In a decision announced Tuesday in the case against Google brought to the European Court of Justice by French data privacy regulator Commission nationale de l'informatique et des libertés (CNIL), the Court ruled that:
- "The operator of a search engine is not required to carry out a de-referencing [a term the Court uses in reference to what's commonly known as consumers' "right to be forgotten"] on all versions of its search engines."
- "It is, however, required to carry out that dereferencing on the versions corresponding to all the [EU] Member States and to put in place measures discouraging internet users from gaining access, from one of the Member States, to the links in question which appear on versions of that search engine outside the EU."
- But "...currently, there is no obligation under EU law, for a search engine operator who grants a request for dereferencing made by a data subject ... to carry out such a dereferencing on all the versions of its search engine."
- However "...EU law requires a search engine operator to carry out such a dereferencing on the versions of its search engine corresponding to all the Member States."
The Court left up to the 28 EU Member States any decision as to whether or not Google has put sufficient measures into place to discourage access by EU consumers to its non-EU versions.
In France in 2014, CNIL fined Google $100K euro for being insufficiently diligent in complying with French consumers' requests to remove inadequate or irrelevant content displayed in searches on their names.
The ECJ's ruling means that CNIL will now have to be content with Google's proposal to protect French consumers through geographical blocking based on the .fr TLD and IP addresses.
In the international Internet community, the Court's decision is seen as a big win for Google.
Comments on ECJ: Google has no obligation to provide 'right to be forgotten' outside the EU