Google and France are at odds over the right to be forgotten, unsurprisingly. In previous posts, we discussed the right to be forgotten and its inherent tension between privacy rights and American freedom of the press and speech. We also covered the initial implementation of the right to be forgotten within Europe, focusing on implementation issues stemming from Google’s “local” removals that only apply to the EU, e.g., <<Google.fr>>, as opposed to removals from all of Google’s over 200 domains.
On September 21, 2015, France’s data protection authority, CNIL (Commission Nationale de L’informatique et des Libertés), rejected Google’s informal appeal of CNIL’s formal notice requesting Google to apply delisting on all of its domain names, e.g., <<Google.com>>, <<Google.fr>> (France), and <<Google.com.mx>> (Mexico).
The Right to Be Forgotten
The right to be forgotten is the right of individuals to have personal information removed from the internet that they find embarrassing, harmful, or potentially stigmatizing. As of May, 2014, the EU Court of Justice (ECJ) legitimized this right and ruled that European domiciliaries who want to remove search results displayed following a search of their name can make a request to a search engine to remove them. The search engine then reviews the request and grants it if all three legal conditions are met, which are:
- Inadequacy; and
- Irrelevance or excessiveness for the purpose of the data-processing.
If the request is granted, the website hosting the link will still be available, all that changes is that the link will no longer appear in search results based on the requester’s name. For example, searching Sophie DuBois on Google won’t return results about her hypothetical sensational drunk driving accident, but searching “drunk driving Fabergé egg travesty” will turn up the same would-be article.
In July of 2015, Google released its first Transparency Report for the de-listing requests. At the time, around 41% of requested links were removed, mostly dealing with things such as overturned convictions, victims of crimes, and sites showing private addresses or personal information that may be used in “doxxing” attacks. On the other hand, de-listing requests about old or current criminal convictions, official government documents, and information in the public interest were denied. Google’s primary concern as a search engine is access to information, which is why it considers whether something qualifies as “political speech” before deciding whether to remove it. To be clear, all search engines are subject to the ECJ’s ruling, it’s just that Google, as the most widely used search engine globally, gets most of the heat.
After receiving CNIL’s formal global de-listing notice, Google’s Global Privacy Counsel released a statement on its “Europe Blog” listing possible extensions to the right to be forgotten ending with unjustifiable global censorship, should Google be forced to comply. Although some may decry this as melodramatic, Google is correct in that extra-territorial enforcement of the right to be forgotten could indeed cause a chilling effect for speech on the web. Google described CNIL’s approach as a “race to the bottom” where “the Internet would only be as free as the world’s least free place.” Less sensationally, but just as interesting, Google pointed out that around 97% of French internet users access a European version of Google’s search engine, bolstering Google’s claim that the order is “disproportionate and unnecessary.”
If these figures hold true and can be extended to most of Europe, Google makes a good point. After all, the right to be forgotten arose out of the harm that came to people through a casual search of their name online. It is undisputed that no actual websites will be taken down, and a thorough search using more creative terms than a mere name will still turn up information about specific individuals. Thus, if the overwhelming majority of EU searches are done through regional domains, it makes little sense to force Google to extend its de-listing protocols across all of its domains.
CNIL was not persuaded by Google’s claims of “censorship,” and listed five reasons it would not withdraw its order. CNIL found that (1) the ECJ judgement required de-listing implementation across all extensions, and geographical extensions are merely “paths giving access to the processing operation;” (2) the easy circumvention that stems from limiting the order to geographic extensions effectually strips away the efficiency of the right, causing “variable rights” for individuals based upon the searching party rather than the “data subject;” (3) there is no censorship because “the right to delisting never leads to deletion of the information on the internet;” (4) the right to be forgotten is not absolute, it must be “reconciled with the public’s right to information, in particular when the data subject is a public person, under the double supervision of the CNIL and of the court;” and (5) the CNIL decision “does not show any willingness. . . to apply French law extraterritorially,” rather it “simply requests full observance of European legislation by non European [sic] players offering their services in Europe.” If Google refuses to comply, it may face sanctions in the form of a onetime payment of up to $340,000, though how much that affects a company that made $13.7 billion in profits last year is yet to be seen.
CNIL will probably issue sanctions and fine Google, which under incoming European regulations could increase the fine to between 2% and 5% of its global operating costs, something likely more effective than CNIL’s current figures. Regardless, once the fine is levied, Google may appeal both the decision and fine with the French Supreme Court for administrative justice, the Conseil d’Etat. Google seems unlikely to back down willingly, and certainly has the means to fight this decision all the way to the top. Even if France goes hardcore and blocks non‑regional variants of Google, similar to China blocking Facebook, this still doesn’t fix the problem. One of CNIL’s reasons for global delisting was its easy circumvention when applied regionally, but even blocking a website may be easily circumvented by using a VPN (Virtual Private Network). A VPN allows users to securely access a private network and share data remotely through public networks, similar to how a firewall protects the data on your computer, except a VPN protects it online. Furthermore, VPNs allow users to fake their physical location, for example, someone in China saying they live in Chicago so they can have a Facebook.
The right to be forgotten is an excellent example of how traditional notions of privacy are tested in the internet age. Google certainly seems to think that access of information and freedom of speech take precedence, but inside of Europe, the jury is still out.