Today, the European Court of Justice (ECJ) handed down its decision in Google v. CNIL, dealing with the remit of the ‘right to be forgotten’ (RTBF). In short, the ECJ held that the operator of a search engine is not required to carry out de-referencing on all domain extensions of its search engine when dealing with a RTBF request. It is required, however, to carry out de-referencing on the versions of its search engine corresponding to all member states and take measures to protect the data subject’s fundamental rights. Though the decision was made under the former Data Protection Directive, it will have implications for data subjects under the General Data Protection Regulation (GDPR) as the RTBF was codified by GDPR Article 17.


Under EU law, data subjects have a qualified right to request the erasure of personal data that relates to them. In the 2014 Google v. Spain decision, the ECJ determined that Google is a data controller in relation to the processing of personal data. The ruling forced Google to de-list links to personal information that were “inadequate, irrelevant, or no longer relevant”. Following the 2014 decision, Google proceeded to de-list search engine results in relation to EU domains but not domains outside of the EU.

The present case arose after the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), imposed a €100,000 penalty on Google for failing to remove an individual’s name from all domain name extensions of its search engine – meaning worldwide. The CNIL argued that global enforcement of the RTBF is the only way to ensure effective protection of data subjects’ rights. With no clear guidance on the territorial scope of RTBF, Google appealed to the ECJ to have the fine annulled.

Key findings of the ECJ

The final decision by the ECJ endorsed the opinion of the Advocate General who earlier this year found in favour of Google and determined that the scope of the de-referencing should be limited to EU member states only. The key findings of the ECJ were as follows:

  • The court emphasised that the right to data protection “is not an absolute right” and must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
  • The court observed that the provisions of the EU Data Protection Directive do not expressly address the territorial scope of the RTBF. With the absence of any cooperation instruments and mechanism between the EU and states outside of the EU, the court determined that there was no intention to impose a de-referencing obligation that would extend beyond the EU member states.
  • In any event, global de-referencing would have come into conflict with existing laws in other jurisdictions as many jurisdictions do not recognise the right to de-referencing, or they deal with it in a different way.
  • Search engine operators are required to carry out a de-referencing on the versions of its search engine corresponding to all the EU member states.
  • Search engine operators are also required to take measures to ensure the effective protection of the data subject’s fundamental rights. Appropriate measures would include discouraging internet users from gaining access to the links in question that appear on versions of that search engine outside of the EU.
  • Member states remain competent to order an operator of a search engine to carry out a global de-referencing.


In the words of Advocate General Szpunar,“[r]econciling the right to privacy and the protection of personal data with the right to information and freedom of expression in the age of the Internet is one of the main challenges of our time”. Had the ECJ found that the RTBF applied outside of the EU, the extraterritorial powers of supervisory authorities in the EU would have been greatly expanded, potentially putting EU data protection law into conflict with data protection laws in other jurisdictions. The ECJ has avoided such a conflict with this decision.

The full judgment of the ECJ in Google v. CNIL can be found here.