What does this cover?

The French data protection regulator, the Commission Nationale de l’Informatique et des Libertés (CNIL) (theRegulator) has refused Google's appeal against a  'right to be forgotten' privacy case brought against Google by the Regulator in July this year.

The case concerns the rule established in the Google Spain case, which established that individuals in the EU have the right to be removed from search engine results that may impact their privacy. The Regulator insists that Google is obliged to apply the rule established in Google Spain at a global level, and not only for search engines used by individuals within the EU.

Google appealed on the grounds that neither the Regulator nor the CJEU have a right to impose the rule outside the EU. This has been rejected by the Regulator, and consequently Google must comply with the Regulator's order requiring the removal of thousands of listings from non-EU domains by May 2016. Google awaits the Regulator's decision over fines and potential sanctions. Once these are announced, Google can then submit an appeal to the French Supreme Court.

To view the statement from CNIL, please click here.

What action could be taken to manage risks that may arise from this development?

The Regulator's decision does not create a binding legal precedent in relation to the territorial application of the right to be forgotten.

However, companies should monitor developments as the case progresses through the French courts. It is hoped this will bring clarity to the law in this area (which is also likely to be addressed in more detail in the GDPR).