Contradicting Rulings Or An Astute Strategy To Expand Territorial Scope Of EU Digital Rights?

Click here to connect with G M Corporate and Fiduciary Services on LinkedIn

The General Data Protection Regulation (GDPR) is widely said to have exported the legislation of the European Union (EU) worldwide since it also applies (in certain instances) to controllers and processors of data which are established outside of the EU. Yet, in a preliminary ruling of the 24th of September the European Court of Justice (ECJ) ruled that Article 17 of the GDPR, which provides for the right to be forgotten, is only required to be applied in the EU internally and not worldwide (Case C-507/17 Google v Commission nationale de l'informatique et des libertés). That ruling was prompted by a fine imposed by the French data protection authority on Google because of that company's refusal, when granting a de-referencing request, pursuant to the right to be forgotten, to apply it to all its search engine's domain name extensions.

In another preliminary ruling of the 3rd of October, regarding Directive 2000/31/EC on electronic commerce (E-Commerce Directive) the ECJ seems to have reached the conclusion that measures granted by national courts to block access to or to remove illegal content online, in terms of Article 18 of the E-Commerce Directive, may be applied worldwide (Case C-18/18 Glawischnig-Piesczek v Facebook Ireland). In this case, an Austrian politician sought an order that Facebook remove and stop disseminating content (and identical or, subject to certain conditions, equivalent content) which was found to be defamatory, and thus illegal, by an Austrian court.

How come the E-Commerce Directive grants a worldwide remedy but the GDPR grants only an EU-wide remedy; and this decided upon by the ECJ in the space of just a few days? In truth, there is much more to be read into with respect to both preliminary rulings.

The ECJ's consistent reasoning

In both cases the ECJ begins its reasoning by reading into the E-Commerce Directive and the GDPR, respectively, the wish of the EU legislature to strike a balance between the interests at stake (para 43 of the Facebook case and para 60 of the Google case). In the Facebook case the interest of the person seeking to have defamatory content taken down is balanced against the difficulty of the host provider to comply with a measure in respect of the E-Commerce Directive. In the Google case the interest of the person seeking to take down content infringing his data protection rights is balanced against the right to...