September 27, 2019
The EU’s highest court ruled that the General Data Protection Regulation’s “right to be forgotten” need not be applied outside of the 28-country bloc in a blockbuster case previewing what could become a major issue going forward.
According to the BEERG Global Labor Newsletter, “The right to be forgotten gives EU citizens the power to demand data about them be deleted… Members of the public can make a request to any organization 'verbally or in writing' and the recipient has one month to respond. They then have a range of considerations to weigh up to decide whether they are compelled to comply or not.”
A French privacy regulator had insisted that Google should have to apply the GDPR’s standard to its services worldwide. Google, which had blocked only users in the EU from accessing content protected by the GDPR’s right to be forgotten, maintained that forcing the tech company to comply worldwide may interfere with the reporting of human rights abuses outside of the EU.
The Court of Justice of the European Union held: "Currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject... to carry out such a de-referencing on all the versions of its search engine"
It was not a total victory. Buried deep in the decision is note that “a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights … a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.”
Looking ahead: Regulating data presents jurisdictional challenges. Practically speaking, measures such as the GDPR and the California Consumer Privacy Act are influencing behavior well beyond the EU and California, respectively. However, whether a company is legally obliged to follow such measures outside of the borders in which they were taken up is a different question. While the decision is encouraging, we can expect more legal challenges like it, including in the arena of HR data.