In Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12 the European Court of Justice in 2014 stated:

(a)          the principle that individuals have the right to have search engine results removed where they affect privacy rights; and

(b)          for the purposes of the Data Protection Directive (95/46/EC) that Google acts as a data controller (through its search function), even if it does not control the data appearing on third-party websites.

Since the ECJ’s judgment Google, alleging freedom of information, has been delisting search results on its EU domains relating to countries where delisting was granted, such as google.co.uk and google.fr, but not on non-EU domains such as google.com. A few days ago news broke that Google - which claims its strict compliance to the ECJ’s judgment quoted above - is now appealing against a demand by the French regulator to apply the EU’s “right to be forgotten” outside Europe.

The issue at stake is whether data protection laws have only territorial nature or have an extra-territorial (perhaps worldwide) reach. As lawyers increasingly involved in advising clients on data protection issues, we are extremely interested in the outcome of this dispute and any further development which may follow from it.