The President of the French data protection authority (the “CNIL”), Isabelle Falque-Pierrotin, rejected Google Inc.’s appeal of the CNIL’s formal cease and desist ordering Google Inc. to delist links from all Google extensions globally when granting “right to be forgotten” requests.

Ever since the landmark decision Costeja v. Google of May 13, 2014, rendered by the Court of Justice of the European Union (ECJ) and establishing a “right to be forgotten” that entitles Europeans to ask search engines to delist certain links from results based on searches for Europeans’ names, the territorial scope of the right to be forgotten has been a recurrent issue between the Mountain View, California firm and EU regulators (see previous posts herehere and here).

Until now, Google Inc. has always adopted a compromise approach, de-indexing links from all the European Union domains, as well as from the Icelandic, Lichtenstein, Norwegian and Swiss domains, regardless of the country of origin of the request.

However, this status quo could now change.

On May 21, 2015, the CNIL issued a cease and desist to Google Inc., ordering it to de-index, within 15 days, the entirety of Google’s indexing services and thus all extensions of the search engine (see previous post here).

Google Inc. appealed this order in July, arguing that “while the right to be forgotten may now be the law in Europe, it is not the law globally” and that “there are innumerable examples around the world where content that is declared illegal under the laws of one country, would be deemed legal in others”. Google Inc. also denounced the risk of censorship and the fact that “this order is disproportionate and unnecessary, given that the overwhelming majority of French internet users—currently around 97%—access a European version of Google’s search engine like google.fr, rather than Google.com or any other version of Google”.

On September 21, 2015, the CNIL rejected Google Inc.’s appeal, notably on the following grounds:

  • The various geographic extensions are simple means of access to the processing. Therefore, if the search engine agrees to delist a result, it must do it on all the extensions, in compliance with the ECJ’s decision;
  • If the right to be forgotten were limited to certain extensions, it could be easily circumvented. Indeed, it would be possible to retrieve a delisted result by simply using another extension (i.e., another means of access), such as .com, thereby depriving the right to be forgotten of its effectiveness;
  • In any case, de-indexing a link does not entail the deletion of the underlying information, but only prevents its listing in the results showed based on searches for a person’s name. Therefore, the information remains available;
  • The right to be forgotten is not absolute and must be balanced against the public’s right to information, in particular when the individual concerned plays a role in public life;
  • Finally, the CNIL does not seek to apply French law abroad, but seeks to ensure that non-European service providers operating in Europe comply with EU laws.

The CNIL’s order is now final and Google Inc. can no longer challenge the regulator’s position. If Google Inc. fails to comply with the order, the CNIL’s Sanctions Committee could order administrative sanctions, including financial penalties, which Google Inc. could appeal to administrative courts. In addition, Google Inc. could face criminal prosecution.