Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-5595" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/01/data-international-iStock-618023980.jpg" alt="Abstract  Futuristic infographic with Visual data complexity , represent Big data concept, node base programming" width="368" height="250" />On January 10, Advocate General <a href="https://curia.europa.eu/jcms/jcms/rc4_170743/en/">Maciej Szpunar</a> released an <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__curia.europa.eu_juris_celex.jsf-3Fcelex-3D62017CC0507-26lang1-3Den-26type-3DTXT-26ancre-3D&amp;d=DwMFaQ&amp;c=tlFs99Fl3Rlo51LXUBQcug&amp;r=P5IuWgh1cu_Bf6M3hCMstiurcBh9ybxtvdTXJO4YT6w&amp;m=ikCNdkxRAX3m6pqn-Lqwd-9sp0nImV7sACUxjvEUi6w&amp;s=0WO1nQbpDC3R1688YJkSPf6DGuDAzWgyoB_57-8Po8E&amp;e=">opinion</a> recommending that Google and other search engines should not be forced to apply the EU’s “right to be forgotten” beyond the EU.  The advocates general assist the judges of the Court of Justice of the European Union (CJEU), providing independent legal solutions to issues presented to the CJEU. The judges decide whether an official opinion from an advocate general is necessary. The judges are not obligated to follow an advocate general’s recommendation but often do. Sometimes the CJEU will also arrive at the same conclusion as the advocate general but through different legal analysis.



This opinion is part of a long-running battle over privacy rights in the EU. In May 2014, the CJEU issued an <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=305802">opinion</a> in <em>Google Spain v. Agencia Española de Protección de Datos (AEPD)</em>, ruling that Google, as a commercial service provider, processes personal information for a profit and targets EU users, making the company subject to EU law and responsible for the personal information it processes. Under that ruling, Google and similar commercial search providers could then be required to remove links to personal information from search results. The decision affirmed EU individuals’ right to request that Google and similar commercial search providers remove links to personal information about themselves when asked to do so, if the information is no longer relevant and the person is not a public figure. Commonly referred to as the “right to be forgotten,” the now-operative General Data Protection Regulation includes a right to request erasure in Article 17.

Following this decision and upon request by EU individuals, Google delisted search results from queries on an individual’s name and delisted certain URLs. Google now delists these from all of Google’s European search results based on the use of geolocation signals to restrict access. Since May 29, 2014, <a href="https://transparencyreport.google.com/eu-privacy/overview?hl=en_GB">Google has received</a> more than 750,000 requests to delist information from search results and nearly 3 million requests to delist URLs.

Leading to the issue now before the CJEU, Google received requests from French citizens to remove certain information from search results. In accordance with its policy to delist based on European search results, Google removed results available on the European extensions of the search engine (e.g., .fr, .es, and .co.uk). Google did not remove those results on other geographical extensions or on google.com, which any internet user can visit.

In May 2015, the president of the French Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties; the “CNIL”) put Google on <a href="https://www.cnil.fr/fr/node/15790">notice</a> that it must remove results on all of the search engine’s domain name extensions, because a Google search consists of a single process across all domains. In July 2015, Google filed an informal appeal asking the president of the CNIL to withdraw this public formal notice. In September 2015, the CNIL <a href="https://www.cnil.fr/fr/node/15814">rejected</a> this informal appeal.

In early 2016, Google began blocking access to certain of the disputed links from all of its domains when people in Europe use its search engine, using geolocation signals to restrict access. In March 2016, the CNIL determined that Google had failed to comply with its formal notice within the prescribed time limit and imposed a penalty of 100,000 euros. Google lodged an application before the Conseil d’État, France’s highest administrative jurisdiction, seeking to have that adjudication annulled. The Conseil d’État decided to refer several questions to the CJEU for a preliminary ruling. The questions relate to the extent of the obligation to comply with a request to remove search results in compliance with <em>Google Spain</em> and the extraterritorial reach of that obligation.

In last week’s opinion, Advocate General Szpunar <a href="https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-01/cp190002en.pdf">proposed</a> limiting this “right to be forgotten” to a full and effective delisting within the EU, which would limit as well the extraterritorial scope of the GDPR. He argued that the fundamental right to be forgotten must be balanced against other fundamental rights, including the right to data protection and the right to privacy, as well as the legitimate public interest in accessing the information sought. However, the Advocate General did acknowledge that some situations may call for worldwide erasure, though he declined to suggest it in this case. Further, once a right to be forgotten within the EU has been established, Advocate General Szpunar’s opinion states that the search engine operator must use “geoblocking” by IP addresses/tech solutions globally with EU internal effect.

This case will test the CJEU on how to balance globally mobile data with national laws and territorial jurisdiction, and it highlights the practical difficulties of compliance. A decision from the CJEU is expected in 2019, and no final appeal is possible within the EU.

Advocate General Opinion Supports Limiting the “Right to be Forgotten” to the EU