The Court of Justice for the European Union today ruled that a privacy law commonly known as the "right to be forgotten" doesn't apply beyond the EU's borders. Internet activists hailed the decision as a victory against online censorship, because it means that EU laws can't force search companies to de-list results made in other countries, which would have given the EU outsized control over what data is available online around the world.
The premise behind the right to be forgotten is simple: people shouldn't be haunted by their pasts forever. But in the modern era, companies like Google have made it near impossible for people to leave their pasts behind, with many of their most embarrassing moments just a few clicks away. That wasn't a problem just a few decades ago; the right to be forgotten is supposed to give people the same chance of moving on.
Implementing the right to be forgotten is another matter. Some people, like celebrities and politicians, live in the public eye. How should their requests to have search results de-referenced (as the CJEU put it) be handled? Other people might want to bury search results, too, but at what point do they become a matter of public interest? And who's going to make sure the rule isn't abused to cover up information that should remain available?
This wasn't a small problem. Google said in 2018 that it received requests to de-list 2.4 million URLs in the first three-and-a-half years since the right to be forgotten's introduction. We doubt those requests have stopped in the interim, which means it's important for the company to know exactly how the EU wanted de-listed results to be handled. Was it truly attempting to remove the results from the global internet, or just within its borders?
CJEU published an initial opinion in January saying it believed that applying the right to be forgotten outside the EU would set a dangerous precedent when it came to online censorship. The EU might have good intentions regarding the removal of certain URLs from search results. Would more oppressive governments like China, Russia and the like use the precedent set by the right to be forgotten to step up their own censorship efforts?
Here's what CJEU said in today's ruling:
The Court emphasises that, in a globalised world, internet users’ access — including those outside the EU — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the EU is likely to have immediate and substantial effects on that person within the EU itself, so that a global de-referencing would meet the objective of protection referred to in EU law in full. However, it states that numerous third States do not recognise the right to dereferencing or have a different approach to that right. The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.
