France Fines Google Over Global Right to be Forgotten

The French data-protection regulator, Commission Nationale de l’Informatique et des Libertés (CNIL) has fined Google 100,000 euros (about $112,000) for not conforming on a global scale with a May 2014 European Court of Justice (ECJ) ruling over the right to be forgotten.

The ECJ ruling held that search engines are responsible for enforcing the right to be forgotten in the following manner:

the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.

Google complied with this ruling by scrubbing the requested search results across its European domains, such as google.fr and google.de, but did not do so across google.com or other, non-European domains. Google defended this choice (as previously reported in JOLT Digest) as one that would prevent a chilling effect on the free flow of information. In implementing the order, Google vets individual requests by weighing that person’s privacy rights against the public interest in keeping that information linked to that person’s name.

However, that decision was not acceptable for the CNIL, who insisted in May 2015 that Google expand its actions to all of its domains, primarily because of the ease with which a use can switch among the various Google domains. The CNIL said: “Contrary to Google's statements, applying delisting to all of the extensions does not curtail freedom of expression insofar as it does not entail any deletion of content from the Internet.”

In response, Google attempted to forge a compromise by censoring results based on whether it thought the user was in France using IP addresses and other indicators to make that determination. This would prevent users from accessing the removed results by simply changing their domain from google.fr to google.com. Accompanying this move, a Google spokesperson said that the company had worked hard to implement the “right to be forgotten ruling thoughtfully and comprehensively in Europe."”

On March 10, 2016 the CNIL released its decision to fine Google for non-compliance with the ECJ ruling. The CNIL rejected Google’s last attempted compromise, insisting that “only delisting on all of the search engine's extensions, regardless of the extension used or the geographic origin of the person performing the search, can effectively uphold this right,” and that a person's right to privacy could not depend on the “geographic origin of those viewing the search results.”

After the fine was imposed, Google spokesperson Al Verney stated that “as a matter of principle, we disagree with the CNIL’s assertion that it has the authority to control the content that people can access outside France, and we plan to appeal their ruling.”