In a press release issued on Friday 12 June 2015, CNIL noted that it had received hundreds of complaints following Google’s refusal to carry out delistings. Following assessment of those requests
the CNIL has requested Google to carry out the delisting of several results. It was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com …).
Although the company has granted some of the requests, delisting was only carried out on European extensions of the search engine and not when searches are made from “google.com” or other non-European extensions.
CNIL considered that, in order to be effective “delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing”.
As a result, the CNIL has given Google formal notice that it must carry out the requested delistings within a period of 15 days. No further action would be taken if the notice is complied with in the time period. However,
If Google Inc does not comply with the formal notice within the fifteen days the President will be in position to nominate a Rapporteur to draft a report recommending to the CNIL Select Committee (the Committee in charge of imposing sanctions in case of violation of the French data protection law) to impose a sanction to the company.
The CNIL can impose fines of up to €150,000 for non-compliance.
A Google spokesperson said
“We’ve been working hard to strike the right balance in implementing the European Court’s ruling, co-operating closely with data protection authorities. The ruling focused on services directed to European users, and that’s the approach we are taking in complying with it.”
CNIL is leading for EU data protection authorities on the implementation of the right to be forgotten. In November 2014 the EU Article 29 Working Party adopted Guidelines on the implementation of the Google Spain judgment. The Working Party said that in order to give full effect to the data subject’s rights as defined in the Court’s ruling, de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. As a result,
“limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com”.