France’s data protection agency rejected Google’s appeal of its decision to require the search engine to apply Europe’s Right to Be Forgotten law to all Google domains worldwide.
Google has largely complied with Europe’s Right to be Forgotten laws since it was instituted in 2014, scrubbing its search results of links to Web pages that contain information about individuals, per their requests, that are damaging, irrelevant, or out of date, but only on European domains, such as Google.fr and Google.de, but not from Google.com or Google.co.jp.
In May, the Commission Nationale de l'Informatique et des Libertés (CNIL) ordered Google to apply the deletions to all of its domains worldwide, a decision Google appealed, citing principles of free speech. On Monday, CNIL dismissed the appeal, and Google could face a 150,000 euro fine if it refuses to cooperate.
“If this right was limited to some extensions, it could be easily circumvented: in order to find the delisted result, it would be sufficient to search on another extension (for example, searching in France using google.com),” CNIL said in a statement.
From May 2014 to Sept. 21, 2015, Google shows it has received about 318,000 requests for removals of individual search results. In deciding whether or not to fulfill the request, Google considers whether or not there’s a public interest in the information remaining.
Google gives examples of requests it has denied: A prominent businessman in Poland who wanted articles removed about his lawsuit against a newspaper; a media professional in the U.K. who requested the removal of four links to articles about embarrassing content he posted to the Internet.
Google does not provide a breakdown of how many of those requests are granted or denied, but an analysis of data obtained by the Guardian in July found that most requests are not granted.
If the request is for the removal of “private or personal information,” the applicant has a 46 percent success rate. The vast majority of these requests, about 95 percent, came from private citizens. In the four other categories—“serious crime,” “public figure,” “political,” or “child protection”—requests were granted less than 1 percent of the time.
In one instance cited by the Guardian, a doctor requested that Google remove links to 50 news articles that documents a botched operation. Google eventually deleted links to three of them because they included personal information on the doctor.
It’s not clear what Google will do next, although it offered a firm opposition to CNIL’s order in July. Peter Fleisher, Google’s global privacy counsel, wrote, “If the CNIL’s proposed approach were to be embraced as the standard for Internet regulation, we would find ourselves in a race to the bottom. In the end, the Internet would only be as free as the world’s least free place.”
In the scenario that Google refuses to apply the Right to be Forgotten rules globally, CNIL could impose another 150,000 euro ($167,759) penalty for the second violation, bringing it to the maximum of 300,000 euro that it can impose within five years.
The amount is a pittance for a company that generates $66 billion in annual revenue, but the European Union is on the verge of introducing new regulations that could raise the maximum amount of data protection sanctions up to 2 to 5 percent of a company’s global revenue, or more than $3 billion for Google.
“So what’s next? Google is unlikely to comply,” Paul Lanois, a technology lawyer who had previously taught in France, wrote via email. In terms of procedures, “If Google would like to appeal any possible sanctions, then depending on the sanctions imposed, it can file a petition for suspension (référé-suspension) ... or it can file a full-fledged appeal in order to overturn the CNIL’s decision (and of course Google may file for both).”
Were the new data protection regulations to be implemented, Google could face the dilemma of either complying with the Right to be Forgotten laws on all of its domains or, to avoid crackdowns on its offices in Europe, withdraw from the continent altogether, a costly endeavor since it had around 5,000 employees in Europe as of 2011. That year, then-CEO Eric Schmidt had announced a hiring spree of another 1,000.
