On Sept. 24, 2019, the European Court of Justice (ECJ), the highest court in the European Union, narrowed the scope of the EU Right to Be Forgotten, also known as the Right to Erasure, a part of the GDPR laws on consumer privacy. The clarification on the law requires that requests to de-reference search engine results are limited only to European Union member states, not globally.
For example, if an EU citizen searches for their name and finds what they consider critical or unsavory results, they have the right to request the search engine remove those search results. The search engine operator is now only required to de-reference, or limit, those search results in EU member states, not in other areas of the world. The search results would still be visible in other countries, such as the United States, Canada, Switzerland, and other non-EU countries.
In a press release, the ECJ recognized the importance of maintaining a balance between individual privacy and freedom of information when addressing de-referencing requests and states:
“The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.”
The ECJ recognizes that other countries view de-referencing requests differently than the EU and subsequently have different laws (or not) on the subject.
The case that introduced this topic was brought by Google in response to a €100,000 fine imposed by the French Data Protection Authority in 2015 for not granting de-referencing requests to the search engine’s domain name extensions.
It is not often that a law is narrowed in scope. Though a legal victory for Google, the ruling will require Google to offer different versions of search results to users based on their location. Having to maintain different types of search results in response to different rules in various geographic locations will mean more work for search engine operators in the long run.
One thing to keep in mind is that the onus of maintaining one’s search results remains with the consumer. Consumers must manage their own online reputations.
For links to the official ECJ judgement, click here.
*Disclaimer: I am not a lawyer and am not offering legal advice. If you have legal questions, consult a licensed attorney.*
Merry Marwig is a senior research analyst at G2 focused on the privacy and data security software markets. Using G2’s dynamic research based on unbiased user reviews, Merry helps companies best understand what privacy and security products and services are available to protect their core businesses, their data, their people, and ultimately their customers, brand, and reputation. Merry's coverage areas include: data privacy platforms, data subject access requests (DSAR), identity verification, identity and access management, multi-factor authentication, risk-based authentication, confidentiality software, data security, email security, and more.