Within the European Union, the right to be forgotten must be adhered to. But the European Court of Justice (ECJ) says that, outside of the EU, Google must not comply with the right to be forgotten. The court stated that the balance between the right to privacy and protection of personal data, and the freedom of information of Internet users vary greatly around the world.
Ecommercetimes.com reported that the ECJ ruled that search engine operators have to de-reference all versions of their search engines in the EU, and to take measures that prevent or seriously discourage Internet users from making an end run by gaining access to the results of a search on versions of the search engine outside the EU.
From The Lion's Mouth
The ECJ had a lot to say about their ruling: "...it must be found that EU law does not currently provide for such cooperation instruments and mechanisms as regards the scope of a de-referencing outside the Union. It follows that, currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine…while EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice"
David Greene, civil liberties director at Electronic Frontier Foundation, remarked that the ruling is "a big win for technology users who do not want to see their access to online information curtailed. [The ruling] correctly recognized that the Right to be Forgotten does not require global de-listing and de-indexing orders. Had the court found otherwise, we would face the prospect of an Internet of lowest common denominator freedom of speech, where the nation with the most restrictive laws would be required to order the takedown of content across the Internet because of a violation of [EU] law."
The ruling was also called "sensible" by Ron Moscona, technology partner at Dorsey's London office. "It is right to recognize that in a world where information is disseminated globally and accessible from everywhere, there are no perfect solutions and it is right that EU law cannot impose its privacy values on other countries, because that would justify other countries imposing their view of the world on the EU."
Why The Court Got Involved
France started the dispute with Google over the right to be forgotten. The European Court of Justice ruled in 2014 that people could ask search engines to remove links to inadequate or irrelevant information in results returned from searches for their names.
At first, Google got rid of only search engine results across its European websites, saying that to do otherwise would have an icy effect on the free flow of information. By 2015, Google de-listed search engine results across all its websites, including Google.com, when the websites were accessed from the EU member country where the request originated.
Google was fined €100,000 in 2016 for not getting rid of web results more thoroughly. Then, Google put in a request for annulment to France's Council of State, the Conseil d'Etat. The Conseil then approached the European Court of Justice for a ruling.
This situation is certainly good for Goolge, who won't have to comply with the right to be forgotten globally. In the EU, the right to be forgotten applies, which satisfies EU member states.
The big issue, however, is that the GDPR does not fully settle every question regarding Internet data security. There is definitely room for debate at many different levels of legislation.