Deliberation No. 2016-054, CNIL

Document type
Administrative Decision
Country

According to the French Data Protection Authority (CNIL), by the date of this deliberation Google has processed approximately 80,000 requests of French citizens to delist specific results from its search engine (right to be forgotten requests). The decision affirms the company delisted 51,5% of the requests. To address the complaints of French citizens who had their requests refused, CNIL launched an investigation on the company. Following the assessment of the complaints, CNIL requested Google to delist several results. According to the authority, "it was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com ...). As the delistings were carried out in European extensions, and not in extensions such as google.com or other non-European versions of the search engine, the president of CNIL issued a note to proceed (in May 21, 2015), ordering the company to comply with this determination in a period of 15 days, issuing a public communication about it in June 12, 2015. 

Google appealed this decision, but the appeal was rejected by CNIL in September 16, 2015, with CNIL initiating a sanction procedure against Google in September 25.

Considering the right granted to individuals to erase inaccurate data (article 12 of the Directive) and to oppose, for legitimate reasons, the processing of their data (article 14 of the Directive), and taking into consideration the Google Spain decision in CJEU, CNIL argued that the Directive seeks to effectively protect the fundamental right to data protection, without circumvention. CNIL responded to Google's assertion that CNIL exceed its power by imposing a measure with extraterritorial effects by affirming that the search engine performs a single treatment of data, and not different treatments of data when the queries are made using different extensions.

The company also argued that the decision affected the sovereignty of foreign states and would violate the rights to freedom of information and freedom of expression. CNIL dismissed these claims by affirming that the right to oppose and erase is attached to the person and, when applied, must be effective without restriction. CNIL also stated delisting decisions are only taken after if the conditions specified in the Google Spain case were met, including the proportionality test designed to ensure the balance of data protection rights with those of access to information and freedom of expression.

Finally, CNIL considered that the use of the IP addresses (proposed by Google) to determine the delisting of results would be insufficient, as would allow the treatment of data from outside of the European Union and could be easily circumvented.

Taking all into consideration, CNIL imposed a fine of 100,000 (one hundred thousand euros) to Google. The company appealed the decision to the French Conseil d'Etat in May 19, 2016.

Country
Topic, claim, or defense
Privacy or Data Protection
Right to Be Forgotten
Jurisdiction
Document type
Administrative Decision
Issuing entity
Administrative Authority
Type of service provider
Search Engine or Index
Issues addressed
Limitation on Scope of Compliance (Geographic, Temporal, etc.)
OSP obligation considered
Block or Remove
Type of law
Civil
Administrative
General effect on immunity
Weakens Immunity