Retour à la page contenant cette publicationNews February 2016: Right to be forgotten and Delisting (Part 1)
What will the CNIL think of Google’s new plan as regards delisting rights of European Internet users?
Eventually, the tenacity of the French Data Protection Authority (the “CNIL”) and the rumor about imminent fines against Google, in January 2016, seem to have paid off to the benefit of the European web users.
Google is about to obey – at least partially – to the CNIL’s injunctions by extending the delisting required by an Internet user to all its domain names (including Google.com), subject to some location criteria though, it seems….
As a reminder and as explained in our previous publication, the arm wrestling between Google and the CNIL started after CJUE’s decision dated of May 2014[1] which consecrated the “right to be forgotten” and allowed individuals, under specific conditions, to ask for and obtain the removal of the links which arise from the search results based on their names.
Further to the restrictive implementation made by Google of the CJUE’s decision (ie. restricting the accepted delisting by the search engine exclusively to its European domain names), the CNIL had summoned Google, on June 12, 2015, to extend the benefit of the delisting to all its domain names (including Google.com).
Google filed a petition against this formal notice, alleging that the CJEU decision was only enforceable as regards EU domains and blamed the CNIL for trying to make an extraterritorial application of European case law.
On September 21, 2015, the CNIL rejected such petition and its conclusion is clear: as from the moment Google accepted a delisting claim, the removal of the related links must be operated on all relevant domains of the search engine. The domains being only different pathways to access one data processor, the delisting shall not be limited to the domains related to the country where the claimant is located; otherwise, such geographical restriction will necessarily deprive the CJEU decision of all practical effectiveness.
Since early February, the French and international media have announced that Google was about to adjust its position in order to satisfy the European data protection authorities (among which the CNIL).
However and since there has not been any official press release by Google itself, there is quite a confusion, at present, on the exact terms of Google’s plan related to the delisting extension scope.
On the one hand, some information sources claim that Google has completely changed its position to meet the European authorities’ requirements and is about to propose a total delisting on all its domain names (including Google.com, Google.ca (Google canada) etc…) to the benefit of European Internet users.
According to those sources, European web users would benefit (provided that their removal request has been accepted) of a delisting on all Google’s domain names worldwide, which Google would grant as soon as a query on their names would arise from a browser located anywhere on the European territory (the location of such query being identified through the browser’s IP address).
Other information sources suggest, on the other hand, that Google would only be ready to grant the benefit of a total delisting to the only European Internet users whose removal request has been accepted and subject to the fact that the query based on their names is originated in the country the removal request has arisen from.
In practice, it means that, for example, a French web user (whose removal request has been accepted by Google) could get the insurance that all relevant links (in connection with his name) are removed from, not only Google.fr, but also from the other European and worldwide domain names (such as Google.com, Google.ca etc….) subject, however, to the fact the query on his name would arise……. from browsers located within the French territory.
Apparently and based on a statement of a Google knowledgeable person collected by the American newspaper Fortune, Google’s commitment would be the following:
“In addition to our existing practice of delisting on all European domains, we’ll soon also remove delisted search results from all Google domains for people searching from the country of the requester, reflecting evolving European law in this area”.
In such a case, the European web user’s “right to be forgotten” and his related delisting right would vary depending on whether the browser is located in his home country or not.
In practice: the French web user (whose removal request has been accepted by Google) can be ensured that the irrelevant links will be removed from all Google domain names and unavailable to any other French browser, but not necessary to another European browser.
Therefore, if it is true that an Italian browser will not be able to have access to the links related to the French requester through neither Google.it, nor Google.fr and other European names…. he will find them through Google.com (the European country from where the query arises – Italy – being different from the country in which the delisting claim has been notified – France, in the present case).
If such is Google’s plan (which is still unofficial at the present time), it is not sure that the CNIL will consider it acceptable: the latter could consider that the French web user (the removal requester) does not benefit of the same “right to be forgotten” everywhere in Europe, since he is subject to a “country-by-country basis” condition within Europe, depending on where exactly the European browser is located.
In order to ensure an adequate and equal protection to all European web users within the European territory, does it mean that such European user (who may be known beyond his homeland’s boundaries) should introduce a simultaneous removal request in all European countries in order to be able to benefit, in practice, of an effective delisting from Google.com?
Google probably considers that:
(i) the extension – even under some conditions – of the delisting right to all its domain names to the benefit of the European Internet user, combined with
(ii) the fact that, since March 2015, it is most difficult for a European citizen to have access to other Google’s domain names but those directly connected to his IP address (indeed, having now access to Google.com by a French browser requires agility and some computer skills!)
both ensure, in practice, an effective “right to be forgotten” and the best implementation of the related delisting, in accordance with the principles referred to in CJUE’s decision of May 2014.
It is not obvious that the most demanding European data protection authority, the CNIL, will share this view. We shall probably find out soon, since the analysis of Google’s plan is currently in progress…
by Sarah Temple-Boyer, Attorney at law
[1] CJUE C-131/12 du 13 mai 2014 Google Spain SL et Google Inc. V. Agencia Espanola de Proteccion de Datos (AEPD) et Mario Costeja Gonzales