Google defies French global ‘right to be forgotten’ ruling

library
crime | hacking | security

Last month the French data protection authority – the Commission nationale de l’informatique et des libertés (CNIL) – told Google that successful right to be forgotten requests made by Europeans should be applied across all of the company’s search engines, not just those in Europe.

In response, Google yesterday gave its unequivocal answer to that request: “Non!”

Writing on the company’s Google Europe blog, Peter Fleischer, Global Privacy Counsel, explained how the search giant had complied with the original “right to delist” ruling – which gives EU citizens the right to ask internet search engines to remove embarrassing, sensitive or inaccurate results for search queries that include their name – made by the Court of Justice of the European Union in 2014.

That cooperation, he said, had already led to the processing of over a quarter of a million removal requests pertaining to over a million web pages.

While I get the impression that Google is far from happy about having to police the links it indexes, Fleischer appeared to be philosophical about the matter, accepting that the law is the law in Europe.

He was, however, keen to point out that the right to be forgotten ruling was not global in nature and that any move to make it so would be “a troubling development that risks serious chilling effects on the web”.

Citing examples of how laws can vary widely between different nations, Fleischer highlighted Russia and its outlawing of any speech which could be deemed to be in favour of homosexuality; legislation in Thailand that makes it an offence to criticise its monarch; and Turkey where it is illegal to utter disparaging remarks about Atatürk, the country’s first president.

If the French ruling were to be taken up by other nations – CNIL is currently in negotiations with data protection regulators from all 28 EU member states over just that – the consequences could be severe, he said:

If the CNIL’s proposed approach were to be embraced as the standard for internet regulation, we would find ourselves in a race to the bottom. In the end, the internet would only be as free as the world’s least free place.

We believe that no one country should have the authority to control what content someone in a second country can access. We also believe this order is disproportionate and unnecessary, given that the overwhelming majority of French internet users – currently around 97% – access a European version of Google’s search engine like google.fr, rather than Google.com or any other version of Google.

Fleischer ended the blog post by reiterating Google’s efforts in working with data protection authorities but made it clear that the company disagreed with CNIL’s ruling and had asked the agency to withdraw its threat of sanctions.

According to the BBC, the French regulator said it was aware of Google’s “political” statement and would reply within the next two months.

Fortunately for Google, CNIL can only go so far with that legal reasoning – the agency can only hand out fines of up to €150,000 (£105,500 or $164,500) for non-compliance with its rulings.

Of greater concern to Google would be the threat of further legal action, not only in France, but also elsewhere in a European Union that appears to have formed a consensus under the Article 29 Working Party, an amalgam of EU data protection regulators who, in November, wrote:

Limiting delisting to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the [privacy] rights of data subjects…this means that in any case de-listing should also be effective on all relevant domains, including .com.

Meanwhile, some non-European countries are also looking to interpret their own versions of the ‘right to be forgotten’ ruling. A Canadian court, for instance, recently forced Google to de-index a Canadian company’s competitor across every one of its search engines, while Russia pushes ahead with its own equivalent ruling, administered by state communications watchdog Roskomnadzor.