The scope of the right to be forgotten

The right to be forgotten has been fought out in Dutch courts many times since the Costeja judgment. [3] On Sept. 24, 2019, it was the European Court of Justice's turn on the scope of the right to be forgotten. [4] The Court ruled that, based on the right to be forgotten, Google does not in principle have to remove search results worldwide. It should remain possible for Internet users outside the EU to receive deleted search results in the EU.

Dutch court on scope of right to be forgotten

The Dutch court was first presented with the question of the scope of a removal request in 2016. [5] The case concerned a lawyer who had been convicted of prohibited possession of firearms, about which a blogger had published a piece with the lawyer's name and photo. Google argued that the lawyer had no interest in any removal of search results with a broader application than the Dutch version of Google Search, namely google.nl. To this end, Google argues that Google Search directs its users to the local version of the search engine, such as google.nl, based on their location when searching from the Netherlands via google.com. The lawyer had argued against this that automatically redirecting to the location of the Google Search user depends on the settings entered by the Google Search user. This means that different settings of Google Search will no longer automatically redirect the search engine user to the google.com version. Since Google had not disputed this contention, the court saw no reason to limit the lawyer's request to the Dutch version of Google Search. [6]

In another case, Google argues that the Dutch court has no jurisdiction to rule on a request to remove information from foreign versions of Google Search because that information falls under the jurisdiction of the foreign court. In that case, this defense was passed over because it is in itself possible for a Google Search user to also use google.com in the Netherlands. The Personal Data Protection Act (Wbp) was also applicable in such a situation under Section 4(2) Wbp, since the controller (Google) uses automated means located in the Netherlands. [7]

Court of Justice

The scope of the right to be forgotten has also been debated outside the Netherlands. The French data protection authority (the Commission nationale de l'informatique et des libertés - the CNIL) had fined Google EUR 100,000 by decision of March 10, 2016, for Google's failure to remove search results worldwide under the right to be forgotten. In fact, Google does not remove the search results from the .com extension, but only from the local European extension. This means that users outside Europe can continue to see the results affected by the removal request.

In March 2016, following "specific discussions that we've had with EU data protection regulators in recent months," Google nevertheless decided to broaden the removal request so that Google not only removed search results from all European versions of Google Search (such as Google.co.uk as well as Google.be, Google.fr etc.), but when a search result was (ordered to be) removed, also ensured that (based on the Internet user's location(geoblocking), using, for example, the IP address) the relevant search results were no longer shown to users searching from the Netherlands, regardless of which version of Google Search, including google.com, is used:[8]

"So for example, let's say we delist a URL as a result of a request from John Smith in the United Kingdom. Users in the UK would not see the URL in search results for queries containing [john smith] when searching on any Google Search domain, including google.com. Users outside of the UK could see the URL in search results when they search for [john smith] on any non-European Google Search domain." So a removal request has no impact on Internet users outside the EU, who can still find search results removed in the EU.

Because the CNIL also deemed geoblocking insufficient, it eventually proceeded to impose the fine. However, removing search results worldwide, thus also for Internet users outside the EU, goes far too far for Google: "The right to be forgotten can sometimes seem complex, and discussions about jurisdiction online certainly are complicated. But this issue is simple: should the balance between the right to free expression and the right to privacy be struck by each country-based on its culture, its traditions, its courts-or should one view apply for all?" [9]

Google therefore appealed to France's highest court, which then referred questions to the Court of Justice. The French Raad van State of State asked the Court whether search results should be removed globally and, if not, whether the results should be removed at the European or national level. Furthermore, the French Raad van State of State asked whether the right to be forgotten should be applied to extensions or on the basis of IP addresses from which it can be deduced in which country the user is located.

