Right to be forgotten. Does Google delist search results from Google searches worldwide or only from European Google searches?
The purpose of this article is to update our clients on the latest position in relation to successful Right to be Forgotten applications and the current position regarding the removal of search results from Google worldwide.
Following the Google Spain decision in 2014, Google started to remove offending links under a Right to be Forgotten from Google searches but only from the applicant’s own country. So a successful Right to be Forgotten application made by a UK citizen would have resulted only in the removal of links to offending pages from Google.co.uk. This was highly unsatisfactory so law firms, including Cohen Davis Solicitors, had made repeated complaints to the Information Commissioner's Office until early in 2015 Google undertook to have offending search results under a Right to be Forgotten removed from all European searches.
Google, we must note, had not fully kept its promise to remove searches from across Europe which means often it has to be nagged at and threatened with legal action before it removes links to offending pages from European search results. By European we mean countries that are members of the European Economic Area and which include Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the UK.
This situation was still unsatisfactory because users in these countries who searched Google.com were still able to view the links to the offending webpages on Google.com search engine. This again, resulted in complaints from Cohen Davis Solicitors and from other law firms across the EEA.
A breakthrough was made in June 2015 after the super active Commission nationale de l'informatique et des libertés (CNIL), which is the French equivalent of our Information Commissioner's Office, issued Google with a formal enforcement notice, telling Google that it had to include all Google search engine extensions in the delisting process following each successful Right to be Forgotten application. Google appealed but its appeal was rejected so in September 2015 CNIL issued Google with another formal Notice that had the power of an injunction.
It ordered Google to delist, across the board, 21 search results in relation to a French citizen who made a successful Right to be Forgotten application. The Notice stated that the protection under the Right to be Forgotten must apply to all European residents with no possible circumvention. Circumvention means, that Google users can get around the filters Google applies and still see offending search results by using all sorts of technical methods.
Google ignored the Notice and refused to delist the offending search results globally. It wrote to the French data protection regulator saying that the Notice it was issued with was unlawful and that global delisting of search results under the European Right to be Forgotten would represent disproportionate attack on freedom of expression and information. Google representations were rejected. Still, Google refused to apply the Right to be Forgotten globally. Instead, it started to delist offending search results based on IP addresses rather than Google search engine extensions.
So, if you search from a device with a European IP address, offending search results will be hidden from you from all Google search extensions but if your device has an IP address which is outside the EEA, then the offending search results will still show. In short, Google changed the way delisting works by moving away from search extension search results delivery (Google.com or Google.co.uk) to an IP address based delivery. This means that you can search any Google search extension you may, if your device delivers an IP address from the EEA, the offending search results will be hidden.
This presented an issue in relation to individuals who live close to a border between an EEA and a none EEA country who might get mixed results based on the IP address their device uses to carry out the Google search. The French data protection regulator noted this was an improvement in Google’s method of delisting offending search results yet it said that IP address geolocation criterion, which varies the protection given to a European resident according to the geographical location of the individual using the search engine, is, on principle, unsatisfactory insofar as, the delisted information remains accessible to all internet users outside the territory affected by the new filter measure, which can in any event be circumvented by any affected users.
It went as far as to state that only a measure that applies to all processing by the search engine, with no distinction between the extensions used and the geographical location of the internet user making a search, is legally adequate to meet the requirement under the Right to be Forgotten. In light of the repeated violations by Google, the French data protection regulator issued Google with a penalty of 100,000 Euros. Google appealed to France’s highest court, the Council of State (Conseil d’État). A decision in the case is expected by the end of 2017.
Google’s current position is that it will not delist search results from all its search engine extensions as a matter of course. The French data protection regulator’s position is that it must do so. So we are all waiting for the outcome of the appeal.
Cohen Davis’ position is that any data, which is found to be unlawfully processed anywhere in the EEA and which is resulting in delisting of search results under the Right to be Forgotten, must not then be processed outside of the EEA.
This is because under European data protection laws, any organisation that transfers personal data to a country outside of the EEA, must do so under the same conditions of processing which applies to processing of the same data within the EEA.
So, if processing of personal data is unlawful within the EEA, it must also be unlawful from outside of the EEA. Under European data protection law, the emphasis is on the data subject (the individual subject the data which is being processed) so the location of the person who carries out the internet search is irrelevant. This, we note has not been an argument in the French case but we expect European transfer of data regulations to form part of Google's obligations in delisting search results from Google worldwide.
Follow us on Twitter and we will let you know as soon as the court reaches a decision.