Retour à la page contenant cette publicationNews June 2016 : Right to be forgotten and delisting (Part 2)
Google’s request to French Supreme Court (« Conseil d’Etat”) after CNIL’s fine of 100,000 euros
In our previous post dated February 2016, we had developed Google’s settlement proposal aimed at avoiding the administrative penalties incurred as from French Data Protection Authority (the « CNIL »)’s formal notice, dated June 2015, under which terms Google was summoned to delist on all its domain names, worldwide, the queries arising from European citizens and regarded as acceptable by the search engine.
At that time, we were very skeptical as regards the possibility for the CNIL to agree with Google’s settlement proposal, which purpose was to extend the delisting to all domain names outside Europe (« .com » or « .ca » for instance) subject to the fact that the claimant’s query would arise from the European country where the claimant was located in.
Such a “filtering” as from the claimant’s country of location appeared to us difficult to accept for the CNIL which stated objective is to clearly ensure “full effectiveness” of the right to be forgotten (and of the related delisting right) to the benefit of any European citizen, regardless of the domain name or the country from which the query would arise).
Thus, it is not surprising that the CNIL objected, through a restricted Commitee’s decision dated 10 March 2016, to Google’s settlement proposal and fined a 100,000 euros penalty[1] to the search engine for not having deleted, at a worldwide scale, the links appearing from a query based on an individual name.
If the CNIL notes that this proposal is an « improvement » (which could explain a fine limited to « only » 100,000 euros), the French Data Protection Authority however considers that the delisting restriction based on the query’s searcher location criterion is unable to ensure the effectiveness of the right-to-be- forgotten ; indeed, Internet users may easily avoid the filter measure by « being allocated a foreign IP address even though he or she is located on national territory » or use a VPN which by-pass the IP address location.
The main interest of the CNIL’s financial penalty is not related to its amount (which is rather symbolic, given in particular Google global turnover) but lies in the radically different conception of the right to privacy and personal data protection, both concepts around which the battle between Google and the CNIL takes place.
For the CNIL, the necessity to ensure the European citizens right-to-be-forgotten effectiveness is so crucial that the worldwide delisting (“the sword arm” of the right-to-be-forgotten) shall not suffer many limitations which should be, in any case, be construed in a restrictive manner:
- first of all, as regards the geographical scope of the right-to-be-forgotten celebrated by Google Spain decision[2]: whereas Google sustains that by requiring a worldwide delisting of link, the CNIL is exceeding its powers by imposing a measure of extraterritorial scope (to « queries made on search engines outside of France ») ; the CNIL replies that French law is applicable since Google search processing systems are “ in reality (…) a single processing system with multiple technical paths” managed by Google Inc. (acting as a data controller) and that « the French Data Protection Act therefore applies to all processing associated with the Google Search service since, within the meaning of Article 5-I-1 of the French Data Protection Act, Google France contributes, in French territory, to the activity of the search engine operator based in the United States”.
Besides, the repressive nature of the administrative fines which the CNIL may impose are close, by principle, to the criminal penalties which applicability lies upon generally a “territorial” criterion (place where the offense has been committed) and/or a “personal” criterion (related to the identity of the person to be protected). It is apparently based on this “territorial” criterion that the CNIL reaffirmed its power to rule on delisting implementation terms[3]. Such an alignment on the criminal penalties legal status could also explain why the location criterion of the searcher’s query (who is not the person to be protected) such as proposed by Google (as a prerequisite to the delisting on all extensions of the domain names) could not satisfy the CNIL[4].
- Besides, the international principles of “courtesy” and “national sovereignty » combined with the freedom of expression and information rights should not prevent or even impair the effectiveness of the right-to-be-forgotten, since the right to delisting is, on the one hand, “associated with an individual” and “must be effective without restriction for all processing, even if it conflicts with foreign rights”. On the other hand, the CNIL reminds that such delisting right is subject, before being granted, to a proportional check with respect to the targeted goal: in this respect, the CNIL considers that the delisting does not erase any content on the Internet but only de-index the web pages links (meaning that the content remains accessible through other search terms) and, besides, conditions in order to implement the delisting right must be met beforehand and a proportional check is also to be implemented, on a case by case basis, in order to safeguard the right to the public of accessing information, in particular in the event that the claimant plays a role in public life.
Following this decision dated March 10, Google Top Management expressed as follows « we’ve worked hard to implement the right to be forgotten ruling thoughtfully and comprehensively in Europe and we’ll continue to do. But as a matter of principle, we disagree with the CNIL’s assertion that it has the authority to control the content that people can access outside France, and we plan to appeal their ruling”.
