose, and that’s how the battle wound up in front of the European Court of Justice.

How the RTBF works

The RTBF allows European citizens to ask search engines not to display specific URLs linked to their name if the information contained on those webpages is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.”

Filling in Google’s link removal request form doesn’t enable people to completely scrub the web clean of any mention of them, but it can make it much harder to find things people would rather not pop high up in search results.

From the get-go, the RTBF has raised loads of thorny questions as it balances an individual’s privacy rights against freedom of speech. Some of those questions: Does it matter if the subject is a celebrity or a politician? Who determines the shelf life of data? Do people have a right to bury heinous crimes, such as murder? What if a person runs for office after hosing down their search results?

Google unenthusiastically launched the RTBF form in May 2014. In short order, it said that it was going to flag the censored search results that would result.

Regardless, Google was inundated with RTBF requests. One man who tried to kill his family wanted a link to a news article about it taken down. Other requests came in from a politician with a murky past and a convicted paedophile. By the end of the first day, 12,000 Europeans had submitted the form. For a while, the rate hummed along at 10,000 requests per day. Nearly a third of the requests related to a fraud or scam, one-fifth concerned serious crime, and 12% were connected to arrests having to do with child abuse imagery.

By May 2018, the initial flood had ebbed. Google was refusing a majority of them anyway: it was accepting between 42% and 44% of the requests per year. According to its most recent transparency report, as of 7 Sept. 2019, it had cumulatively granted 45% of RTBF search requests, or about 846,000 links.

The decision

The court decision on Tuesday held that search engines such as Google aren’t required to honor delisting requests worldwide:

Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject … to carry out such a de-referencing on all the versions of its search engine.

That doesn’t let search engines off the hook completely, though: the court included a reminder that they’re expected to have measures in place “discouraging internet users from gaining access, from one of the Member States, to the links in question which appear on versions of that search engine outside the EU.”