On June 12, 2015 the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés – CNIL) issued a notice ordering Google to draw all the consequences of the CJEU May 13, 2014 ruling and to apply delisting not only to the national domain of the individual who requests delisting but on all of the search engine’s domains, including google.com (see our article The Right to be Forgotten: Another Scuffle between Google and The French Data Protection Authority | Security, Privacy and the Law).
Google filed an informal appeal against this formal request and, not surprisingly, on September 21, 2015 the French Authority rejected the appeal for the same reasons, basically, as those set out in June:
“Geographical extensions are only paths giving access to the processing operation. Once delisting is accepted by the search engine, it must be implemented on all extensions, in accordance with the judgment of the ECJ.
If this right was limited to some extensions, it could be easily circumvented: in order to find the delisting result, it would be sufficient to search on another extension (e.g. searching in France using google.com), namely to use another form of access to the processing…
In any case, the right to delisting never leads to deletion of the information on the internet; it merely prevents some results to be displayed following a search made on the sole basis of a person’s name.
In addition, this right is not absolute: it has to be reconciled with the public’s right to information, in particular when the data subject is a public person, under the double supervision of the CNIL and of the court. Finally, contrary to what Google has stated, this decision does not show any willingness on the part of the CNIL to apply French law extraterritorially. It simply requests full observance of European legislation by non European players offering their services in Europe.”
The CNIL concluded that Google “must now comply with the formal notice. Otherwise, the President of the CNIL may designate a Rapporteur who may refer to the CNIL’s sanctions committee with a view of obtaining a ruling on this matter”.
Three comments can be made in relation to this recent development:
First, the last time CNIL imposed a fine upon Google (100.000 €) was in March 2011 in relation to Street View and it took ten months for CNIL to issue a decision after the formal notice was sent to Google.
Second, the position adopted by the French CNIL is not isolated: it is perfectly in line with the European Guidelines on the implementation of the ECJ judgment which were issued by G29 (the Group attended by representatives of Data Protection Authorities of all European countries) on November 26, 2014: “limiting delisting to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the judgment”.
Finally, although the CNIL states that delisting must be implemented on all extensions “in accordance with the judgment of the ECJ”, this issue was not in fact discussed in the Costeja Gonzalez case. This is a matter of interpretation which could well lead to a new referral to the European Court of Justice.