In June, French regulators ordered Google to extend its "Right to be Forgotten" search engine delistings to its sites around the world rather than only in Europe. From their perspective, Google leaving such listings available in other versions of its search engine (such as the American Google.com) lets people easily get around the delistings in localized, European versions of Google. They're not wrong about that.
On the other side of the coin, however, Google argues that by complying with this, it would effectively be enabling one regulator to to have control over what happens around the entire world.
Google appealed in July, but news is out now that its appeal has been blocked, and Google now finds itself at the stage where it has no more course for appeal before facing impending fines. CNIL sasy the appeal has been rejected for the following reasons:
Geographical extensions are only paths giving access to the processing operation. Once delisting is accepted by the search engine, it must be implemented on all extensions, in accordance with the judgment of the ECJ.
If this right was limited to some extensions, it could be easily circumvented: in order to find the delisted result, it would be sufficient to search on another extension (e.g. searching in France using google.com) , namely to use another form of access to the processing. This would equate stripping away the efficiency of this right, and applying variable rights to individuals depending on the internet user who queries the search engine and not on the data subject.
In any case, the right to delisting never leads to deletion of the information on the internet; it merely prevents some results to be displayed following a search made on the sole basis of a person’s name. Thus, the information remains directly accessible on the source website or through a search using other terms. For instance, it is impossible to delist an event.
In addition, this right is not absolute: it has to be reconciled with the public’s right to information, in particular when the data subject is a public person, under the double supervision of the CNIL and of the court.
Finally, contrary to what Google has stated, this decision does not show any willingness on the part of the CNIL to apply French law extraterritorially. It simply requests full observance of European legislation by non European players offering their services in Europe.
You can read CNIL's whole announcement about the rejection here.
The Guardian shares quotes from both CNIL (the French regulator) and Google:
CNIL said in a statement: “Contrary to what Google has stated, this decision does not show any willingness on the part of the CNIL to apply French law extraterritorially. It simply requests full observance of European legislation by non European players offering their services in Europe.”
A Google spokesman said: “We’ve worked hard to implement the ‘right to be forgotten’ ruling thoughtfully and comprehensively in Europe, and we’ll continue to do so. But as a matter of principle, we respectfully disagree with the idea that one national data protection authority can assert global authority to control the content that people can access around the world.”
According to the report, Google faces a fine around €300,000 if it doesn't comply, but that could increase to between 2% and 5% of global operating costs. The company will reportedly then be able to appeal the fine with the he Conseil d’Etat, which serves as the supreme court in France.
Image via Google