The French regulator has rejected Google's request to drop a right-to-be-forgotten case.
The right to be forgotten is a concept introduced by the European Court of Justice via its controversial ruling back in May 2014 against Google in Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12) where the ECJ ruled that individuals in Europe have the right to have search engines results removed where they affect their privacy rights. The French regulator, Commission Nationale de l’Informatique et des Libertés (CNIL), has claimed that the search engine is compelled to apply the new rule globally, not just to its search engines intended for audiences in the European Union (EU). It opened a case against Google in July 2015 which Google subsequently appealed. Google argued in its appeal that neither CNIL nor the European Court of Justice, had a right to demand that the rule be applied outside of EU borders. CNIL, however, has argued that all search results relating to an EU citizen should be de-linked from Google's search engine if the company agrees to such a request. This ruling falls in line with the recent tensions surrounding the Safe Harbouragreement and transfer of data between the EU and the US. CNIL has rejected Google's appeal, which means that Google must comply with the order by May 2016 and remove thousands of delistings from non-European domains.
Under French law Google cannot appeal the order and it is highly likely that Google will face a fine and possible sanctions from CNIL. Google can appeal to the French Supreme Court once the decision on the fines to be imposed has been finalised. Google has stated that it does not believe the French regulator has the authority to extend the scope of the ECJ's ruling and that it is acting ultra vires. It can be seen that both sides are vehemently fighting to set a precedent. CNIL and many other European regulators have argued that by the nature of Google's search engine capabilities, private information on individuals in Europe can be easily found in search results. At present this is still the case and this undermines the ECJ's ruling and the right to be forgotten which is now enshrined into EU Law. How this case will sit with the results of the Safe Harbour judgment will be of interest in the battle to protect European data and privacy rights.