InfoCuria, the website responsible for publishing the case-law of the European Court of Justice (the "ECJ") has published the eagerly awaited judgment in the Google LLC v Commission nationale de I'informatique et des libertés (CNIL) case here, which relates to the territorial scope of a data subject’s "right to be forgotten". The right to be forgotten stems from the now repealed Data Protection Directive and was made famous by the Google Spain case, now enshrined under Article 17 of the GDPR, providing individuals with the right to have personal data erased. The right is not absolute and only applies in certain circumstances.
The ECJ has ruled in favour of Google - Google does not have to apply the right to be forgotten globally. This sets a precedent for all search engines - if a search engine operating within a territory covered by the GDPR receives a valid request, they are not required to de-list links from search results worldwide, only within territories directly covered by the GDPR.
While the ruling will be a relief for search engine operators, it will only be persuasive in the application of the right to be forgotten to non-search engine operators and it is difficult to ascertain whether there will be any situations whereby a non-search engine operator will look to rely on this ruling to limit the application of the right to be forgotten. In any event, the ruling is also likely to fuel further challenges to the extra-territoriality provisions of the GDPR.
With Brexit imminent, it is important to note that UK businesses must continue to comply with the GDPR post-Brexit as the Data Protection Act 2018 will remain in place and, subject to possible amendments in the event of a Brexit deal being struck, the EU Withdrawal Act will incorporate the GDPR into UK law to sit alongside it.
