RIP Webby

The Internet is forever, we tell social media users: be careful what you put online, because you can't ever take it back off. And while that's gospel for US users, there's some nuance to that dictum across the Atlantic. In Europe, individuals have a right to be forgotten and can request that information about themselves be taken down—but only, a court has now ruled, within Europe.

The Court of Justice of the European Union, the EU's highest court, issued a ruling today finding that there is no obligation under EU law for a search service to carry out a valid European de-listing request globally.

"EU law requires a search engine operator to carry out such a de-referencing on the versions of its search engine corresponding to all the Member States," the Court wrote in a statement (PDF), "and to take sufficiently effective measures to ensure the effective protection of the data subject's fundamental rights."

"Since 2014, we've worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people's rights of access to information and privacy," Google said in a statement. "It's good to see that the court agreed with our arguments."
The right to be forgotten

The right to be forgotten—to request that information about you be de-listed and made unsearchable—has been a point of contention between Google and the EU since the idea was first proposed back in 2010. In 2014, the Court of Justice ruled that search engines have an obligation to remove links that are old, out of date, irrelevant, not in the public interest, and could harm individuals.

Google was inundated with requests to remove links after it made an online request form available to European consumers, and it began to comply. The company has continued to review all takedown requests, cumulatively honoring 45% of requests to delist results, or about 846,000 links, through September 7 of this year.

The company, however, uses geofencing practices to limit where in the world links are scrubbed from. Users in the EU cannot see links blocked by takedown requests under EU law, but users in other regions, including Asia and North and South America, can.

In 2015, French regulator CNIL (Commission Nationale de l'Informatique et des Libertés) ordered Google to apply takedown requests globally. The commission argued that users in the country could use VPNs or other similar tools as a workaround to access links they would otherwise be blocked by law from seeing. In 2016, the CNIL imposed a €100,000 fine on Google (about $113,000 at the time) for failing to comply.

Google appealed the CNIL ruling, and the Court of Justice in 2017 agreed to hear the case.

While the court today held that search engines such as Google are not required to honor de-listing requests worldwide, it did add a reminder that companies are expected to have measures in place "discouraging Internet users from gaining access, from one of the Member States, to the links in question which appear on versions of that search engine outside the EU."