Does the EU’s right to be forgotten extend to the whole world?  The French data protection authority, CNIL, says yes and wants search engines to delist search results which contain information that violates the European Union’s right to be forgotten – not just for French users, not just for European users, but for all users everywhere. Google is prepared to remove offending search results for European users, but balks at removing material globally just because European courts find that it violates European privacy rules. 

In a significant ruling, earlier this month, the European Court of Justice ruled that an individual’s privacy interest in limiting the disclosure of personal information does not generally override the interest in public disclosure about company officials. The ruling protects the public interest in transparency about governance of public companies; preserves the capacity of stock holders to assess companies accurately and protect their legal rights with respect to them; and reaffirms the legitimacy of data processor access to personal information in public data bases about companies.

Just as everyone was headed out of Washington for the Memorial Day weekend, CNBC did a report on Google’s Two Years of Forgetting Europeans. It was a useful summary of the material Google publishes in its transparency report on European privacy requests for search removals.  It noted such interesting facts as that Google has removed 43% of the URLs they have reviewed and processed and that Facebook was the most frequently removed URL. But the report strangely missed a major legal development that threatens a stable international understanding about the limits of domestic law in age of global communications networks. This stable understanding is that national governments have control over the Internet within their own borders.  They have right and the obligation to make the rules of the road for Internet conduct occurring within their own borders. But they don’t have the right to extend their local laws to Internet conduct within the jurisdiction of other cou ...

Google recently informed European data protection authorities (DPAs) that, in addition to removing search results from all European domains of Google Search, Google would soon begin using geo-location technology to additionally restrict access to search results that have been delisted in response to European privacy requests.  This is a sensible step to allay DPA concerns about the balance of a right to privacy and freedom of information and should satisfy those in Europe calling for full global removals without impeding access to information outside of Europe. Of course, the right to be forgotten is a terrible idea – at least in the form in which the European Court of Justice imposed it on European search engines in May 2014.  That decision instructed search engines not to return results derived from a search on a person’s name when the data “appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which the ...

According to media reports, Google is resisting the global application of the European Union’s right to be forgotten.  It is entirely right. And it is important to understand why this is a matter of urgent principle for all organizations and individuals whose lives are improved by a vibrant open Internet.

On February 6, 2015, the Advisory Council to Google on the Right to be Forgotten released its report.  Convened to advise Google on how to implement the European Court of Justice’s right to be forgotten decision from May 2014, the Council’s independent members recommended that search engines maintain limited transparency of their delisting decisions and restrict deletions to European search engines.