Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

In a landmark ruling, the European Court of Justice—Europe’s highest court—dealt Google a clear win by placing a territorial limit on the “right to be forgotten

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

Forget Me…or Not: Europe’s High Court Limits Territorial Reach of Right to Be Forgotten, But Not of GDPR

Forget Me…or Not: Europe’s High Court Limits Territorial Reach of Right to Be Forgotten, But Not of GDPR | Socially Aware

Alex van der Wolk

In a landmark ruling, the European Court of Justice—Europe’s highest court—dealt Google a clear win by placing a territorial limit on the “right to be forgotten” in the EU. The court’s holding in <a href="http://curia.europa.eu/juris/document/document.jsf?text=&docid=218105&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=1623465" target="_blank" rel="noopener">Google v. Commission nationale de l’informatique et des libertés (CNIL)</a> clarifies that a search engine operator that is obligated to honor an individual’s request for erasure by “de-referencing” links to his or her personal data (i.e., removing links to web pages containing that personal data from search results) is only required, under the GDPR, to de-reference results on its EU domains (e.g., google.fr in France and google.it in Italy), and not on all of its domains globally.However, in the same ruling, the Court also stated that the GDPR applies to Google’s data processing on all of its domains globally (by virtue of such processing comprising “a single act of processing”). Therefore, an EU Member State’s supervisory authority and courts are free to treat the ECJ’s EU-wide de-referencing requirement as a “floor” and go one step further, requiring search engines to implement the right to be forgotten on all of its domains worldwide, including those outside the EU.Background – The Right to Be ForgottenThe right to be forgotten—codified at <a href="https://gdpr-info.eu/art-17-gdpr/" target="_blank" rel="noopener">Article 17 of the GDPR</a>—grants individuals the right to obtain erasure of their personal data without undue delay, where, for example, the data are no longer necessary for the purpose for which they were collected or processed. However, the right is not unlimited; exceptions apply if the processing is deemed necessary for the exercise of freedom of expression, compliance with a legal obligation, public interests such as public health, scientific or historic research, or the establishment or defense of legal claims.<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046&from=en" target="_blank" rel="noopener">Article 12(b) of the EU Data Protection Directive 95/46/EC</a> (“the Directive”) conferred a similar (though slightly narrower) right. The Directive required Member States to guarantee individuals the right to obtain rectification, erasure, or blocking of personal data when the processing of that data does not comply with the Directive’s provisions. Although the GDPR replaced the Directive, the court examined the questions posed under both the Directive and the GDPR because the case originated when the Directive was still operative.The CaseIn 2014, the ECJ ruled in <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118" target="_blank" rel="noopener">Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos</a> that individuals have the right to request that Google delete links to webpages containing their personal data from Google search results even if the publication of such information on those webpages is lawful. This was <a href="https://www.sociallyawareblog.com/2014/05/15/european-court-of-justice-strengthens-right-to-be-forgotten/" target="_blank" rel="noopener">a significant expansion of rights as it granted the right even where the information was rightfully made public</a>. The ECJ held that because search engines make it easier to find information, the search engine operators are responsible (i.e., are data controllers) with respect to search engine results. Search engine operators are therefore fully responsible for the content they display, and individuals have a right to request that links to third-party websites containing their personal data be deleted from search results when the personal data are inadequate, irrelevant, or excessive in relation to the purposes of the processing.Google responded to the ruling by using geolocation data to route users to the appropriate national version of its search engine and by de-referencing the relevant search results on its EU domains only. The CNIL, France’s data protection authority, subsequently levied a €100,000 fine on Google, asserting that Google should de-reference the search results all of its domains globally. Google appealed the fine to the ECJ.The Court’s ReasoningSiding with Google, the court reasoned that while both the Directive and the GDPR aim to guarantee a high level of protection of personal data throughout the EU, and “de-referencing carried out on all the versions of a search engine would meet that objective in full,” there is currently no obligation to do so under EU law. Instead, the court held that search engine operators need only carry out de-referencing on all of their EU Member State domains, regardless of the Member State from which the erasure request originates.In its decision, the court emphasized that it is not apparent from the text of either the Directive or the GDPR that the EU legislature intended for the right to be forgotten to have an extraterritorial reach.  An individual’s data protection rights are not absolute and must be balanced against other fundamental rights, including freedom of expression and information.  The court indicated that the EU legislature performed this balancing test for the EU only, and the outcome “is likely to vary significantly around the world.” Accordingly, the right to be forgotten is not necessarily recognized outside of the EU and there is currently no obligation under EU law for a search engine to de-reference its search results around the world.However, the court noted that while EU law does not require global de-referencing, it likewise does not prohibit it. As it has been left up to Member States to balance individual rights and the freedom of expression and information (based on <a href="https://gdpr-info.eu/art-85-gdpr/" target="_blank" rel="noopener">GDPR Article 85</a>), a Member State’s supervisory authority or courts may reach a different conclusion on global de-referencing.The GDPR’s Extra-Territorial ApplicabilityWhile it may appear to be limited to search engines and the right to be forgotten, the court’s ruling is in fact much broader. The court already decided, in the 2014 Google Spain case, that Google Search in the United States is subject to the GDPR because its activities are inextricably linked with the activities of Google’s EU sales office. In that case, the court reasoned that the EU establishment was “intended to promote and sell in that Member State advertising space offered by the search engine which serves to make the service offered by the search engine profitable.” Selling advertising space renders the search engine economically profitable, while the search engine provides the platform on which the advertising activities are performed. As a result, the court held that Google’s activities in the U.S. and the EU are “inextricably linked” and the GDPR therefore applies directly to Google in the U.S. The subsequent question of whether the GDPR applies to personal data processed in the context of the EU domains only, or to all of Google’s processing activities in the U.S. (including those on non-EU domains), was left unresolved.The ECJ appears to answer that question in <a href="http://curia.europa.eu/juris/document/document.jsf?text=&docid=218105&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=912312" target="_blank" rel="noopener">this latest decision</a>. The ECJ ruled that although Google operates different national versions of its search engine, the “entire search engine must still be regarded as carrying out a single act of personal data processing” due to the existence of gateways between the various national versions.  In other words, because national versions of the Google search engine are considered part of a single act of processing, GDPR applies to data processing in the context of the entire search engine, not just the EU versions. This clarifies the court’s holding that national EU regulators and courts may conduct their own balancing test and potentially require de-referencing outside of the EU if they find that the processing is inextricably linked.The decision may also apply outside of the search engine context. Any company that operates a single service (such that it constitutes a single act of processing of personal data) and has establishments in the EU runs the risk that the GDPR will “taint” all of its global data processing operations. However, it remains to be seen whether regulators will focus enforcement on global processing of personal data. As the European Data Protection Board acknowledged in its (draft) <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_en.pdf" target="_blank" rel="noopener">Guidance</a>, the GDPR’s territoriality principle (under <a href="https://gdpr-info.eu/art-3-gdpr/" target="_blank" rel="noopener">Article 3(1)</a>) should not be applied overly broadly, such that even a remote link to data processing in the EU would be sufficient to bring that processing within the GDPR’s scope. At a minimum, it seems highly unlikely that regulators will make such extraterritorial enforcement of GDPR a priority.