The Danish DPA issued a guide on the procedure for exercise of the “right to be forgotten” – or more accurately, the procedure for having a person’s name removed from search engine results, as based upon the European Court of Justice’s judgement against Google Spain and Google Inc. This includes the criteria used by the DPA in assessing these cases.
CNIL announced on March 10, 2016 that it was ordering a 100 000 euros fine against Google. The fine was ordered for violation of data subjects’ rights to object to the processing of their personal data and their right to delete their personal data, as interpreted by the Court of Justice of the European (Google Spain decision of July 2014). The Court stated the obligation for Google to remove inadequate or irrelevant information from web results appearing under searches for people’s names. Google appealed on 19 May 2014 the order for the CNIL to remove certain web search results globally.
Background of the case:
After the Google decision in 2014, Google created a procedure for submitting removal requests. If a removal request was accepted, Google decided to remove links from search results on all EU Google Search domains. For instance, if Google approved a request from a Spanish national, the inappropriate link would not be available in search results from google.es or from searches executed from any other EU domain (google.fr, google.co.uk,…). In March 2016, Google announced that it would “use geolocation signals (like IP addresses) to restrict access to the delisted URL on all Google Search domains, including google.com, when accessed from the country of the person requesting the removal.” For instance, if Google delist a URL as a result of a request from Pierre Dupont in France, users in France would not see the URL in search results for queries comprising “Pierre Dupont” when searching on any Google Search domain (including google.com). Users outside France could see the URL in search results when they look for “Pierre Dupont” on any non-European Google Search domain.
On 10th March 2016, the French data protection authority (CNIL) issued the Decision no. 2016-054 in which it fined Google Inc. €100,000 for failing to properly implement the so-called “right to be forgotten”.
The decision is based on the Judgment of the Court of Justice of the European Union (“ECJ”) in Costeja v. Google which stated that internet users residing in Europe could ask search engines to delist their personal data. Those whose request to delist Internet links on the “Google Search” engine had been turned down lodged a complaint with the CNIL and after a investigation, Google was asked to delist several results.
In some requests, Google carried out the delisting only on the search engine’s European geographic extensions and therefore, the delisted content in France remained accessible in other non-European countries. In May 2015, the CNIL issued a formal order to the company to extend delisting to all of the extensions since the Chair considered that delisting must be carried out on all of the extensions under the CJEU ruling.
Google stated that a global delisting would disproportionately undermine the freedom of expression and information.
The CNIL answered that the commitment of its decision is to guarantee effective and complete protection of data subjects and sanctions procedure against the company was initiated.
On 15 October 2015, the Spanish Supreme Court handed down its first ruling which applied the so-called “right to be forgotten” to internet search engines but expanding to editors. It stated that detrimental information affecting individuals without public relevance should not be accessible to Internet search engines when the news has lost relevance over a considerable period of time.
The background of the case
In 1985, a prestigious national newspaper published a new in paper version about two people who were arrested on drug trafficking and drug use charges. In 2009, when these persons had already served their time and had their criminal records erased, details about their arrest, their imprisonment and other personal information could still be found on the top links led to those old newspaper stories.
The claimants asked the newspaper to completely remove information relating to their conviction and imprisonment from the defendant’s digital archives and to adopt the necessary measures to ensure that the story no longer showed up in online search results.
Spain’s highest court rejected a petition by claimants to eliminate their whole harmful information from its online. The Court, however, ordered that the defendant´s were responsible for ensuring that the personal information couldn’t be easily accessed through online search engines.