The French privacy watchdog has dug its heels in over Google’s refusal to apply the so-called Right To Be Forgotten* to all of its domain names, including Google.com.
In June, CNIL ordered Google to de-link outdated and irrelevent information from its Google.com domains within two weeks, or face a fine. The search monster appealed, but on Monday the CNIL watchdog rejected that appeal.
Google had argued that around 97 per cent of French users use Google.fr rather than Google.com, that CNIL was trying to apply French law extra-territorially and that applying the RTBF on its global domains would impede the public’s right to information and would be a form of censorship.
In a statement on Monday, the French data protection authority poured cold water on all of the Chocolate Factory’s arguments.
“Geographical extensions are only paths giving access to the processing operation. Once delisting is accepted by the search engine, it must be implemented on all extensions. If this right was limited to some extensions, it could be easily circumvented: this would equate stripping away the efficiency of this right, and applying variable rights to individuals depending on the internet user who queries the search engine and not on the data subject,” it said.
“In any case, the right to delisting never leads to deletion of the information on the internet; it merely prevents some results from being displayed following a search made on the sole basis of a person’s name. Thus, the information remains directly accessible on the source website or through a search using other terms,” continued CNIL.
The DPA has now given Google another ultimatum: de-list from Google.com or face a €150,000 fine. It is unlikely that such a small amount would dent the tech behemoth’s coffers, but the situation could escalate.
Last October, the High Court in Paris ordered Google to remove links to defamatory information (as distinct from the outdated or irrelevant info under RTBF) from its .com domain. Prior to that, most rulings limited themselves to the local top-level domain, but the court took the same view as CNIL that even in France users can search using the Google.com domain.
* The “Right To Be Forgotten” is really no such thing. Despite a huge media song and dance over the May 2014 European Court of Justice ruling, the right was already enshrined in EU data protection law. The 1995 EU Data Protection Directive requires companies which collect and process data to remove “outdated, inadequate or irrelevant” information.
What was new in the ECJ decision was the ruling that the search engine did constitute a data controller and as such was subject to the law. Therefore Google was ordered to remove the links. The information, as pointed out by CNIL, remains untouched on the original website. ®