Shawdesh Desk: Europe’s top court has ruled that Google does not have to apply the right to be forgotten globally.

It means the firm only needs to remove links from its search results in Europe – and not elsewhere – after receiving an appropriate request.

The ruling stems from a dispute between Google and a French privacy regulator.
In 2015, CNIL ordered the firm to globally remove search result listings to pages containing damaging or false information about a person.

The following year, Google introduced a geoblocking feature that prevents European users from being able to see delisted links.

But it resisted censoring search results for people in other parts of the world. And the firm challenged a 100,000 ($109,901; £88,376) euro fine that CNIL had tried to impose.

“Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject… to carry out such a de-referencing on all the versions of its search engine,” the European Court of Justice ruling said.

Google had argued that the obligation could be abused by authoritarian governments trying to cover up human rights abuses were it to be applied outside of Europe.

“Since 2014, we’ve worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people’s rights of access to information and privacy,” the firm said in a statement following the ECJ ruling.
“It’s good to see that the court agreed with our arguments.”

The tech firm had been supported by Microsoft, Wikipedia’s owner the Wikimedia Foundation, the non-profit Reporters Committee for Freedom of the Press, and the UK freedom of expression campaign group Article 19, among others.

ECJ adviser Maciej Szpunar had also concluded that the right to be forgotten be limited to Europe in a non-binding recommendation to the court earlier this year.

Google has applied the right to be forgotten since May 2014, when the ECJ first determined that under some circumstances European citizens could force search firms to delist webpages containing sensitive information about them from queries made using their names.

The idea is to hide sensitive information – such the fact a person once committed a criminal offence or had an extra-marital affair – if the details are judged to be “inadequate, irrelevant or no longer relevant or excessive”.

Google has said that since that time it has received more than 845,000 requests to remove a total of 3.3 million web addresses, with about 45% of the links ultimately getting delisted.

This involves both removing the results from its European sites – such as Google.fr, Google.co.uk and Google.de – as well as restricting results from its other sites – such as Google.com – if it detects a search is being carried out from within Europe.

However, this means that users can still circumvent the action if they use a virtual private network (VPN) or other tool to mask their location.

Notably, the ECJ ruling said that delistings must “be accompanied by measures which effectively prevent or, at the very least, seriously discourage an internet user” from being able to access the results from one of Google’s non-EU sites.

“It will be for the national court to ascertain whether the measures put in place by Google Inc meet those requirements.”

News sites, including the BBC, are exempt from the rule, but may find that links to some of their old articles no longer appear on Google or other search engines.