Analysis
GDPR does not (yet) give right to global oblivion
By Peter Teffer
EU citizens will see their 'right to be forgotten' online enshrined in EU law on Friday (25 May), but its effectiveness and reach will depend on a case which is still pending in front of the Court of Justice of the EU.
The general data protection regulation (GDPR), which will apply as of Friday, gives EU citizens the right to demand from companies or organisations to have their personal data removed, under certain circumstances.
Join EUobserver today
Get the EU news that really matters
Instant access to all articles — and 20 years of archives. 14-day free trial.
Choose your plan
... or subscribe as a group
Already a member?
But it is not yet clear to what extent the right to have personal data erased or removed from search engine results will apply globally.
"This issue is just now pending in front of the Court of Justice: the reach, the applicability of the decisions by our data protection authorities," said a European Commission official on Wednesday, on condition of anonymity.
"We cannot apply our EU law extraterritorially. … How does it work in such a medium as internet?"
The provision in GDPR follows an earlier ruling by the Luxembourg-based EU court in 2014, which said that search engines had to remove results related to an EU citizen's name if they were "inadequate, irrelevant or no longer relevant".
However, the question is how such a right can be effectively applied in light the global nature of the internet.
The French data protection authority (DPA) was one of the most aggressive DPAs enforcing the right to be forgotten – which has since become known as 'delisting' or 'de-referencing'.
In 2016, it demanded that Google not only delist information from French citizens from the search engine's French version Google.fr, but also from Google.com and other non-French domain names - which, because of the global nature of internet, are available to French users too.
Last year, France's highest administrative court, the Council of State asked the Court of Justice of the EU for advice.
It asked if the right to be forgotten also requires a search engine to remove data from its domain services outside the EU.
The Council of State also asked if a company should use geo-blocking to comply with the right to be forgotten.
Geo-blocking is a technique via which a website checks the geographical location of the user requesting a page and blocks users from certain geographical areas.
This approach could lead to removed information still remaining available to users outside the EU.
That might not necessarily be a bad thing.
There is a tension between the right to be forgotten and human rights, in particular freedom of expression and freedom of information.
One unintended consequence of a rigid global application of the right to be forgotten could be a stifling effect on freedom of speech in the rest of the world.
However, geo-blocking is not foolproof and there are ways to circumvent it.
Document
Site Section
Related stories
- Nine lines that changed history - at least on the internet
- More French and Brits want Google to forget them
- Europeans give Google final say on 'right to be forgotten'
- Google has own idea of what 'right to be forgotten' means
- EU sides with Google in data protection case
- GDPR - a global 'gold standard'?