Brendan Van Alsenoy is a legal researcher at the Interdisciplinary Centre for Law & ICT (ICRI), KU Leuven – iMinds. Marieke Koekkoek is a research fellow at the Leuven Centre for Global Governance Studies (GGS), KU Leuven.
In May of this year, the Court of Justice of the European Union (CJEU) decided that individuals can – under certain conditions – ask Google (photo credit) to stop referring to certain information about them. The CJEU’s recognition of this so-called “right to be forgotten” has kicked up quite a storm. Now that the dust is beginning to settle, it’s time to direct our attention to questions of practical implementation. One set of questions is about territorial reach. How far should the right to be forgotten extend, geographically speaking? Should Google, upon finding that an individual’s request is justified, modify its search results globally? Or should it only modify search results shown within the EU?
According to press reports, Google’s current approach is to limit its modification of results to the “European versions” of the search engine. Search results of people using google.com remain unaltered, while people using google.es or google.be may no longer be seeing the full picture. However, Google still allows its EU users to switch to the .com version, simply by clicking a button at the bottom of the page. EU users can also freely navigate to other country-specific versions of the search engine, whose search results may not be filtered in the same way. By not taking further measures to limit access to “forgotten” search results, it seems as if the search engine is needlessly provoking the wrath of European data protection authorities. So what should the search engine be doing?
Realistically speaking, only two approaches seem viable. The first option would be to “keep it local”, by filtering the search results for queries originating from EU territory – regardless of which country version of Google is being used. The second option would be to “go global”, which would involve modification of search results worldwide. (To be clear, either approach would only kick in once Google has decided to grant a specific request and would only affect results following a name search).
It is true that nothing in the CJEU ruling suggests that Google would be justified in limiting itself to specific websites, countries or regions. But, as even the Chairwoman of the Article 29 Working Party has acknowledged, the matter may not be so clear-cut.
Public international law offers a useful frame of reference to assess the extra-territorial effects of EU data protection law (see also this earlier entry by Christopher Kuner). However, the question before us today is not one of legislative or adjudicative jurisdiction per se. This issue has already been dealt with by the CJEU in its ruling (see paragraphs 42-60) and has been analyzed elsewhere. What concerns us today is the extra-territorial reach of implementation. How far can (or should) the EU go when requiring Google to implement the “right to be forgotten”? In answering this question, it is useful to consider legal precedents involving both public and private international law.
The argument in favor of keeping it local
One of the most well-known cases on internet jurisdiction is UEJF and LICRA v. Yahoo! and Yahoo France. Here, Yahoo! was sued for hosting an auction page displaying Nazi paraphernalia. This page was accessible from any place in the world, including France, where the display of Nazi paraphernalia is outlawed. The Tribunal de Grande Instance (TGI) of Paris ordered Yahoo! to take all necessary measures to prevent French residents from accessing the pages in question. But it only confirmed this order after satisfying itself that it would be technically feasible for Yahoo! to determine, with sufficient probability, whether or not a page request originated from French territory.
There are several reasons why the approach of the TGI made sense. A first reason is rooted in the principle of territoriality, which acts as the primary basis for jurisdiction in public international law. As noted by the District Court of California: “[a] basic function of a sovereign state is to determine by law what forms of speech and conduct are acceptable within its borders.” If the TGI were to have ordered Yahoo! to stop displaying the pages globally, it would have interfered with the sovereignty of other States. A second argument in favor of territorial limitation can be derived simply by considering the alternative. If States would be free to restrict the accessibility of information in other parts of the world, eventually only the lowest common denominator would remain. Only content tolerated by the most restrictive regime would stay available online. Both these arguments suggest that that the geographical borders of a State should, as a general rule, delineate its ability to impose restrictions upon the accessibility of online content.
The argument in favor of going global
The arguments in favor of territorial limitation seem quite compelling – especially when one thinks about them in the abstract. But when one considers the specific facts of a particular case, things start to look slightly different. For example, looking at the facts that preceded the CJEU ruling, one can find several elements that might justify a Spanish order for global modification of search results:
(1) the announcement referenced by Google was published by a Spanish newspaper;
(2) the website indexed by Google was hosted by a server located in Spain;
(3) the announcement to which Google was referring concerned a Spanish citizen; and
(4) the search term used consisted of the name of a Spanish citizen.
Taken together, these elements suggest that the content in question is more closely related to Spain than to any other country. From this perspective, one can argue that it should be up to the Spanish authorities to decide whether Google’s search results should be modified globally or not. Moreover, if Spain had decided to go after the source of the publication – a move well within its rights, at least from the perspective of public international law – the information would have become globally inaccessible. A Spanish order for global modification of search results might therefore be less of a “jurisdictional overreach” than initially thought.
A recent example of a global injunction against Google is provided by Equustek Solutions Inc. v. Jack. In this case, Canadian company Equustekclaimed that Jack et al. had misappropriated Equustek’s goodwill by performing a “bait and switch”. (Jack et al. advertised Equustuk products on their websites, but delivered their own products instead once a sale was made.) In the end, the Supreme Court of British Columbia considered it necessary to issue an injunction with global effect “in order to adapt to the borderless nature of the internet”. The Court also noted that Google’s removal of search results from google.ca alone was inadequate to offer the plaintiff’s effective relief. Needless to say, this judgment also invited some mixed reviews.
While the competency of the B.C. Court in Equustek was essentially a matter of private international law, examples of “interest-based” reasoning can also be found in public international law doctrine (see for example Ryngaert at p. 4 et seq.).
The way forward
In conclusion, it seems that valid arguments can be made for both the local and global approach. If one rigidly clings to the territoriality principle, successful “forget me” requests should only affect local search results. However, as the right to be forgotten is based on an EU Directive, the case for modification of results throughout the EU is easily made. Others will feel that the nexus with EU territory is sufficiently strong to justify a global implementation order (when deemed appropriate by the competent authority). One might even argue that this is the only way to ensure an “effective and complete” protection of EU data subjects (see also paragraph 58 of the CJEU ruling).
Both approaches have their advantages and disadvantages. Nobody really likes the idea of applying “territorial zoning” to the internet, but this is already the world we live in. At the same time, we must stay mindful that geo-filtering mechanisms are not iron-clad. Anyone willing to invest some time and money will easily circumvent them (e.g., by using a proxy server). It’s quite possible that EU authorities will consider such additional costs to be sufficiently dissuasive. If not, it looks like the only satisfactory approach will be to go global.
In the end, the final outcome will depend on how far EU regulators are willing (and able) to push this. The further litigation of the Yahoo! case in the U.S. suggests that any attempt to see the right to be forgotten enforced in the U.S. would most likely fail. EU enforcement capabilities therefore seem limited, by and large, to Google’s assets within the EU. But of course, one shouldn’t lose sight of Google’s interest in the EU market. As long as the gains outweigh the costs, Google is unlikely to ignore enforcement actions which would interfere with its ability to sell advertising space to EU businesses. To be continued …