Skip to Content

Cybersecurity & Standards, European Policy, Free Expression

Google Appeals French Data Protection Authority’s Demand to Modify Search Results Worldwide

Today marked another salvo in the on-going battle over the “right to be forgotten”, with Google filing an appeal to the Conseil d’État of the fine levied by the French data protection authority against the company for failing to modify search results according to French law for searches conducted outside of France. CDT is glad to see Google push back against this expansive application of national law.

Two years ago, the Court of Justice of the European Union (CJEU) declared that, under the European Union’s Data Protection Directive, European citizens have a right to demand that search engines no longer return links to “inadequate, irrelevant or no longer relevant, or excessive” information in searches based on their names.  CDT was critical of this decision, which found that an individual’s right to privacy “override[s], as a general rule,” other internet users’ access to information.  The information at issue in the case, Google Spain v. Mario Costeja Gonzáles, was true information that had been published in a newspaper as required by Spanish law and then lawfully posted online. The CJEU’s decision in the Costeja case jeopardized a fundamental principle of the open Web: that it is unquestionably lawful to link to lawfully posted public information.

It is unquestionably lawful to link to lawfully posted public information.

Google, Bing, and other search engines that operate in Europe have since created processes by which EU citizens can submit requests to have specific links de-listed from searches based on their names. (These web pages are not removed from search engines’ indexes, so they may still show up in the results for other relevant queries.) Search engines assess these requests based on criteria they have developed and will reject requests that they judge to be out of scope or against the public interest.  Google reports that it rejects 57% of the requests it receives. News outlets, including the BBC, the Telegraph, and PinkNews, have reported on the de-listing of their own articles from certain search queries due to Costeja de-listing requests. Data protection authorities, demonstrating the pernicious potential for expansive interpretation of this ruling, have also ordered Google to remove links to such stories.

Since the 2014 CJEU decision, the primary point of contention between Google and the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), has been the scope of the search engine’s implementation of de-listing demands.  Initially, Google would de-list challenged results for an individual from the EU on all searches conducted on its EU member-state-specific domains, such as google.de or google.fr.  In March, under pressure and the threat of fines from the CNIL, Google announced that it would also return the modified search results for searches on any Google domain that was accessed from within the individual’s home country.  That is, if a French citizen asks Google to de-list a certain link and Google agrees, then anyone searching from a French IP address (the likeliest proxy for the searcher’s location) will not see that link in queries based on that French citizen’s name, across any version of the search engine, including google.com.

This is a radical expansion of the territorial effect of French law, and a theory of jurisdiction that is appropriately rejected in other contexts.

CDT raised concerns about even this expansion of the de-listing rule, because of the risk that such policies will legitimize demands from governments across the globe to insist that their censorship laws be applied whenever an online service is accessed from within their country.  But even this expanded application was not satisfactory to the CNIL, who fined Google €100,000 for failing to apply French de-listing demands to all searches conducted worldwide on Google’s services.

This demand from the CNIL is extreme.  Fundamentally, the CNIL is declaring jurisdiction over searches that happen entirely outside of France, by internet users who are not in France and processed on servers that are not in France.  CNIL is claiming jurisdiction over any search conducted about someone from France, regardless of whether any of the data processing related to the search actually occurs in France.  This is a radical expansion of the territorial effect of French law, and a theory of jurisdiction that is appropriately rejected in other contexts.

For example, Turkish law prohibits insults to the founder of the Turkish Republic, and the Turkish government routinely seeks to block websites that display such content.  But the fact that Turkey engages in this censorship does not justify placing restrictions on the ability of people outside the country, using services based outside the country, from accessing information that is critical of Atatürk. French politicians would likely (and rightly) reject demands that Turkish censorship laws should govern what information internet users in France should be permitted access.

Yet, this is the logic of the CNIL’s demand that French law govern all search results around the world.  Adopting such a standard for jurisdiction would erode protections for free expression and the right to seek information across the globe, as far more censorious governments would seek application of their laws to speech that occurs outside their borders. The Conseil d’État should accept Google’s appeal and reject the CNIL’s dangerous assertion of jurisdiction.