Analysis of the past, future and present legal position concerning Google removal of web pages under the Right to be Forgotten, from worldwide search results
There is still a great deal of confusion as to the extent of Google's delisting of search results under the Right to be Forgotten. The main question is whether Google will delist web pages from search results from outside of Europe.
The aftermath of the 2014 Google Spain case was that Google began to implement a policy of delisting articles, which complied with the principles of that case, from Google internet searches. However, the removal by Google only applied to the individual’s applicant own country.
In the case of someone who resided in the UK, their successful Right to be Forgotten application would have been limited to delisting of offending web pages from search results but only for Google.co.uk. This situation was highly unsatisfactory because if, for example, you searched for the delisted webpages from the UK, using Google.com, the offending search results would have still appeared. This resulted in numerous complaints to the regulator, the Information Commissioner's Office (ICO) who in 2015 came to an understanding with Google, which involved an undertaking by Google to have offending search results under the Right to be Forgotten removed from all searches conducted across Europe.
This was regardless of whether the search engine used was Google.co.uk, Google.com or Google.fr. Across Europe refers to countries that are members of the European Economic Area and which include Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the UK.
Despite the undertaking by Google, there had still been too many instances where Google did not comply with its promises. The delisting by Google of offending web pages from search results across European searches was sporadic. It took nagging and begging by committed lawyers acting on behalf of individual right to be forgotten applicants, coupled with threats of legal action before Google complied with its promises to the ICO. Even after Google delisted offending search results across its European search engine network, the situation was still unsatisfactory. Google was adamant that searches on Google.com will be excluded from the European delisting arrangement, which meant, internet users in these countries who carried out searches on Google.com were still able to view the links to the offending web pages on the Google.com search engine.
This, in turn, led to more complaints to the ICO who promised to settle the matter indefinately with Google. As a result of the ICO intervention, Google changed the way by which it carried out delisting and started to delist content based on geolocation rather than what search engine the internet user had used to carry out the search. The next step was to convince Google to delist offending web pages from search results Google search networks across the world. An opportunity came in June 2015 when the super active Commission nationale de l'informatique et des libertés (CNIL), which is the French equivalent of the UK Information Commissioner's Office, issued Google with a formal enforcement notice, telling Google that Google had to include all Google search engine extensions in the delisting process following each successful Right to be Forgotten application.
Google appealed but its appeal was rejected. In September 2015 CNIL issued Google with another formal Notice that had the power of an injunction. Google was ordered by the enforcement notice, to delist from its entire network, 21 search results in relation to a French citizen who made a successful Right to be Forgotten application. The Notice stated that the protection under the Right to be Forgotten must apply to all European residents with no possible circumvention. Circumvention means, that Google users were able to get around the filters Google applied and still see offending search results by using all sorts of technical methods such as changing their geolocation settings or by using a VPN.
Google declined to comply with the Notice and refused to delist the offending search results from its entire search network. It appealed to the French data protection regulator claiming that the Notice was unlawful because global delisting of search results under the European Right to be Forgotten, would represent disproportionate attack on freedom of expression and information. Google wanted the regulator to accept that the decision to order Google to delist web pages from across its network, would effectively deprive Americans from constitutional rights and particularly will hinder free speech.
Google's representations were rejected but still, Google refused to comply with the Notice. Instead, it made it standard practice to delist offending search results based on IP addresses rather than Google search engine extensions. This change meant that if you searched from a device with a European IP address, delisted search results would not appear as part of your search results. If, however, your device had an IP address which was from outside the EEA, those results will still be shown to you, regardless of your actual location. In other words, Google changed the way delisting worked by moving away from the concept of search extension (Google.com or Google.co.uk) to an IP address based delivery.
This meant that you could search any Google search extension you may, if your device delivered an IP address from the EEA, the offending search results will be hidden. The problem remained for individuals who live close to a border between an EEA and a none EEA country. They might receive mixed search results based on the IP address their device uses to carry out the Google search. The French data protection regulator noted this practice was an improvement in Google’s method of delisting offending search results.
However, the regulator insisted that the IP address geolocation criterion, had caused an undesirable variation in the level of protection offered to European resident. The regulator made it clear that the only satisfactory outcome, would be for Google to apply the delisting to all its search engine extensions, with no distinction between the Google search extension used and the geographical location of the internet user making a search. The French data protection regulator also issued Google with a penalty of 100,000 Euros to reflect on its repeated breaches of the Notice but Google appealed to France’s highest court, the Council of State (Conseil d’État). Google’s position remained that it will not, as a matter of course, delist search results from all its search engine extensions so it appealed to the Court of Justice of the European Union.
In September 2019, the Court of Justice of the European Union, delivered its final ruling that Google is not required to extend the Right to be Forgotten to versions of its search engine outside of Europe. This settled the matter. for now at least. The Court, however, concludes that, “currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject to carry out such a de-referencing on all the versions of its search engine,".
But, the court added, any information delisted under the Right to be Forgotten must be delisted in every European member state, regardless of which country the request originated in. The wordings of the decision means that Google now must delist offending search results from its entire European search network. But it also leaves open the possibility that in the future the court will come to a different decision. This, presumably, will require specific legislation by the European Commission, which is something which at the moment appears highly unlikely.
It is still possible that at one point in the future, Google will be ordered to delist search results worldwide. It is likely, however that any change will be founded on the basis that under GDPR, an organisation that transfers personal data to a country outside of the EEA, must do so under the same conditions of data processing which applies to processing of the same data within the EEA.
This means that if processing of personal data is unlawful within the EEA, it is must also be unlawful outside of the EEA. If the processing of a specific Google search results is unlawful in the UK, there is no reason, why the same practice should be lawful in the USA. European data protection law places emphasis on the data subject (the individual whose data is being processed) rather than on the location of the individual.
This is one of the reasons why foreign website are required to comply with GDPR provisions. This argument of unlawful data transfer had not yet been placed before the European court which means it might still come up in future cases.