The European Court of Justice (ECJ) has recently ruled in favour of Google, saying that it does not have to remove links of sensitive information of people worldwide, but only for those within the boundaries of the European Union. In its ruling, the top court claimed that the dispute known as the right to be forgotten or the right to erasure could be ill-treated by authoritarian governments should it be implemented outside Europe.

With this win, individuals can see litigious entries de-listed from Google results at a worldwide level if the competent EU data protection regulator or court determines that, in the light of national standards, global delisting would be required.

Gabriel Voisin, a partner at Bird & Bird in London, explains further that this ruling means that under EU laws, everyone has a right to data protection.

“In practice, however, supervisory authorities will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident in the European Economic Area (EEA),” he says. “So practically speaking, individuals from outside the EEA will not have access to this right.”

If visiting the EU, the General Data Protection Regulation (GDPR) applies only to data subjects when they are in the EU, and this includes the right to be forgotten – Google is not required to remove the search results in other countries outside the EU. However, if visiting other countries outside the jurisdiction of the EU, for instance, and a different address for Google is put in, then any sensitive information still appears.

“Indeed, this search will be deemed to be outside the EU via your IP address, which will show that you are in other countries outside EU,” says Voisin. “This happens regardless of your nationality. This also explains why you may see from time to time the following disclaimer at the bottom of Google result web pages: ‘Some results may have been removed under data protection law in Europe.’”

On the other hand, if Google removes an individual from searches in Europe, the possibility of showing up on Google in the US, Hong Kong or the Philippines, for example, may depend upon the search engine.

“An important distinction here is that individuals cannot just request a blanket wipe of ‘their data’ from the internet,” says Voisin. “The right to be forgotten requests are linked to particular items that individuals want to see de-listed from Google results. Google reviews every request. If Google believes that arguments can be made to resist to someone’s request (e.g. there are freedom of information or speech considerations that override the individual’s rights), then it may decline to remove the requested item. If Google does remove the requested item, it would do so only in relation to EU-wide results, meaning that if you Google the search term outside of the EU, it will appear.”

Voisin adds that if a competent EU data protection regulator or court approached by the individual determine that, in the light of national standards, global de-listing would be required, then the item may no longer be listed and Google will have to remove it from results displayed in Europe, US, Hong Kong, the Philippines or anywhere else in the world.

Meanwhile, according to Sheena Jacobs, managing partner of JurisAsia in Singapore, the difficulty with this right is that it is quite complicated to accomplish when you also consider other rights such as freedom of information or the public interest.

“It may be possible for the right to be forgotten when taken to the extreme to limit freedom of speech and expression because the individual has complete control over their personal data, notwithstanding that it may have been commented on by others or be important for the public to view,” she says. “While this would not arise in every case, the public also has a competing right to have access to such information. For example, a totalitarian government may use this right to censor content that they do not want their citizens to have access to.”

She adds that in the near future, it is quite possible that the right to be forgotten may be implemented in other countries’ data protection laws in the same way as rights of access and correction.

In 2016, Google was fined approximately US$110,000 by the Commission Nationale de L’informatique et des Libertés (CNIL), a private, France-based organization designed to protect personal data, support innovation and preserve individual liberties, for its failure to delist search engine results globally. This came after the EU’s right to be forgotten in 2014 that says that search engines should have the right to remove results that are deemed inappropriate and vulgar, such as criminal records.

In view of the ruling, the top court considered two cases. The first looked at the territorial scope of de-listing requests (the right to be forgotten on Google). The second examined requests to de-list sensitive personal data (special category data) and criminal offenses and convictions data and Google’s obligation to consider the interests of freedom of information.

Excel V. Dyquiangco