This week, the Court of Justice of the European Union ruled that “right to be forgotten” does not extend to the versions of Google’s search engine directed to non-EU member states. Ron Moscona, a partner at the international law firm Dorsey & Whitney, looks at the implications for the digital industry.
This is good news for Google and other operators of online services, at least in that they will need to worry less about having potentially conflicting legal obligations in different jurisdictions when complying with ‘right to be forgotten’ requests relating to their online services. Online service operators can now proceed on the basis that when content has to be taken down to comply with a ‘right to be forgotten’ request, it will only need to be taken down from the versions or iterations of these services servicing the EU market. In principle, non-EU versions of the services would not need to be affected by the request.
It is noteworthy that the Court’s reasoning drew on the idea that privacy interests are not absolute rights but rights that have to be balanced against competing interests and that different countries (even within the European Union) may strike a different balance between the interests of privacy on the one hand and the interests of free speech and freedom of information on the other. In other words, the EU court recognises that countries outside the European Union may legitimately place a stronger weight, for example, on freedom of speech interests and that unless the EU legislature clearly imposes a duty that extends to territories outside the EU, the court will interpret the legislation as being limited to the territory of the EU.
The wider implications of the decision are very difficult to predict. The decision does not consider the broad issues concerning the territorial effect of GDPR. The provisions of Article 3 GDPR that define its territorial effect clearly extend the legal rights and obligations of GDPR, in many circumstances, to the processing of personal data outside the EU including by entities operating outside the EU.
This week’s decision of the EU court does not address these broader territorial issues. Rather, the case focused specifically on the obligations of a global online service – specifically a search engine – that hosts personal data, flowing from the exercise by an individual of the ‘right to be forgotten’. The courts will have to develop the law further before it becomes clearer in what other ways the legal obligations under GDPR may be limited to the territory of the EU.
By Ron Moscona
Partner
Dorsey & Whitney