Earlier this week, the Court of Justice of the European Union, perhaps for the first time, drew a territorial limitation to the requirements imposed under the General Data Protection Regulation (‘GDPR’). The court held that an individual’s exercise of their “right to be forgotten” in relation to certain materials available online, which obliges Google’s search engine to remove search results to websites containing that content, does not extend to the versions of Google’s search engine directed to non-EU member states. In other words, the search results would only have to be removed insofar as the search engine is accessed from the EU.
This is good news for Google and other operators of online services, at least in that they will need to worry less about having potentially conflicting legal obligations in different jurisdictions when complying with ‘right to be forgotten’ requests relating to their online services. Online service operators can now proceed on the basis that when content has to be taken down to comply with a ‘right to be forgotten’ request, it will only need to be taken down from the versions or iterations of these services servicing the EU market. In principle, non-EU versions of the services would not need to be affected by the request.
It is noteworthy that the Court’s reasoning drew on the idea that privacy interests are not absolute rights but rights that have to be balanced against competing interests and that different countries (even within the European Union) may strike a different balance between the interests of privacy on the one hand and the interests of free speech and freedom of information on the other. In other words, the EU court recognises that countries outside the European Union may legitimately place a stronger weight, for example, on freedom of speech interests and that unless the EU legislature clearly imposes a duty that extends to territories outside the EU, the court will interpret the legislation as being limited to the territory of the EU.
The court held further that, when issuing an order for the delisting of search results based on a ‘right to be forgotten’ request, the national regulatory authority must determine the geographical extent of the order as necessary in the circumstances to protect the individual’s legitimate privacy interest. The court noted that the legislation requires national authorities within the EU to coordinate in these matters. The court said that EU law does not require that the delisting should be done on a global basis, but that it does not stop the national authority issuing an order with a global reach, outside the EU, if it considers such order to be necessary. The decision, however, sends a signal to national authorities that they should use that power carefully and that they should recognise that other countries, particularly outside the EU, may have different views on how to balance competing interests.
The wider implications of the decision are very difficult to predict. The decision does not consider the broad issues concerning the territorial effect of GDPR. The provisions of Article 3 GDPR that define its territorial effect clearly extend the legal rights and obligations of GDPR, in many circumstances, to the processing of personal data outside the EU including by entities operating outside the EU.
Today’s decision of the EU court does not address these broader territorial issues. Rather, the case focused specifically on the obligations of a global online service – specifically a search engine – that hosts personal data, flowing from the exercise by an individual of the ‘right to be forgotten’. The courts will have to develop the law further before it becomes clearer in what other ways the legal obligations under GDPR may be limited to the territory of the EU.
