GOOGLE v. CNIL – French Highest Administrative Court limits the scope of the right to be forgotten to the territory of the EU

On 27 March 2020, the Highest Administrative Court in France ("Conseil d'Etat", hereinafter the "French Court") issued a much-awaited ruling on the right to be forgotten, which marks the end of a long, legal battle between the French data protection authority ("CNIL") and Google regarding the territorial scope of the right to be forgotten under European law.
 
As a reminder, the right to be forgotten (or right to "de-referencing") enables a natural person to request the operator of a search engine to remove links to web pages from the list of results prompted by a search query conducted on the basis of that person's name.

The ruling of the French Court is the outcome of a legal dispute opposing Google to the CNIL that was played in three acts.

 

1. Act 1: CNIL imposes a 100 000 euro  fine on Google

Google was initially fined by the CNIL 100 000 euro for refusing to de-reference the results pertaining to several individuals globally on all its search engine’s domain name extensions.

Following this sanction, Google filed an appeal before the French Court on the grounds that the right to de-referencing as it is currently established under European Union ("EU") data protection law is limited to the territory of the EU and Google therefore cannot be forced to remove the search results globally on all its domain names extensions. Following this appeal, the French Court decided to submit some preliminary questions to the Court of Justice of the European Union ("CJEU").
 

2. Act 2: the CJEU clarifies the territorial scope of the right to de-referencing

In September 2019, the CJEU ruled that the right to de-referencing, as currently provided for under EU data protection laws, only applies within the territory of the EU, and therefore does not apply globally[1].

Interestingly though, the CJEU also specified that the right to obtain a global de-referencing is not in itself prohibited but is currently not provided for under EU data protection laws. Consequently, the competent national courts or data protection authorities may order such global dereferencing based on their applicable national laws, provided that they strike a fair balance between the individual's right to de-referencing and the public's right to information and freedom of expression.

Taking note[2] of the CJEU's ruling, the CNIL interpreted this to mean that, when justified for the purpose of protecting an individual's right to obtain de-referencing, a data protection authority is therefore competent to order a search engine to de-reference the disputed results pertaining to such individual on all versions of its engine globally.
 

3. Act 3: the French Court implements the CJEU's ruling under French law

On 27 March 2020, the French Court finally annulled the CNIL's sanction on Google.

The French Court ruled that the CNIL had misinterpreted the law by considering that only a global de-referencing could satisfy the requirements established under EU data protection law. In other words, the right of the individual to obtain de-referencing may be satisfied by ordering a search engine to execute such de-referencing within the EU only. As a result, the CNIL's sanction did not rely on an appropriate legal ground.
Furthermore, the French Court ruled that there is currently no legislative provision in France that suggests that the right to dereferencing could apply outside of the territory of EU.

Lastly, the French Court found that, in any case, the right to global de-referencing would only have been permitted if the CNIL had struck a balance between the individual's right to privacy and the general public's right to freedom of information, which the CNIL had failed to do when it pronounced its sanction against Google.
 

4. Epilogue

The decision clearly limits the territorial scope of the right to de-referencing to EU territory from a French law perspective, in the absence of a French law that allows individuals to obtain de-referencing globally.

This ruling of the French Court marks a victory for Google. Not only was the CNIL's 100 000 euro fine annulled, but more importantly, this French Court's decision sets an important precedent at a Member State level by limiting the territorial scope of the right to dereferencing to the EU territory. This ruling is likely to have an impact on other global technology companies that provide online services to the public. In this regard, it is worth noting that Wikimedia Foundation Inc and Microsoft both intervened in the dispute to support Google's arguments before the French Court.

The CNIL took due note of the French Court's ruling and, on 7 April 2020, it published an updated version of its Q&A guidance on the right to dereferencing (available here, in French only), which now states:

• As a general rule, the right to dereferencing is limited to the territory of the EU and has no global outreach.
• While EU law does not prohibit a Member State from adopting a national law that enables individuals to obtain global dereferencing, currently no such law exists in France. As a result, the CNIL is not authorized to order global dereferencing.
• Even if such law was adopted in France, global dereferencing would not be systematic, and the CNIL would still have to strike a balance on a case-by-case basis between the individual's right to privacy and the general public's right to freedom of information.