Clifford Chance

The right to be forgotten from a EU and U.S. perspective

21 July 2014

On 13 May 2014, the Court of Justice of the European Union ("CJEU" or "Court") ruled that an EU citizen has a "right to be forgotten" under the EU's 1995 Data Protection Directive 95/46/EC ("Directive"), which requires data controllers, such as Google Inc. and other search engines, to comply with user requests to delete links to outdated or inaccurate data about themselves.

This is a landmark decision in several respects. First, the Court exercised jurisdiction over Google Inc.—a U.S. company—through the activity of its Spanish subsidiary. This means that data controllers based outside of the EU will now have to comply with the ruling if they or any of their subsidiaries process EU citizen data in any EU Member States. Second, the ruling highlights the stark differences in data privacy and protection law that exists outside the EU, such as in the United States. Google Inc.'s implementation of new policies to comply with the ruling will reveal the broader global implications of the decision.

Download PDF