Google Spain: French data protection authority rejects Google appeal

The French data protection authority, the CNIL, has dismissed an internal administrative appeal by Google Inc against its ruling that the decision in Google Spain requires delisting on all versions of the search engine, including google.com.

In May 2015, the CNIL served Google Inc with a notice requiring it to delist across all domain names worldwide.  The CNIL considered that, in order to be effective “delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing”.  

In July 2015, Google Inc lodged a “recours gracieux” – that is an internal administrative appeal -seeking withdrawal of the notice.  This was considered by the President of CNIL, Isabelle Falque-Pierrotin, and was rejected on 21 September 2015.

The following reasons were given for the rejection of the appeal:

• Geographical extensions are only paths giving access to the processing operation. Once delisting is accepted by the search engine, it must be implemented on all extensions, in accordance with the judgment of the ECJ.
• If this right was limited to some extensions, it could be easily circumvented: in order to find the delisted result, it would be sufficient to search on another extension (e.g. searching in France using google.com) , namely to use another form of access to the processing. This would equate stripping away the efficiency of this right, and applying variable rights to individuals depending on the internet user who queries the search engine and not on the data subject.
• In any case, the right to delisting never leads to deletion of the information on the internet; it merely prevents some results to be displayed following a search made on the sole basis of a person’s name. Thus, the information remains directly accessible on the source website or through a search using other terms. For instance, it is impossible to delist an event.
• In addition, this right is not absolute: it has to be reconciled with the public’s right to information, in particular when the data subject is a public person, under the double supervision of the CNIL and of the court.
• Finally, contrary to what Google has stated, this decision does not show any willingness on the part of the CNIL to apply French law extraterritorially. It simply requests full observance of European legislation by non European players offering their services in Europe.

As a result of this ruling Google must now comply with the original order and delist over 100,000 URLs, already removed from European versions of its search engines at the request of individuals linked to France, from all other versions.

According to Google’s latest transparency report of the 318,560 delisting requests it has received, 66,732 or 21% have come from France.  These have resulted in the removal of 48.2% of the URLs requested, that is 106,029.

Google cannot, at this stage, appeal the order.  If, however, it does not comply and fines are imposed by CNIL then the decision to fine can be appealed to the Conseil d’Etat.

In a statement quoted in the Guardian, a Google spokesman said:

“We’ve worked hard to implement the ‘right to be forgotten’ ruling thoughtfully and comprehensively in Europe, and we’ll continue to do so. But as a matter of principle, we respectfully disagree with the idea that one national data protection authority can assert global authority to control the content that people can access around the world.”

It will be interesting to see whether Google now complies with the CNIL’s order and whether this ruling has any impact on the approach taken by other data protection authorities across Europe.  The ICO in England has, so far, not required Google to implement delisting across all versions of its search engine.