The Court of Justice of the European Union has ruled that the right to be forgotten – that is, the removal of information relating to a given person from the results of internet search engines – applies only within the territory of the EU.

In its judgment in Case C-507/17 against Google LLC, the Court of Justice of the EU clarifies that where the operator of an internet search engine grants a request to remove results submitted by a data subject, whether by order of a regulatory or judicial authority of a Member State, it is under no obligation for that removal to cover all international versions of the search engine.

The case was prompted by a fine of EUR 100,000 imposed on Google Inc. The company was penalised for its refusal to remove disputed results from all extensions of its domains. Google argued that the right to be forgotten does not include the unconditional removal of links on a global scale.

The Court rules that EU law does not extend the rights of data subjects beyond the territory of the Union. For this reason, an operator such as Google cannot be required to remove search results also in the national versions of the search engine that are not for EU Member States.

Scope of removal in the Member States

Within the EU, search engine operators must erase the results corresponding to the Member States and take effective measures to prevent or significantly restrict users' access to the relevant hyperlinks through versions of the search engine outside the EU. The measures must be sufficiently effective to deter, or at least seriously hinder, internet users in the EU from finding the unwanted information through the search engine in a global context.

EU Member States may, through their national legislation, impose obligations to remove information on an international scale if they consider this necessary. The Court notes that the right to be forgotten is not universally recognised and that different states outside the EU adopt different approaches. The balance between the protection of personal data and the public's right of access to information varies, and therefore each country assesses the significance of the personal data according to its own legal standards.

Where sensitive data is involved

In its judgment in Case C-136/17, the Court of Justice of the EU rules that where the operator of an internet search engine receives a request to remove a result containing sensitive data, it must assess the specific case. The removal should be considered by weighing the seriousness of the interference with private life and the right to data protection of the person concerned against the public's right of access to that information.

Where data has been made public by the person, the search engine may refuse removal, provided that the processing of the data is lawful and the person has no legal grounds to object. In this case, refusal is permissible if all the requirements for the lawfulness of the processing are met and the person concerned cannot object on that basis.

Removal of data concerning judicial proceedings

Where there is a request to remove results containing information about a court case involving personal data, the operator of the search engine assesses whether to grant the request. Where the judicial information relates to an earlier stage of the court proceedings and does not reflect the current situation, the request for removal should be granted. This assessment is based on the following circumstances:

  • the nature and seriousness of the offence,
  • the development of the court proceedings and their outcome,
  • the time that has elapsed,
  • the role of the person in society,
  • the interest of the public at the time of the request,
  • the content, form and consequences of the publication.
Updating results where removal is refused

If the operator refuses removal, it is nevertheless obliged, upon receipt of the request, to update the results so that users receive correct information consistent with the current legal position. This requires that the links reflecting the new circumstances appear first in the list of results, so that the user is informed of the most recent information on the subject.

Should you need assistance in preparing GDPR documents or a consultation in the field of personal data protection, please contact us on tel.: 0887550706 or by e-mail: [email protected]