Google and CNIL clash on global right to be forgotten
A 15-judge Grand Chamber of the European Court of Justice today heard arguments in a case that will define the territorial scope of the right to be forgotten, as well as the question of whether search engines should automatically delist links that point their users to websites that contain sensitive personal data.
If the European Court of Justice sides with arguments made by the French government and France’s data protection authorities – known as CNIL – it could lead to European data watchdogs being able to order delisting not only within the EU’s territory, but across the world, affecting countries such as the US that lack the right to be forgotten.
The hearing today followed a pair of French cases referred to the ECJ by the Council of State, the country’s highest administrative court.
The reference relating to global delisting stemmed from CNIL ordering Google to delist links across each of its global domain names in 2015; it fined the company €100,000 in 2016 for its failure to follow the order.
The second case saw the Council of State refer questions up to the ECJ following appeals from four individuals known only as GC, AF, BH and ED; CNIL had agreed with Google’s decision not to delist links that pointed to sensitive personal data. The Council of State has asked the ECJ whether search engines should automatically comply with delisting requests if they involve sensitive personal data, instead of first going through Google Spain balancing exercises between data subject rights and the public interest.
Global right to be forgotten
Google counsel Patrice Spinosi, a partner at Spinosi Sureau in Paris, said CNIL’s proposed global delisting would unreasonably violate freedom of expression rights and create conflicts of law with other states that do not recognise the right to be forgotten.
He had earlier outlined how Google currently operates the right to be forgotten. In the immediate wake of Google Spain, in which the ECJ upheld the right to be forgotten, Google would dereference names from its country-specific domains, he said. For example, dereferencing requests from France would apply to Google.fr.
Spinosi said the company later set up a one-stop shop that would remove references for all its national sites with a single request. Following discussions with data protection authorities, the company added a geoblocking function in autumn 2017 that determined where internet users were searching from – using extra information such as their search history and location through GPS data – and withheld delisted links if they were from within the EU.
The Google lawyer said the current system correctly filters 99.94% of searches without undermining the sovereignty of other states. He urged the court not to call the current system into question, which was directly inspired by Google Spain.
CNIL lawyer Jean Lessi, however, said that the full effectiveness of the fundamental right to be delisted would only be protected properly with global bans. He said non-global delisting was unsatisfactory, with geoblocking not stopping links from appearing on searches made from outside the EU – potentially leading to links spreading again across different websites, and leading to more delisting requests.
Lessi said Google had chosen to target European citizens with its services, saying that the case was about the consequences of that choice and its decision to subject itself to EU law guaranteeing fundamental rights.
Lessi further criticised Google’s geoblocking solution by saying it did not guarantee the effective application of the law, and was easily evaded, for example by using virtual private networks or proxy servers. He said that an increasing number of internet users now use VPNs and proxy servers, and that the new generation will only use them more given the growing awareness about online tracking.
The CNIL lawyer also said that geoblocking that covers only the EU still allows data processing outside. He said that approach falls foul of the thinking behind the GDPR and Data Protection Directive, likening data transfers into the EU as entering a “bubble” that moves with data and ensures continuity of protection; limiting the scope of data protection rights at the borders of the EU would make the law a “dead letter”, he said.
Raphaël Coesme, a lawyer for the French government, said the GDPR corroborates the conclusion that applying the right to be forgotten outside the EU would fall within the territorial scope of the new regulation. He said the regulation applies to extraterritorial processing that relates to people located within the EU.
Lawyers for Microsoft and multiple journalism and freedom of expression groups today backed Google’s approach, warning that global delisting could harm freedom of expression around the world and incentivise authoritarian regimes to order search engines to cease indexing content.
Multiple parties before the ECJ – including France, Austria and the European Commission – urged the court not to hold that right to be forgotten requests involving sensitive personal data should automatically lead to delisting.
Ahead of the hearing, the ECJ had asked the parties whether search engines should systematically check for sensitive personal data before indexing it, effectively applying the right to be forgotten before any claims are made.
Louis Boré, counsel to the delisting requesters, dismissed Google’s argument that it would be technically impossible to automatically filter links that point to websites featuring sensitive personal data – such as criminal convictions. He said the company could use AI and algorithms to automatically spot links that point to such websites.
Contradicting arguments raised by journalism groups, Boré said that automatic halts to processing would actually help them, as users would be forced to research individuals directly through news websites, rather than search engines, leading to an increase in page views.
But Google’s lawyer Spinosi outlined two necessary steps to online search: automatic indexing of all pages on the internet; and answering user queries. He said that filtering measures can only be put into place at the second stage, stressing that no search engine has the human or technical resources to search and filter the internet for sensitive information.
Spinosi added that the activity would also have a chilling effect on journalists and other commentators, dissuading them from publishing their work online.
He added that Google Spain forces search engines and courts to carry out balancing exercises to decide whether to agree to delisting requests – pointing to several recent judgments, such as NT1 & NT2 v Google in England and ML and WW v Germany at the European Court of Human Rights, as having refused such requests. He said all of those judgments conformed to Google Spain, and that the GDPR codifies the ECJ case’s conclusion.
ECJ advocate-general Maciej Szpunar today said he would hand down his opinion in both the global dereferencing and automatic filtering referrals on 11 December.
Counsel to Google
Partner Patrice Spinosi in Paris is assisted by Yehudi Pelosi
William Maxwell in Bordeaux
Counsel to CNIL
Isabelle Falque-Pierrotin, Jean Lessi and Gwendal Le Grand in Paris
Counsel to GC, AF, BH and ED
Boré Bruneton Megret
Partner Louis Boré in Paris
Counsel to France
Counsel to the European Commission
European Commission’s Legal Service
Antoine Buchet, Herke Kranenborg and Daniele Nardi in Brussels
Counsel to Microsoft
Emmanuel Piwnica in Paris
Counsel to Ireland
Margaret Gray in Dublin
Counsel to the Wikimedia Foundation
Claire Rameix-Séguin in Paris
Counsel to the Reporters Committee for Freedom of the Press
Wilmer Cutler Pickering Hale and Dorr
Partners Frédéric Louis in Brussels, Martin Braun and Hans-Georg Kamann in Frankfurt and Patrick Carome, David Bowker and counsel Ari Holtzblatt in Washington, DC are assisted by Christian Schwedler
Counsel to Article 19
Gerry Facenna QC and Eric Metcalfe in London
Copyright © Law Business ResearchCompany Number: 03281866 VAT: GB 160 7529 10