31 July 2015 – Google is appealing an order from the French data protection authority to apply the “right to be forgotten” on a global basis, the company said yesterday.
The Commission nationale de l’informatique et des libertés (CNIL) said in June that, when Google receives requests for the delisting of personal information from its search results, it should remove links to that information from all its sites around the world, including google.com. Google accordingly only removes those links on its European domains, but CNIL wants the links to disappear from all the others too, including google.com. Its reasoning is that geographically limited delistings are too easy to circumvent.
The search giant currently only removes such results from its European domains, as the “right to be forgotten” stems from a ruling by Europe’s highest court.
Google has now formally asked CNIL to withdraw its order for global delisting.
Said Peter Fleischer, Google’s global privacy chief, in an official statement:
“We’ve worked hard to implement the right to be forgotten ruling thoughtfully and comprehensively in Europe, and we’ll continue to do so. But as a matter of principle, we respectfully disagree with the idea that a national data protection authority can assert global authority to control the content that people can access around the world.”
The Court of Justice of the European Union ruled in May 2014 that EU-wide privacy legislation applies to foreign search engines operating in the region. It said search engines must take down links to information that is “inaccurate, inadequate, irrelevant or excessive” upon request, as long as there are no good reasons to keep them in its results.
Google went on to comply with the ruling, though a dispute remained between the firm and privacy regulators over the scope of the delinking.
Internet regulation is inherently complicated by the fact that the Internet does not naturally respect national borders. This leads to a tension between those who want to see national laws respected in the countries where they apply, and those who see international enforcement as the only way to make that happen.
While it is relatively easy to apply rules to country-specific versions of a website, such as those with addresses ending in Germany’s “.de” or France’s “.fr,” there is nothing to stop people visiting other versions of the site to find missing information.
The Article 29 Working Party, the umbrella group for EU data protection regulators, wrote in November that “limiting delisting to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient mean to satisfactorily guarantee the [privacy] rights of data subjects.”
This stance was the basis for CNIL’s order in June, which came with the threat of a fine of up to €150,000 for non-compliance.
However, a Google-convened panel of privacy experts said in February that the rights of EU citizens had to be balanced with those of people in other countries, who may have the right to see the offending information under their own national laws.
Americans accessing google.com, for example, live in a country whose legal system broadly prioritizes freedom of speech over the right to privacy.
Google built on this theme on Thursday, arguing that global delisting would risk a “chilling effect” on the web as many countries around the world have their own national speech restrictions.
The firm cited several national examples: Turkey criminalizes some criticisms of Kemal Ataturk; Thailand does the same for its royalty; and Russians are banned from disseminating “gay propaganda” online.
And Fleischer … not happy with his “official” statement said in his personal blog post “If the CNIL’s proposed approach were to be embraced as the standard for Internet regulation, we would find ourselves in a race to the bottom. In the end, the Internet would only be as free as the world’s least free place.”
CNIL said it had received Google’s appeal and would “look at the arguments,” though it claimed those arguments were “in part political” whereas its own reasoning was “strictly legal.”
CNIL added that it would respond within two months.
