The ‘Right to be forgotten’ law forces Google to wipe personal information from its search results when requested by people, such as criminal convictions.
The tech giant was braced for a potentially landmark ruling from the EU Court of Justice (ECJ), which could have decided to expand the remit of the so-called “right to be forgotten” law beyond Europe.
Five years ago, judges in Luxembourg made it a requirement for Google to delete links that led to sensitive details if asked to do so after a case was brought by French privacy watchdog CNIL.
One case resulted in a businessman winning an “unprecedented” High Court bid to have a past crime he committed disappear from search results.
Google was confident of coming out on top in its second court battle with CNIL after receiving the vital backing of ECJ adviser Maciej Szpunar, who said earlier this year that the right to be forgotten should only apply in Europe.
Judges at the top EU court said on Tuesday that they agreed with the Polish lawyer, ruling that Google does not have to remove links to sensitive personal data globally.
Ahead of the decision, experts had warned that ruling in favour of CNIL for a second time may embolden authoritarian governments to demand the removal of any topic they want.
Thomas Hughes, executive director of British human rights organisation Article 19, said: “Courts or data regulators in one country should not be able to determine the search results that internet users around the world get to see.
“When making a decision to de-list websites, they need to strike a proper balance between the right to freedom of expression and other rights.”
Google, which remains the most popular search engine in the world, has also warned about the potential dangers of over-reach by the European court.
In a blog post two years ago, the company said there should be a balance between sensitive personal data and the public interest, and that no one country should be able to impose its rules on citizens of another.
Google has previously been fined €100,000 (£88,284) by CNIL for failing to comply with the original ruling.
The company revealed in a report that it had removed 45% of the 3.3 million links it had been asked to remove, spanning more than 845,000 requests, since 2014.