Tech

Google does not have to apply 'right to be forgotten' globally, EU court rules

Key Points
  • The ECJ's ruling states that Google's delisting of search results that concerned EU citizens only applies in the bloc's 28 member states.
  • A Google spokesperson said the company has "worked hard to implement the right to be forgotten in Europe" and welcomed the ruling.
Budrul Chukrut | LightRocket | Getty Images

Google does not have to apply the right to be forgotten globally, the European Court of Justice ruled Tuesday.

Europe's top court had been looking at two separate cases involving the search engine: whether it must remove sensitive personal data worldwide or just in Europe; as well as whether it must automatically delete search results with sensitive information.

The ECJ's ruling states that Google's delisting of search results that concerned EU citizens only applies in the bloc's 28 member states.

"The Court concludes that, currently, there is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be,... to carry out such a de-referencing on all the versions of its search engine," the ECJ said in a statement Tuesday.

This follows on an earlier decision on the so-called "right to be forgotten" — a ruling made five years ago that grants European citizens the right to ask search engines, such as Google, to remove sensitive information about them, such as past crimes.

"Since 2014, we've worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people's rights of access to information and privacy," Peter Fleischer, senior privacy counsel at Google, told CNBC in an emailed statement.

"It's good to see that the Court agreed with our arguments, and we're grateful to the independent human rights organisations, media associations and many others around the world who also presented their views to the Court," he added.

In 2016, France's privacy watchdog CNIL fined Google 100,000 euros (109,889) for refusing to remove sensitive information from search results on the internet upon request under "right to be forgotten."

During a hearing at the Luxembourg-based institution last year, lawyers defending Google argued that applying the right to be forgotten worldwide could restrict people's access to information in certain countries, Politico reported.

At the same time, Tuesday's decision delivers a setback to the European Union and its prospects of extending its own privacy standards globally.

Tension between global tech and national rules

"Google will be happy with the decision, and I think the broader question is who has jurisdiction when it comes to tech, which is global in its nature," Dexter Thillien, senior industry analyst at Fitch Solutions, told CNBC via email.

"As we're unlikely to see global rules, that tension between global tech and national rules will continue, and this means that some jurisdictions will still try to implement rules which will have a global impact," he added.

Tuesday's ruling comes amid increasing scrutiny of the tech giant from European regulators, with the EU's antitrust authority cracking down on the company in recent years.

In March, the European Commission fined Google $1.7 billion for abusing its dominance over the digital advertising market, marking the third consecutive year of EU antitrust rulings on the U.S. firm. Among those rulings was a record $5.1 billion fine for anti-competitive practices on Google's Android devices.

But when it comes to privacy, Google is also facing intensifying pressure from authorities in the United States.

VIDEO3:3203:32
Is Google a monopoly?

Earlier this month, it was announced that Google-owned YouTube would pay $170 million to settle allegations by the U.S. Federal Trade Commission and the New York attorney general that it earned millions by illegally collecting data from children without their parents' consent.

Representatives for the company were also questioned by lawmakers at a Senate hearing on data privacy last year.

Amid the rising scrutiny, the tech giant has been attempting to overhaul its reputation. Back in June, the company unveiled several measures aimed at safeguarding its users' privacy and data, such as new extensions to allow users better control over their privacy settings and restricting third-party data collection.

Earlier, the company announced it would set up a European hub to handle data privacy. CEO Sundar Pichai said Google planned to have more than 200 privacy engineers working in Munich, Germany, by the end of the year.

— CNBC's Elizabeth Schulze contributed to this article.