The Right to be Forgotten is NOT an absolute right - Europe's highest court hands Google an important privacy victory

A big day for important court action. Not only has the British Prime Minister been found guilty of illegally suspending Parliament, Europe’s highest court has just handed Google an unaccustomed victory.

While the company is more used to being on the receiving end of heavy fines in the European Union, the Court of Justice of the European Union (CJEU) has ruled that Google will not be required to enforce Europe’s controversial “Right to be Forgotten’ law outside of  the EU.

The Right to be Forgotten enables European residents to demand that Google - and other search engines/social platforms - remove information or personal references to them that they consider to be inaccurate. More problematically it also allows for requests for removal of embarrassing or inconvenient information, such as criminal convictions.

It came into force following a court case in which a Spanish citizen demanded that Google removed pages from 1998 that detailed the forced sale of a property that he had owned at the time.

Since then Google has accepted and dealt with requests for deletion when the information in question is hosted on its European domains. During the court hearing, the firm said it has received 845,501 deletion requests in the past five years and removed 45% of the 3.3 million links referred to in those requests.

But it has refused to extend the same rights beyond EU boundaries. This means that, for example, an offending item could be erased from history on google.co.uk, but still be found on google.com.

France's data regulator, the Commission Nationale de l'Informatique et des Libertes (CNIL), disputed this loophole and insisted that EU law should extend to all domains, fining Google €100,000 in 2016 for non-compliance with its demand. Google then appealed to the CJEU for an final opinion on the matter.

Not absolute 

That opinion this morning sided with Google, determining in its ruling that the Right to be Forgotten is not a global right:

The right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.

Interestingly the court also ruled separately that links do not automatically have to be removed just because they contain information about a person's sex life or a previous criminal conviction. Such items could justifiably remain if there is a case that removal would breach others freedom of information rights.

It added that Google and other search engines have an obligation to “discourage” users from using technology such as VPNs in order to circumvent domains where the Right to be Forgotten does apply and that it is down to national courts around the EU to determine whether appropriate measures have been taken. National courts are also expected to handle local cases:

The authorities of the member states remain competent to weigh up, in the light of national standards of protection of fundamental rights, a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other. And after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine,

In response, Peter Fleischer, Google’s senior privacy counsel, said in a statement:

Since 2014, we've worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people's rights of access to information and privacy. It’s good to see that the court agreed with our arguments.

My take

A good ruling by the CJEU and one that had been likely since an advisory note was published in January, written by Advocate General Macieg Szpunar. The CJEU seldom deviates from such advice, but it’s still a relief to read the final opinion. France’s arguments would have been a clear impingement on free speech and an outrageous attempt to extend EU law to other nations.

The reaction from the White House if the case had gone the other way can only be imagined. And at a time when the EU is rightly resisting attempts to extend US reach around data stored in Europe, any other opinion by the court would have been hugely unhelpful to say the least.

I still maintain that the Right to be Forgotten in its current form is bad law and open to enormous abuse by the nefarious elements of society. But at least it’s being contained within EU borders.