Implementing the right to erasure: the judgment of the EU Court of Justice in Google v CNIL

By Cedric Ryngaert and Mistale Taylor

On 24 September 2019, the Court of Justice of the EU (CJEU) rendered its judgment in Google v CNIL on the geographic scope of implementation of the right to erasure (also known as the right to be forgotten or the right to be de-referenced). The judgment has received substantial media coverage (see, e.g., here and here), but press reports have paid little attention to its legal nuances. This blogpost provides such legal analysis, and reflects on the jurisdictional aspects of the judgment, in particular on the territorial reach of decisions to de-reference search results. The post argues that the CJEU deserves credit for displaying jurisdictional reasonableness, and on that basis rejecting an obligation for search operators to de-reference search results on all versions of their search engine. However, the CJEU pays conspicuous deference to EU Member State authorities, and gives little specific guidance as to how exactly these authorities are to determine the scope of implementation of the right to erasure.  

The CJEU’s judgment in Google v Commission nationale de l’informatique et des libertés (CNIL) is supposed to give guidance regarding an issue that was left open in the Court’s Google Spain judgment (2014). In Google Spain, the CJEU had famously confirmed the existence of a right to erasure, which entitles an EU data subject to have information relating to him or her personally no longer linked to him or her by a list of results displayed following a (Google) search. After Google Spain, it remained unclear, however, how a search engine operator such as Google, which establishes that a data subject is entitled to a right to erasure, is to give effect to that right to de-referencing, in particular what the territorial scope of this right ought to be. Several implementation options could be envisaged: global implementation (which means that de-referencing takes place on all versions of Google accessed from anywhere), regional implementation (de-referencing takes place on all EU Member State versions of Google accessed from the EU), or local implementation (de-referencing takes place only in the Member State of residence of the grantee of a request for de-referencing). The French data protection agency (CNIL) took the view that global implementation was required. Accordingly, Google had to remove links to web pages from the lists of results displayed following a Google search on all Google domain name extensions. This meant that in practice, no Internet user, regardless of where he or she accessed the Internet, could see these links. Not surprisingly, conferring such a wide reach on the right to erasure raised concerns over extraterritoriality and jurisdictional overreach. Hence, it is to be welcomed that the CJEU has clarified the acceptable geographic reach of the right to be forgotten. 

In essence, the CJEU opts for a model of regional implementation. The CJEU held that ‘there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine’ (para. 64), but that instead ‘the de-referencing in question is, in principle, supposed to be carried out in respect of all the Member States’ (para. 66). 

From the perspective of international law, a rejection of a global implementation model is to be applauded. A global model might intrude on the sovereignty of other states and the life choices of foreign citizens, who could have other views on the desirability of the right to erasure and its relation with the freedom of information. The Court acknowledges this risk where it emphasizes that ‘numerous third States do not recognise the right to de-referencing or have a different approach to that right’ (para. 59), and that ‘the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world’ (para. 60). In so doing, the Court appears to apply the  notion of jurisdictional reasonableness, pursuant to which, even if a state, or the EU, in principle has jurisdictional authority, it ought to exercise this authority reasonably and balance its own interests against the interests of other states. 

Conceptually, however, the Court’s reasonableness is not free-standing, as the Court links the required jurisdictional restraint to an apparent presumption against extraterritoriality, by virtue of which the EU legislature is presumed not to legislate beyond EU territory: ‘[i]n particular, it is in no way apparent … that the EU legislature would … have chosen to confer a scope [on the right to erasure] which would go beyond the territory of the Member States’ (para. 62). This indicates, nevertheless, that the EU could have chosen to confer a global scope of implementation on the right to erasure. In fact, the Court even implies that such a choice would be internationally lawful under the territorial effects principle of jurisdiction, where it holds as follows:  

‘In a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.’ (para. 57)

‘Such considerations are such as to justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.’ (para. 58)

Thus, the Court holds that global implementation is not internationally unlawful, but that it was not the intent of the EU legislature to legislate to the fullest extent allowed under the international law of jurisdiction. Further, because global implementation is not internationally unlawful, the Court even explicitly allows national authorities to order global implementation, even if EU law does not require it:    

‘[W]hile … EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights … a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine’ (para. 72)

It remains now to be seen, however, to what extent Member States will take into account the Court’s considerations on jurisdictional restraint, in particular the divergent views that internationally exist regarding the existence and scope of the right to erasure. While these considerations are certainly authoritative and convincing in their own right, they are systemically bound up with the Court’s quest to determine the intent of the EU legislature rather than with the appropriate geographic scope of the right to erasure in the abstract (see notably the use of the words ‘in particular’ in para. 62, which make the link between reasonableness and the presumption against extraterritoriality). In any event, from an international law and global pluralism perspective, it is prudent for national authorities to order global implementation only on a very exceptional basis.

For Google, the Court’s principled endorsement of the regional implementation model should be good news, even if the Court itself did not directly review Google’s measures, as it held that ‘[i]t is for the referring court to ascertain whether … the measures adopted or proposed by Google meet those requirements (para. 71). Currently, Google uses geolocation to determine from where someone is presumed to be conducting the search and then shows him or her  redacted results on all versions of Google (.co.uk, .com, .fr, .com.au, etc.) if the user is searching from the same country as where the person requested the delisting from. The only way Google might not be seen to adhere to EU-wide implementation is that it currently shows people in the EU, but not in the EU country where someone made the delisting request, the non-redacted search results if they use a non-EU version of Google, e.g., google.com. That being said, Google can take comfort from a passage in the Court’s judgment which may allow Member States to limit implementation of the right to erasure to the country from where the person requested the delisting (i.e., local implementation only): ‘it should be pointed out that the interest of the public in accessing information may, even within the Union, vary from one Member State to another, meaning that the result of weighing up that interest, on the one hand, and a data subject’s rights to privacy and the protection of personal data, on the other, is not necessarily the same for all the Member States … it is for the Member States, in particular as regards processing undertaken solely for journalistic purposes or for the purpose of artistic or literary expression, to provide for the exemptions and derogations necessary to reconcile those rights with, inter alia, the freedom of information’ (para. 67). For the Court, local implementation only applies ‘in principle’ (para. 66). 

Because of the Court’s hedging, one could wonder what the main takeaway is from the judgment. Arguably, the Court has confirmed that regional, EU-wide implementation of the right to erasure is henceforth the default legal position. While this position is likely to be followed by Member State authorities, the latter may deviate from the default position, however, and opt instead for global or local implementation in specific circumstances. The Court remains silent, however, as to the nature of these circumstances, the identification of which is left to national authorities whose approaches may vary. Ultimately, the Court’s cautious, and even ambivalent position reflects the internationally contested nature and scope of the right to erasure. Given this reality, a quest for a one-size-fits-all solution may appear to be futile, and a case-by-case analysis the only workable solution. It remains that the Court could have given some criteria that national authorities could use when deciding on the geographic scope of implementation of the right to erasure (see for potential criteria here, here and here).