Such appeal has been lodged, on May 19, as Google has decided to file a summary request before the French Administrative Supreme Court (“Conseil d’Etat”) in order to challenge CNIL’s decision which is regarded to be disproportionate. Google still believes that the geo-tracking through the IP address grants effectiveness to the right-to-be-forgotten, since it further considers that 100% of the European users can only access the local results of its search engine.
However, this position shall be difficult to sustain for Google since the right-to-be-forgotten is more and more regarded as a fundamental personal right. The new Regulation 2016/679 of the European Parliament[5] on the protection of personal data, adopted on April 14, has dedicated to the right-to-be- forgotten its recitals 53 and 54 and its article 17. Pursuant to Article 32 of the draft law for a Digital Republic which has been modified by the French Senate on its first reading, on May 3, a specific right-to-be-forgotten for minors is introduced (people can request the deletion, within one month, subject to a fine of 10,000 euros, of their personal data which have been collected by means of a services proposal issued by a company when the concerned person was minor).
It has to be noted that, whereas in the draft law adopted by the French National Assembly in January 2016, the fines by the CNIL had been substantially increased (from 300,000 euros to a fine amounting up to 20 million euros or, in case of a legal entity, up to 4% of the worldwide aggregate turnover), the French Senate has reduced the maximum penalty to 1.5 million euros.
The joint mixed commission will have the final say; being reminded that the draft adopted by the National Assembly was in line with the administrative fines recommended by Article 79 of the European Regulation.
There still remain grey zones on how to implement the delisting on all domain names of the search engine – in case the Conseil d’Etat would confirm the CNIL’s decision and in any case actually.
How the delisting claimant is expected to express his query? Shall he be required to draft several queries, depending on the search engine concerned (at the risk of getting contradictory decisions on his queries) or shall he have to wait for a “single-desk” query-form having a simultaneous effect on all search engines?
If a delisting query is rejected by the search engine after the proportionality check, shall the claimant be entitled to be provided with the reasons of such rejection? For the moment, the criteria according to which Google admits or not a delisting query is marked with a certain lack of transparency….
Many practical questions still remain unanswered.
The least one can say is that the right-to-be forgotten issue and the questions of the person fundamental rights which derive from it, go well beyond the European boundaries, with all due respect to Google.
The United States have very coldly welcomed the CNIL’s decision blaming the French administrative authority – and through it, France – to try to « export its censorship » and to « impose unilaterally its rule to the entire world ». Is it something that could reinforce the “French bashing”, which is never very distant?
Canada is currently wondering about how to implement the right-to-be-forgotten and, on that subject, faces a violent opposition from the freedom of speech defenders. It is true that, if a delisting query can legitimately arise from the directly concerned claimant, it seems necessary to ascertain that the first admissibility condition of such a query should be that it must exclusively arise from the concerned natural person (and not, for example, from a State which could have political interest in censoring a content on the Internet)…
However, a Chinese court had apparently rejected, in last May, a delisting query and has judged that Chinese citizens do not benefit of any right-to-be-forgotten on the Internet. The New Delhi Supreme Court should normally state, on September 19, on the right-to-be-forgotten issue, which is rather ironical, if we consider the recent declarations of the Attorney General of India, Mukul Rohatgi – quote: « Violation of privacy doesn’t mean anything because privacy is not a guaranteed right ».
Next step of this fascinating drama in France: the Conseil d’Etat ruling which is expected in one or two years.
by Sarah Temple-Boyer, Attorney at law
[1] Decision no. 2016-054 of March 10, 2016 of the Restricted Committee issuing Google. Incwith a financial penalty
[2] EUCJ C-131/12 du 13 mai 2014 Google Spain SL et Google Inc. V. Agencia Espanola de Proteccion de Datos (AEPD) et Mario Costeja Gonzales
[3] Extract of its decision n°2016-054 dated 10 March 2016: « Furthermore, the Commission is empowered to determine the de-listing methods if the processing in question is carried out, as per Article 48 of the French Data Protection Act, whether fully or partially, on the national territory, including where the data controller is established in another Member State of the European Union ».
[4] Extract of its decision n°2016-054 dated 10 March 2016: « The protection of a fundamental right cannot vary depending on the data recipient. Bothe European and French legislation states that an individual can exercise his or her rights with regard to data processing regardless of the recipient ».
[5] Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)