Google Inc., no. 399922, Conseil d'Etat. July 19, 2017.
This case refers to the geographical scope of delistings in "right to be forgotten" (droit au déréférencement) requests.
Google filed a complaint on the Conseil d'Etat against the decision of CNIL to fine the company in the amount of 100,000 Euros for failing to comply with the commission letter of formal notice. On the letter, CNIL demanded Google to delist search results on all the extensions of domain name of its search engine (google.fr; google.uk; etc...). CNIL considered the measures took by the company insufficient to ensure the data protection rights of European citizens.
In this decision, the Conseil d'Etat stayed the proceedings and referred three questions to the European Court of Justice (ECJ). The first question is if a search engine, when implementing the ECJ's Google Spain decision, must delist the content from the results page from all its domains (.fr, .com, .uk, etc...), including those outside the European Union. In the case the answer to this question is negative, the Conseil d'Etat asks if the search engine should be obliged to delist the content from its European Union domains. Finally, the Conseil d'Etat asks if the search engine, when implementing a delisting request, should use a geo-blocking technology to prevent the results from showing up the results page of any user coming from the territory of the person requesting the delisting or, more generally, from any European Union territory, independently of the domain extension used to perform the search.
Mme C, M. F, M. H, M. D, F, Conseil d'Etat. February 24, 2017.
With this decision, the Conseil d'Etat refers to the ECJ questions about the implementation of the "right to be forgotten", based on four requests refused by Google, brought to CNIL and refused by the Commission, and then brought by the claimants to the Conseil.
The Conseil d'Etat seeks clarification on the interpretation of the Google Spain about the obligations of a search engine to delist search results pointing to web pages that contain sensistive data - as defined in the EU Directive 95/46/EU (the Data Protection Directive)
Deliberation No. 2016-054, CNIL, March 10, 2016
According to the French Data Protection Authority (CNIL), by the date of this deliberation Google has processed approximately 80,000 requests of French citizens to delist specific results from its search engine (right to be forgotten requests). The decision affirms the company delisted 51,5% of the requests. To address the complaints of French citizens who had their requests refused, CNIL launched an investigation on the company. Following the assessment of the complaints, CNIL requested Google to delist several results. According to the authority, "it was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com ...). As the delistings were carried out in European extensions, and not in extensions such as google.com or other non-European versions of the search engine, the president of CNIL issued a note to proceed (in May 21, 2015), ordering the company to comply with this determination in a period of 15 days, issuing a public communication about it in June 12, 2015.
Google appealed this decision, but the appeal was rejected by CNIL in September 16, 2015, with CNIL initiating a sanction procedure against Google in September 25.
Considering the right granted to individuals to erase inaccurate data (article 12 of the Directive) and to oppose, for legitimate reasons, the processing of their data (article 14 of the Directive), and taking into consideration the Google Spain decision in CJEU, CNIL argued that the Directive seeks to effectively protect the fundamental right to data protection, without circumvention. CNIL responded to Google's assertion that CNIL exceed its power by imposing a measure with extraterritorial effects by affirming that the search engine performs a single treatment of data, and not different treatments of data when the queries are made using different extensions.
The company also argued that the decision affected the sovereignty of foreign states and would violate the rights to freedom of information and freedom of expression. CNIL dismissed these claims by affirming that the right to oppose and erase is attached to the person and, when applied, must be effective without restriction. CNIL also stated delisting decisions are only taken after if the conditions specified in the Google Spain case were met, including the proportionality test designed to ensure the balance of data protection rights with those of access to information and freedom of expression.
Finally, CNIL considered that the use of the IP addresses (proposed by Google) to determine the delisting of results would be insufficient, as would allow the treatment of data from outside of the European Union and could be easily circumvented.
Taking all into consideration, CNIL imposed a fine of 100,000 (one hundred thousand euros) to Google. The company appealed the decision to the French Conseil d'Etat in May 19, 2016.
Please use this form to provide your feedback or suggest any amendments or updates to this page.