IP & IT analysis: Could Google's willingness to engage with the right to be forgotten be eroded by continuous challenges from national regulators? Will Richmond-Coggan, a partner and solicitor-advocate at Pitmans LLP, considers the decision in Google v CNIL, in which the French data regulator rejected Google's appeal. This article was first published on Lexis®PSL In-House Advisor on 1 October 2015.

Original news 

Google informal appeal rejected 

The Commission Nationale de l'Informatique et des Libertés (CNIL) has rejected Google's informal appeal against the notice requesting Google to apply delisting to all domain names. 

What is this case about and why is it significant? 

This is the latest in a string of national-level decisions, which have arrived on the back of the now well-known case of Google Spain SL and another company v Agencia Espanola de proteccion de Datos (AEPD) and another: C-131/12 [2014] All ER (D) 124 (May), a decision of the Court of Justice of the European Union (CJEU) in connection with the so-called 'right to be forgotten'. Just as the AEPD is the Spanish data regulator (equivalent to the English Information Commissioner), so CNIL is the comparable French body. That body has decided that, in light of the Google Spain decision and the emerging European jurisprudence generally on the right to be forgotten, Google does not meet its obligations under that right simply by removing links to the relevant data from the results produced by the specific domestic search engine of the territory concerned. Instead, Google has been ordered to remove the results from every search result returned by each search engine it operates on a global basis. Such an approach, if adopted at the level of the French courts, or indeed at a European level, would obviously be highly significant in asserting the right to be forgotten on an extra-territorial basis, and specifically in relation to jurisdictions (such as the US) which do not recognise the concept. 

What was decided and why? Does the decision clarify the law in this area? 

It is important to bear in mind that the present decision is the result of an informal appeal by Google against the CNIL's original conclusions. That appeal was to the president of the CNIL, and so the decision itself does not have the effect of creating any binding judicial precedent within France, let alone more widely. What will happen next, in the event that Google does not comply with the decisions, is that monetary sanctions will be imposed on it. Google will then be able to challenge not only the sanctions, but also the basis of the decision to impose them, before the French courts. While it is to be hoped that that process will ultimately lead to greater clarity in the law, the present decision has only underscored the uncertainty which multi-national firms operating in the internet space must confront when engaging with European data regulatory authorities. 

What is this decision likely to mean on a practical level? 

For the reasons explained above, the practical effect of this decision will probably be confined to Google itself, which must negotiate the CNIL's sanctions regime and, presumably, embark on what is likely to be a protracted further series of cases in the domestic French and ultimately the European courts. Equally, though, other operators of search engines and online databases which operate internationally would be well advised to consider the extent to which they would be able to implement the effect of this ruling by the removal of results on a global basis, in the event that this decision is ultimately reflected in a ruling at European level.

What could it mean for the law in the UK and in Europe? 

The effect on the law, if any, will be seen as this case progresses through the various tiers of the French judicial system and, perhaps, ultimately to the CJEU. It should be borne in mind, however, that the General Data Protection Regulation (GDPR) which is due to come into force at the end of 2015 is also likely to make enhanced provision for the enforcement of the right to be forgotten, and the implications of the GDPR may well supersede any specific effects from the outcome of this individual dispute. 

What does this mean for lawyers and their clients? 

With the exception of Google itself, and its legal team, there are no immediate implications, but this is certainly a developing case which lawyers with clients that operate in this area should watch very carefully. For other applicants in other jurisdiction, it may certainly be a precedent (albeit a non-binding one) which they might want to draw to the data regulator's attention in their own jurisdiction, in an attempt to secure an equivalent outcome 

How does all this fit in with other developments in this area? 

As explained above, it is likely that the GDPR will have much more wide-ranging implications for the right to be forgotten and its enforcement--the effects of that regulation, once enacted, will be much more immediately felt. Regrettably, one of the effects may well be that Google's willingness proactively to engage with right to be forgotten requests may well be eroded if further decisions of this type are made--since the effect of them, if upheld, would be to vastly increase the burden on that business in terms of the work needed to give effect to any legitimate right to be forgotten that might be identified.