The Court of Justice first states that, on the basis of Article 17(1) AVG, a data subject has the right to obtain from the controller the erasure of personal data concerning him without unreasonable delay, and the controller is obliged to erase such data without unreasonable delay when one of the cases mentioned in that provision applies. Article 17(3) AVG specifies that the right to be forgotten does not apply insofar as the processing in question is necessary for one of the reasons mentioned in Article 17(3). According to Article 17(3)(a) AVG, these reasons also extend to the exercise of Internet users' right to freedom of information, among other things.

Based on the recitals of the AVG (10, 11 and 13), the ECJ finds that the purpose of the AVG is to ensure a high level of protection of personal data throughout the EU. There is therefore no question that the removal of search results for all versions of a search engine fully meets that objective. "After all, the Internet is a global network without borders, and search engines ensure that the information and links in the results list displayed after a search performed on a natural person's name are available everywhere." On the basis of the aforementioned considerations, the Court of Justice considers that the Union legislature is empowered to impose on the search engine the obligation, when granting a request for removal, to proceed to such removal for all versions of its search engine.

Nonetheless, the ECJ emphasizes that numerous third states do not know the right to the deletion of search results or take a different approach with respect to this right. Also, the right to protection of personal data does not have absolute validity, but must be balanced against other fundamental rights in accordance with the principle of proportionality. Moreover, the balance between the right to respect for private life and to protection of personal data on the one hand and the freedom of information of Internet users on the other hand can vary considerably worldwide.

It does not appear from the AVG that there is any such consideration regarding the scope of deletion of links outside the EU. In addition, the AVG also does not show that the right to be forgotten extends beyond the EU. The CJEU does stress that the search engine must take effective measures that prevent or at least seriously discourage EU Internet users from accessing the deleted search results on non-EU versions of the search engine via a search on the data subject's name, (Google did so, as explained above, through geoblocking). Thus, if Google has to remove search results, it must do so on versions within the EU, i.e. on google.co.uk, google.de, google.fr, etc., but not on google.com.

The CJEU adds an important note here. While the AVG does not provide for the obligation to remove search results worldwide (outside the EU), it does not prohibit it either. Therefore, the supervisory data protection authorities and national courts in the EU are still empowered to make their own balancing exercise between the data subject's right to respect for their private life and to protection of their personal data on the one hand and the freedom of information on the other, and after this balancing exercise, to order the search engine to remove the search results in question for all versions of that search engine.

Conclusion

The ECJ ruling is another step in the years-long battle over the right to be forgotten. Google's (expanded) policy on the right to be forgotten is in line with the Court's considerations. Indeed, Google removes search results from all EU versions of Google Search and through geoblocking, Google also ensures that removed search results are no longer shown to Internet users searching from the Netherlands, regardless of which version of Google Search, including google.com, is used. Whether this should be considered "effective" measures as the Court intended is up to the national court.

[1] ECJ EU 13 May 2014, C-131/12, ECLI:EU:C:2014:317 (Google Spain).

[2] However, see Amsterdam District Court March 22, 2018, ECLI:NL:RBAMS:2018:3354 in which the court considered that application of the AVG in that case probably would not have led to a different result.

[3] L. Mourcous and M. Weij, Three years of the right to be forgotten: an analysis of Dutch case law, Tijdschrift voor Internetrecht 2017 no. 4. L. Mourcous and M. Weij, 2018 the year of Google: the right to be forgotten in case law, Journal of Internet Law 2018, no. 5/6, pp. 189-194

[4] C-507/17, ECLI:EU:C:2019:772.

[5] Rotterdam District Court March 29, 2016, ECLI:NL:RBROT:2016:2395, r.o. 4.5-4.7.

[6] See also: Rechtbank Amsterdam 19 April 2017, ECLI:NL:RBAMS:2017:2896, r.o. 4.4: "It will be ordered to take the two measures that are customary for it in this type of case, namely to ensure that the URL referred to above under 2.2. is no longer shown to users searching " [name 8] " from the Netherlands and also that this search result is removed from all local EU/EFTA versions of Google Search."