CNIL orders Google to apply delisting on all domain names of the search engine
In its decision of 13 May 2014, the Court of Justice of the European Union has recognized the right to delisting. The exercise of this right results from the application of European data protection law to search engines, including Google. In practical terms, any individual who wants to see removed one or more results displayed following a search made on the basis of his/her name can make a request to a search engine. The search engine then reviews the request and grants it if the legal conditions are met. In case of refusal by the search engine to carry out the requested delisting, the individual can lodge a complaint with the data protection authority (in France, the CNIL), or the competent judicial authority in each Member State. In this respect, the CNIL received hundreds of complaints following Google’s refusals to carry out delisting on Internet links (or URL). Following the assessment of the complaints, the CNIL has requested Google to carry out the delisting of several results. It was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com …). Although the company has granted some of the requests, delisting was only carried out on European extensions of the search engine and not when searches are made from “google.com” or other non-European extensions. In accordance with the CJEU judgement, the CNIL considers that in order to be effective, delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing. In this context, the President of the CNIL has put Google on notice to proceed, within a period of fifteen (15) days, to the requested delisting on the whole data processing and thus on all extensions of the search engine. Considering the necessity to draw the attention of search engine providers and internet content publishers to the scope of the right to object and to obtain the erasure of personal data, the formal notice is made public. The CNIL recalls that the formal notice does not constitute a sanction. No further action will be taken if the company complies in all aspects and in the given period of time with the formal notice. If this is the case, the proceeding will be closed and this decision will also be made public. If Google Inc does not comply with the formal notice within the fifteen days the President will be in position to nominate a Rapporteur to draft a report recommending to the CNIL Select Committee (the Committee in charge of imposing sanctions in case of violation of the French data protection law) to impose a sanction to the company.