French privacy regulator Commission Nationale de l'Informatique et des Libertés (CNIL) has rebuffed Google's appeal to withdraw an order that requires the search firm to apply right to be forgotten requests across its global websites.
The CNIL formally announced its unsurprising decision in a statement, which says that if Google limited the right to be forgotten removals on its French website, Google.fr, the law could be easily circumvented by simply searching on Google.com. The agency also denies a Google assertion that it wishes to enforce French laws on international territories.
"Contrary to what Google has stated, the decision does not show any willingness on the part of the CNIL to apply French law extraterritorially," says the agency. "It simply requests full observance of European legislation by non-European players offering their services in Europe."
In late July, Google's Global Privacy Counsel Peter Fleischer wrote in a blog post that Google disagreed with the CNIL's ruling to remove all right to be forgotten links across all Google's websites, saying that doing so "risks serious chilling effects on the web." Fleischer also said the ruling was unnecessary, since 97 percent of all Google French users use Google.fr.
"If the CNIL's proposed approach were to be embraced as the standard for Internet regulation, we would find ourselves in a race to the bottom," wrote Fleischer. "In the end, the Internet would only be as free as the world's least free place."
Google is required to comply with the CNIL's ruling to delist all right to be forgotten requests globally. Otherwise, it risks paying a fine of up to 150,000 euros (approximately $169,000) in fines and up to 300,000 euros (approximately $337,000) for repeat offenses, according to Reuters.
The fine may be a drop in the bucket for Google, but a new law may increase the fine by up to 5 percent of the company's operating costs, which can significantly impact its operations. Under the current process, Google may no longer make an appeal to the CNIL, but it can ask the Conseil d'Etat, the French Supreme Court for administrative justice, to take up its case.
The CNIL is the first European data protection regulator to officially sanction Google for failing to comply with delisting right to be forgotten requests across all domains. However, the European Union has already expressed its own stance on the matter, saying that requests must be delisted globally to ensure that citizens cannot circumvent the law.
