EFF: European Court’s Decision in Right To Be Forgotten Case is a Win for Free Speech

European Court’s Decision in Right To Be Forgotten Case is a Win for Free Speech

In a significant victory for free speech rights, the European Union’s highest court ruled that the EU’s Right to Be Forgotten does not require Google to delist search results globally, thus keeping the results available to be seen by users around the world.

The EU standard, established in 2014, lets individuals in member states demand that search engines not show search results containing old information about them when their privacy rights outweigh the public’s interest in having continued access to the information. The question before the court was whether Google had to remove the results from all Google search platforms, including Google.com, or just the ones identified with either the individual’s state of residence, in this case Google.fr, or ones identified with the EU as a whole.

The Court of Justice of the EU (CJEU) decided that the Right to Be Forgotten does not require such global delisting. Thus, by delisting search results from Google.fr and from any search performed through an IP address identified as being located in France, Google was in compliance with the Right to be Forgotten. France’s data protection authority, the Commission Nationale de l’Informatique et des Liberties (CNIL),  had argued that the Right to be Forgotten required Google to delist search results from all of its sites, since they were all available to users in France.

EFF joined Article 19 and other global free speech groups in urging the Court of Justice to reach this decision and overturn a ruling by CNIL. As the brief explained, a global delisting order would conflict with the rights of users in other nations, including U.S. users protected by First Amendment. U.S. courts have consistently held that the First Amendment’s protections for expression, petition, and assembly necessarily also protect the rights of individuals to gather information to fuel those expressions, petitions, and assemblies.

As we explained in the brief:

"In the United States, a right to de-reference publicly available information on data protection grounds would be unconstitutional: the First Amendment to the US Constitution guarantees the right of people to publish information on matters of public interest that they acquire legally, even in the face of significant interests relating to the private life of those involved (Smith v. Daily Mail Publishing Co. 443 US 97 (1979)). This reasoning extends to those situations where there is a significant governmental interest in maintaining the confidentiality of the information in question (Oklahoma Pub. Co. v. Distr. Court 430 US 308 (1977), where the information concerns judicial procedures (Landmark Communications, Inc. v. Virginia 435 US 829 (1978) and even where the publisher of the information knows that her or his source obtained the information illegally (Bartnicki v. Vopper 532 US 514 (2001). The First Amendment also guarantees the right to receive information, including by means of a search engine (see e.g. Langdon v. Google 474 F. Supp. 2d 622 (D. Del. 2007)). . . .  The incompatibility of broad de-referencing obligations with US law is especially relevant in the present case given that all major search providers are established in the US…"

The CJEU agreed. It found “that numerous third States do not recognise the right to de-referencing or have a different approach to that right. . . . Furthermore, the balance between the right to privacy and the pf personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.” Thus, “there is no obligation under EU law, for a search engine operator  . . .  to carry out such a de-referencing on all the versions of its search engine. . . . [and] a search engine operator cannot be required . . .  to carry out a de-referencing on all the versions of its search engine.

The CJEU also found that EU state data protection regulators could only order de-listing in domains associated with other EU member states after conferring with their counterparts from other states. The purpose is to ensure that such an order would be consistent with any other state’s implementation of the Right to be Forgotten.

In a passage that has left commentators scratching their heads, the court emphasized that even though the Right to be Forgotten “does not currently require” delisting from all versions of Google’s search engine, “it does not prohibit such a practice.” The court said an authority in an EU member state may balance an individual’s right to privacy and the freedom of information and, “where appropriate,” order the operator of a search engine to delist search results from all of its versions.

It is unclear how to square this with the court’s statement that “a search engine operator cannot be required . . .  to carry out a de-referencing on all the versions of its search engine.” Some commentators have suggested that the EU could rewrite the Right to Be Forgotten directives to permit global delisting. Another interpretation is that the court was preserving the ability of individual state authorities to order global delisting as a remedy in extraordinary cases. And yet another interpretation is that the court was simply allowing for the possibility of global delisting orders for violations of other laws, but not the Right to Be Forgotten. So this is unlikely to be the last time the CJEU takes up the issue of global delisting; indeed, another case, presenting a similar issue in the context of a defamation claim, is expected to be decided soon.

The ability of one nation to require a search engine to delist results globally would prevent users around the world from accessing information they have a legal right to receive under their own country’s laws. That would allow the most speech-restrictive laws to be applied globally. The CJEU decision rightly rejected that scenario.