Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)

In the above judgment dated 24 September 2019, the Court of Justice of the European Union (CJEU) held that Google is not required to guarantee the right to be forgotten outside of Europe. According to the Court's decision, the right to be forgotten does not oblige search engine operators to carry out de-referencing on all versions of the search engine, but only on those accessible within EU territory.

This case concerns a complaint brought by Google against the National Commission for Informatics and Liberties (CNIL). Pursuant to the decision taken by the CNIL, Google was forced to de-list certain links which include personal data of specific individuals. The CNIL’s decision essentially ordered Google to de-list such links not only on the Google.fr domain, but on a worldwide basis. Google challenged this interpretation of the territorial scope of the right to be forgotten before the Conseil d’État, which in turn made a preliminery refernce to the CJEU on this point.

Right to erasure (“right to be forgotten”)

The decision taken by the CNIL relates directly to the scope of the right to erasure, now enshrined in article 17 of the GDPR. Providing data subjects with a right to have their personal data erased is particularly important for the effective application of data protection principles, particularly the principle of data minimisation (personal data must be limited to what is necessary for the purposes for which that data is processed).

The CJEU has affirmed the importance of this right to ensure a high level of data protection, specifying however that the right to the protection of personal data is not an absolute right and must be considered in relation to its social function and be reconciled with other fundamental rights.

In a globalised world, access to the Internet can take place simultaneously from different parts of the world and by different users. Accordingly, global de-referencing could ensure the effective protection of data subjects’ right to erasure. However, numerous third States do not recognise the right to erasure and to date, EU law does not provide cooperation with third countries on this point.

Therefore, as indicated by the Court, there is currently neither an obligation on search engines to apply worldwide de-referencing, nor a prohibition.

We note that this ruling raises interesting insights into the balancing of private life on one hand and protecting the freedom of information on the other. An increasingly globalized market sets new goals, questions and new points of reference. The Court has anticipated a concept that will be necessary in the coming years: law has territorial limit, cooperation does not.

More information on the CJEU decision can be found here.