Can Europe export its privacy rules world-wide?

0
35
Advertisement

Google has appealed an order to extend the European Union’s “right to be forgotten” to its search engines across the globe, arguing before the EU’s top court that the order encourages countries to assert sovereignty beyond their borders. National laws used to stop at the border. In cyberspace, they increasingly stretch around the world, as regulators in Europe, the US and Canada have started asserting legal authority over the internet across country lines.

That is thrusting global tech firms like Google, Facebook Inc. and Microsoft Corp. into a potentially costly legal morass, and setting the stage for conflict over who will—or should—regulate everything from free speech and privacy to cybercrime and taxes.

The Google dispute before the EU’s Court of Justice in Luxembourg is the highest-profile case yet to test where jurisdiction begins and ends when it comes to data. Google is appealing a 2015 order from France’s privacy regulator, CNIL, to extend the EU’s “right to be forgotten” to all of its websites, no matter where they are accessed. CNIL fined Google 100,000 euros ($116,295) when it didn’t comply.

France argues that the right—which allows individuals to request removal of results that include personal information from searches for their own names—is empty if it can be dodged by spoofing one’s location, for instance by connecting to a VPN. Google, a unit of Alphabet Inc., GOOGL 0.01% says France’s demand risks allowing the censorship laws of dictators and tyrants to dictate what people around the world can see online.

“It will set governments’ expectations about how they can use their leverage over internet platforms to effectively enforce their own laws globally,” said Daphne Keller, who studies platforms’ legal responsibilities at the Stanford Center for Internet and Society and previously was Google’s associate general counsel.

At issue in these disputes, experts say, is a fundamental mismatch between how both laws and the borderless internet each operate. As regulations proliferate, tech firms risk ending up in a legal bind no matter which course of action they take, lawyers say.

Over Google’s objections, Canada’s highest court last year ordered the internet giant to globally block search results linking to commercial websites associated with a company accused in Canada of stealing trade secrets. A US federal judge later declared that the Canadian world-wide injunction wasn’t enforceable in the US Google ultimately agreed to comply with the injunction, which remains in place.

Conflict can also arise when one country’s police demand data from a tech company, but another country’s law forbids giving such data to foreign police. In early 2015, for instance, Brazilian law-enforcement officials detained a Microsoft executive in São Paulo after the company refused to produce Skype data of a Brazilian customer, Microsoft said in a blog post later that year. The reason: The data was kept in the US, and American law at the time forbid Microsoft from turning it over to foreign law enforcement, putting the company in a legal bind, the company said.

“It’s a clash between the way data is managed and moved around, which doesn’t respect borders, and efforts by territorial governments to impose their norms and rules,” said Jennifer Daskal, an American University law professor.

The Google case stems from the EU Court of Justice’s landmark ruling in 2014 that created a right to be forgotten from search engines. The court said that search engines must honor individuals’ requests to remove results, including their personal information, from searches for their own name. But the court also said Google must balance those requests against the public interest in keeping those results linked to that person—for instance, in the case of public figures.

Google moved quickly to implement the ruling on all the European versions of its search engine, setting up a request and vetting process that has so far removed some one million search results in Europe. In one instance, Google removed links to a 1998 Wall Street Journal article about tantric sex from the search results of a man whom the article said had attended a tantra workshop.

If Google complies with the French ruling ordering global application, the firm risks running up against US free-speech protections. Content providers could seek US court injunctions to stop removals, but then Google would face EU privacy fines if it complies. Under the EU’s new privacy law, such fines can rise to as much as 4 percent of a company’s annual world-wide revenue.

Google declined to comment on what it will do if it loses the case. A ruling will likely take at least several months. Before the court rules, one of its advocate generals will issue a nonbinding opinion in the case.

Google argues that its application of the right to be forgotten is already effective in France for well over 99 percent of searches. More broadly, the company asserts the EU has an obligation to minimize legal conflict with other jurisdictions. It also argues that the right to be forgotten is far from settled law in many places, such as the US.

Google was joined by several press-freedom groups in its arguments. One group, Reporters Committee for Freedom of the Press, says a ruling against Google would have “grave world-wide consequences.”

“There would be nothing to prevent other jurisdictions from claiming the same global scope of application for their own laws. The result would be a ‘race to the bottom,’ as speech prohibited by any one country could effectively be prohibited for all, on a world-wide basis.” (   The Wall Street Journal

LEAVE A REPLY

Please enter your comment!
Please enter your name here