The fight over “the right to be forgotten” and why a landmark EU court case matters

The idea of the “right to be forgotten” is a thoroughly modern conundrum, amplified by the internet’s tendency to never forget anything, especially anything salacious. In the past, one could reasonably move on from any controversial misdemeanor, even ones that may have made the news. A drunk and disorderly incident, for example, may have reached local newspapers, but years pass and the isolated incident essentially disappears, unless a motivated researcher chooses to dig through a microfiche in a library.

Nowadays, however, nothing ever truly disappears, and a quick Google search often swiftly brings up a raft of potentially contentious things from a person’s past. Meaning a small error from 10 years ago can be the first thing a prospective employer sees when checking your background details.

The most prominent court case bringing the modern “right to be forgotten” issue to light began around two decades ago. In 1998 a Spanish newspaper published a series of announcements covering the sale of several properties that had been claimed by the government from individuals with significant social security debts.

Mario Costeja González was one of those individuals reported in the 1998 story. Ten years later González had moved on, paid his debts, and was trying to put those tough financial times behind him, but the newspaper had effectively digitized all of its past content. Every time he searched Google for his name these old stories dominated the search results.

González asked the paper to take the story down … the paper refused. He then went to Google, asking for the search links to be removed … Google refused. Years of court battles ensued, and in late 2014 González was finally vindicated by the highest court in the European Union. The result was informally referred to as the “right to be forgotten” ruling, and it determined internet search engines must reasonably consider de-indexing requests by individuals.

The ruling was not without controversy. The unsurprisingly oblique language simply suggested an individual has the right to request removal of search results that, “appear to be inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed.”

The influential 2014 ruling quickly resulted in Google being swamped with thousands of requests from Europeans looking to have contentious links removed from their personal search results. Google complied, however, it also instituted a geo-fencing policy meaning any links requested for removal were only delisted in European Union nations.

The French privacy watchdog CNIL (Commission Nationale de l'Informatique et des Libertés) suggested these takedown requests must be de-indexed globally. Google refused and was subsequently served a massive fine by CNIL in 2016. Since then, the court battle has risen through the ranks, ultimately reaching the highest court in the EU, the Court of Justice of the European Union. The case proved to be an important litmus test for the “right to be forgotten” issue, with the world watching to see where the chips would fall.

Advocates for invoking the global rule suggest removing search results in an individual nation is redundant when many people already use a variety of methods, such as VPNs, to get around local geofencing rules. However, Google and anti-censorship activists claim imposing a global reach on the rule amounts to a massive overreach on the EU’s part.

It has been suggested if the EU were to globalize its “right to be forgotten” rule it could come into conflict with freedom of speech laws in countries such as the United States. Others have raised issues such as a lack of accountability in the system meaning some EU nations could use the rule to regulate dissenting information, and essentially rewrite history.

The EU’s Court of Justice’s recent ruling on the issue, while ultimately in favor of Google, seems acutely aware of the balancing act that needs to be met in making any kind of “right to be forgotten” adjudication. It suggests a global “right to be forgotten” ruling would certainly be an unfair imposition on non-EU states that don’t recognize similar rights.

“The Court emphasises that, in a globalised world, internet users’ access – including those outside the EU – to the referencing of a link referring to information regarding a person whose centre of interests is situated in the EU is likely to have immediate and substantial effects on that person within the EU itself, so that a global de-referencing would meet the objective of protection referred to in EU law in full,” the Court states in its ruling.

"However, it states that numerous third States do not recognise the right to de-referencing or have a different approach to that right. The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.”

The latest ruling is full of weird gray areas, with the Court specifically stating it does not prohibit global de-indexing across all versions of a search engine, implying in some cases this may be appropriate. There is also a notably strange addendum to the ruling implying search engines must put measures in place to prevent, or discourage, individuals from accessing search results outside of the EU. This odd inclusion seems to suggest some kind of control over VPN access, but it is all incredibly vague at this point.

“…such a de-referencing must, if necessary, be accompanied by measures which effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, through a version of that search engine ‘outside the EU, to the links which are the subject of the request for de-referencing,” the Court ruling states. “It will be for the national court to ascertain whether the measures put in place by Google Inc. meet those requirements.”

So, while this is certainly a win for Google, and a ruling celebrated by some free speech advocates, there are sure to be more legal battles in the future. Exactly what “measures” should Google be putting in place to “discourage” users from using a VPN to access search results outside of the EU? And is relying on geo-fencing futile in an age of increasing VPN use?