Google v CNIL (C-507/17) and Glawischnig-Piesczek v Facebook (C-18/18)
The General Data Protection Regulation (GDPR) is widely said to have exported the legislation of the European Union (EU) worldwide since it also applies (in certain instances) to controllers and processors of data which are established outside of the EU. Yet, in a preliminary ruling of the 24th of September the European Court of Justice (ECJ) ruled that Article 17 of the GDPR, which provides for the right to be forgotten, is only required to be applied in the EU internally and not worldwide (Case C-507/17 Google v Commission nationale de l’informatique et des libertés). That ruling was prompted by a fine imposed by the French data protection authority on Google because of that company’s refusal, when granting a de-referencing request, pursuant to the right to be forgotten, to apply it to all its search engine’s domain name extensions.
In another preliminary ruling of the 3rd of October, regarding Directive 2000/31/EC on electronic commerce (E-Commerce Directive) the ECJ seems to have reached the conclusion that measures granted by national courts to block access to or to remove illegal content online, in terms of Article 18 of the E-Commerce Directive, may be applied worldwide (Case C-18/18 Glawischnig-Piesczek v Facebook Ireland). In this case, an Austrian politician sought an order that Facebook remove and stop disseminating content (and identical or, subject to certain conditions, equivalent content) which was found to be defamatory, and thus illegal, by an Austrian court.
How come the E-Commerce Directive grants a worldwide remedy but the GDPR grants only an EU-wide remedy; and this decided upon by the ECJ in the space of just a few days? In truth, there is much more to be read into with respect to both preliminary rulings.
The ECJ’s consistent reasoning
In both cases the ECJ begins its reasoning by reading into the E-Commerce Directive and the GDPR, respectively, the wish of the EU legislature to strike a balance between the interests at stake (para 43 of the Facebook case and para 60 of the Google case). In the Facebook case the interest of the person seeking to have defamatory content taken down is balanced against the difficulty of the host provider to comply with a measure in respect of the E-Commerce Directive. In the Google case the interest of the person seeking to take down content infringing his data protection rights is balanced against the right to freedom of information which evidently is adversely affected by a de-referencing order in respect of the GDPR.
In the Google case the ECJ reasons that while EU legislature has struck a balance between the right to privacy and the right to freedom of information (see Article 17(3)(a) of the GDPR) as regards the application of the right to be forgotten within the EU, it has not struck such a balance as regards application outside the EU territory (para 61). This is because the rights arise from the EU Charter of Fundamental Rights. As a result, that balancing exercise inhabits a purely EU legal order and is necessarily an exercise in EU law which cannot be exported outside its territory to other regions of the world where the balance of the two rights at stake may vary significantly. The ECJ further holds that nowhere does the GDPR indicate that any of its provision should apply outside of the territory of the EU, therefore, it is only required to be given effect to within the territory of the EU (para 62 and 63).
However, this is not the end of it. The ECJ continues to argue that neither does the GDPR expressly prohibit its application worldwide (para 72). Therefore, the national data protection authorities and the national courts may decide to apply the de-referencing pursuant to the right to be forgotten worldwide but, given what has been said about the EU Charter, the balance should be struck in the light of national standards of protection of fundamental rights (para 72).
In the Facebook case the ECJ simply states the balance of the individual’s and the host provider’s interests must mean that the host provider cannot be burdened with an excessive obligation, that is, a host provider cannot be obliged to generally monitor for illegal activity (para 43). In fact the Member States are expressly prohibited from imposing such a general obligation by Article 15 of the E-Commerce Directive; therefore, a balance struck in this sense is purely made in terms of EU legislation and, by implication, cannot be applied to measure which have effect worldwide.
Yet, the ECJ rests on Recital 58 of the E-Commerce Directive which states that “in view of the global dimension of electronic commerce, it is, however, appropriate to ensure that the Community rules are consistent with international rules; this Directive is without prejudice to the results of discussions within international organisations (amongst others WTO, the OECD, Uncitral) on legal issues” to allow the application of measures worldwide made on a balance of interests made in terms of international rules to which the Member States subscribe. The ECJ further posits that nowhere does the E-Commerce Directive make any territorial limitation to the application of the measures permitted under Article 18, therefore, those measures may be given worldwide effect (para 49 and 50). Nevertheless, in the case that a Member State applies a measure with worldwide effect it must do so in a manner consistent with the framework of the relevant international law (para 51).
Conclusion: a converging territorial scope
Contrary to first impressions, the effect of the two cases is the convergence of the territorial scope of the GDPR and the E-Commerce Directive. That is, they can apply within the EU territory but also with global effect provided that a balance must then be struck between the interests at stake, in the case of the GDPR, in terms of national standards of protection of fundamental rights, and, in the case of the E-Commerce Directive, in terms of international law. Even this difference between striking a balance in terms of national standards and international law, respectively, seems superficial.
National standards for human rights protection necessarily derives from international law be it in the form of binding treaties like the European Convention on Human Rights, or soft law made in the fora of the United Nations or of regional organisations or their affiliated agencies and bodies, or even general principles. The ECJ clearly adopts a single strategy as to the territorial scope of EU rules in relation to online activity. That is, prudently deferring to apply EU law as such outside of the EU territory while leaving the Member States free to apply deriving or analogous rules worldwide.
