CYIL vol. 12 (2021)

CYIL 12 (2021) THE GLOBAL REACH OF THE RIGHT TO BE FORGOTTEN THROUGH THE LENSES … national authorities are not prevented from demanding such an extensive implementation on a case-by-case basis, should this not be seen as a clear threat to the right to freedom of information of the global population. 56 It is not known whether unintentionally, through the vague wording of the provision or completely intentionally, whether the CJEU thereby provides an opportunity for global protection (…) of the right to information of the global population. This in itself shows that the Court is not at all categorical about the possibility of protecting individual rights on a global scale. As M. Zalnieriute points out: “By leaving the door to extraterritorial de-referencing wide open, the CJEU continues to pursue its post- Snowden hard-line stance on data privacy in a manner that is likely to transform the data privacy landscape”. 57 Even a careful analysis of the GDPR shows that the legal act does not contain a provision that would directly limit its scope. Moreover, article 3(2)(b) of the GDPR states that the GDPR applies to monitoring user behaviour occurring in the EU, even if the controller is not registered in the EU. Considering the territorial applicability of the GDPR, the CJEU in the CNIL case does not change the broad interpretation of article 3(1) of the GDPR, given in the Google Spain case , where it was extended to the processing of personal data of data subjects located in the EU by a controller not registered in the EU, if the processing actions were related to the offer of goods or services. Therefore, the position of the CJEU that the EU legislature does not grant the rights enshrined in the GDPR outside the territory of EU member States is questionable. 58 The Court first noted that in a globalized world, even access to information specified in search results by an Internet user located outside the EU can have immediate and significant consequences for the victim in the EU. 59 The CJEU stressed that the Conseil d’État considers Google as a single entity when it comes to the processing of data connected to natural persons such as French/EU citizens. 60 It also acknowledged the validity of the argument that a global application of the right to be delisted would certainly meet the declared aim of the GDPR – “to guarantee a high level of protection of personal data” within a global online environment that facilitates the flow of information across national boundaries to a degree never witnessed before’’. 61 In this way, the Court gives legitimacy to global de-referencing. As P. Dixit states: “The judgment in favour of Google, allowing dereferencing only around the EU and not globally is criticized, however the judgement when read intrinsically allows the Member States to weigh between the right to be forgotten and the right to freedom of information and if in the interest of the national public good, there be a reason to demand for dereferencing globally, such an order can be made. This proves that there is no complete bar and limitation to the right to be forgotten in the EU”. 62 56 Ibid, para. 72. 57 ZALNIERIUTE, M.: Google LLC v. Commission nationale de l’informatique et des libertés (CNIL), American Journal of International Law . April 2020. Volume 114. Issue 2. pp. 261–267. Avaliable at: https://www. cambridge.org/core/journals/american-journal-of-international-law/article/google-llc-v-commission-nationale- de-linformatique-et-des-libertes-cnil/AF7235FDDA7059C2418166C4612597CD. 58 Case C507/17 Google LLC v CNIL ., para. 62.

59 Ibid, para. 57. 60 Ibid, para. 52. 61 Ibid, para. 54–58.

62 DIXIT P.:Will The Internet Remember You Forever? RightTo Be Forgotten And ItsTerritorial Limits. 2019. Available at: https://www.iiprd.com/will-the-internet-remember-you-forever-right-to-be-forgotten-and-its-territorial-limits/.

205