Google has rejected the French data protection authority’s demand that it censor search results worldwide in order to comply with the European Court of Justice’s so-called right to be forgotten ruling.
The company’s rejection of the ruling could see its French subsidiary facing daily fines, although no explicit sanction has yet been declared.
The ruling, made in May 2014, requires the search engine to remove links to pages that “appear to be inadequate, irrelevant or no longer relevant or excessive … in the light of the time that had elapsed”. Even accurate data that has been lawfully published initially can, the court said, “in the course of time become incompatible with the directive”.
Google grudgingly acquiesced to the ruling, which was based on a case brought by a Spanish man who wanted to remove an auction notice of his repossessed home dating from 1998, and started to take requests from the public for links to be removed from European domains soon after.
As of March 2015, the company had received nearly 220,000 requests to remove links to online information, including many high-profile requests from criminals, politicians and public figures, and slightly less than half of the request have been granted. But figures obtained by the Guardian show that more than 95% of the requests come from everyday members of the public.
In September 2014, a Parisian court went a step further than the original ruling and ordered Google to remove links from its entire global network if they violate the right to be forgotten. In November 2014, it threatened the company with daily €1,000 fines if it didn’t comply.
Then, in June 2015, the French national data protection authority, CNIL, stepped in and made the same demand, ordering Google to apply delisting on all versions of its search engine. The authority’s rationale is that removing links just from the French, or even European, versions of Google’s websites does not sufficiently protect the right to be forgotten, since readers can still go to Google.com, the company’s American site, and find unexpurgated results. This works even within European countries.
CNIL said that “in accordance with the CJEU (European court of justice) judgement, the CNIL considers that in order to be effective, delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing”.
The company was given 15 days to comply, but Google has today said it will not be doing so. A spokesperson said: “We’ve worked hard to implement the right to be forgotten ruling thoughtfully and comprehensively in Europe, and we’ll continue to do so. But as a matter of principle, we respectfully disagree with the idea that a national data protection authority can assert global authority to control the content that people can access around the world.”
In a blogpost, Peter Fleischer, Google’s Global Privacy Counsel, said: “We believe this order is disproportionate and unnecessary, given that the overwhelming majority of French internet users – currently around 97% – access a European version of Google’s search engine like google.fr, rather than Google.com or any other version of Google.”
Additionally, Fleischer added, the company is concerned that complying with the French courts could potentially set a precedent that one country’s laws can control access to content globally. “There are innumerable examples around the world where content that is declared illegal under the laws of one country, would be deemed legal in others: Thailand criminalises some speech that is critical of its King, Turkey criminalises some speech that is critical of Ataturk, and Russia outlaws some speech that is deemed to be ‘gay propaganda’.
“If the CNIL’s proposed approach were to be embraced as the standard for internet regulation, we would find ourselves in a race to the bottom. In the end, the internet would only be as free as the world’s least free place.”
Google’s difficulties are just the latest example of a major web firm struggling to deal with the practicalities of offering the same service across a number of different nations. Facebook has been sparring with European data protection authorities for several years over whether it is sufficient to comply by the rules of Ireland, where its European subsidiary is based, or if it has to abide by every individual European nation’s regulations.
Most recently, Facebook was ordered by a German regulator to relax its real-name policy. Directly addressing the issue of jurisdiction, the German regulator told the firm “if you like our game, you must play by our rules”.
This article was written by Alex Hern, for theguardian.com on Thursday 30th July 2015 17.00 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010