Google wins EU fight against worldwide 'right to be forgotten'

Google is not required to apply an EU "right to be forgotten" to its search engine domains outside Europe, the EU's top court ruled Tuesday in a landmark decision.

The European Court of Justice handed victory to Google in the case, seen as crucial in determining whether EU online regulation should apply beyond Europe's borders or not.

This file photograph taken on February 5, 2014, shows a Google logo on a wall at the entrance of the Google offices in Brussels. EU's highest court is expected to decide Google 'Right to be Forgotten' case on September 24, 2019. [Photo: AFP]

The US internet giant had argued that the removal of search results required under EU law should not extend to its google.com domain or its other non-EU sites.

The court ruled that, while a search engine operator such as Google must carry out "de-referencing" of links as demanded by a regulator or court in an EU state to all European versions of its sites, that "right to be forgotten" did not need to go further.

"There is no obligation under EU law" for search engine operators such as Google "to carry out such a de-referencing on all the versions of its search engine," the court said.

But it did stress that de-referencing on EU sites must include measures to "seriously discourage" a European internet user being able to get around the "right to be forgotten" by accessing unrestricted results from a search engine on a non-EU domain.

That demands "geo-blocking", which Google says it already uses effectively in Europe.

- France sees loophole -

But it was unclear the legal battle over the issue is entirely over.

The French data regulator CNIL, whose fight since 2014 to have Google apply the "right to be forgotten" to all its search domains sparked the EU court case, reacted by saying the ruling did not expressly prevent it demanding worldwide de-referencing.

"If EU law does not impose global de-referencing, it does not forbid it either," CNIL said in a statement.

"As a result, a regulatory authority, and therefore CNIL, is competent to demand a search engine to de-reference results on all its search engine versions if that is justified, in certain cases, to guarantee the rights of the person concerned," it said.

CNIL also said it was up to France's highest court to deem whether Google's geo-blocking technology was sufficient.

CNIL in 2016 fined Google 100,000 euros ($110,000) for not complying with its order to apply the "right to forget" everywhere. The regulator argues that, for de-referencing to be effective on the internet, it must apply to all domains wherever they are.

Google appealed to France's highest court, which in turn referred to the European Court of Justice, leading to Tuesday's ruling.

- Google hails win -

The EU court case was seen as pitting individuals' rights to privacy online against freedom of information.

If France had won Tuesday, it could have deepened a rift between Europe and the United States, which is home to most of the internet's behemoths and whose President Donald Trump has railed against what he sees as EU meddling in US business.

Google hailed the decision by the EU court.

"It's good to see that the court agreed with our arguments," its lawyer, Peter Fleischer, said in a statement, adding that Google has worked "to strike a sensible balance between people's rights of access to information and privacy".

The US company and other stakeholders had warned that authoritarian countries outside Europe could abuse global de-referencing requests to cover up rights violations.

Google's position was bolstered in January by a non-binding opinion from the EU court's top legal advisor, advocate general Maciej Szpunar, who recommended judges "should limit the scope of the de-referencing that search engine operators are required to carry out, to the EU".

The case had been closely watched, especially as Europe has also already emerged as a global rule-setter in terms of data protection on the internet.

A 2016 General Data Protection Regulation it enacted that covers all EU citizens and residents has forced many sites and companies around the globe to comply.