€100,000 saved in France
On March 27, 2020, the French Supreme Administrative Court (Conseil d’Etat) struck out a €100,000 fines imposed by the French Supervisory Authority (the CNIL) on Google in 2016. Besides the financial sanction, the CNIL had also ordered Google LLC (former Google Inc.) to remove links to the concerned webpages appearing in the search results of the non-EU version of its search engine.
Indeed, the French Court upheld the decision of the Court of Justice of the European Union (CJEU) decision handed down in September 2019. According to this latter decision, the right to be forgotten should apply only to the EU Member States version of the search engine unless the Authority carries out, beforehand, a balancing test between the rights to privacy and the protection of the individual’s personal data, on one hand, and the freedom of information, on the other hand.
The French Court stated that:
- the CNIL had not carried out the required balancing test;
- there was no existing legal provision allowing the right to be forgotten to exceed the scope of the Union law to apply outside of the EU territory.
Therefore, as long as French or EU law does not provide for the right to be forgotten to apply outside of the GDPR territorial scope, this right is only applicable within the European Union territory.
€7 million lost in Sweden
On March 12, 2020, the Sweden Supervisory Authority imposed a €7 million fine on Google LLC for failing to comply with an order to remove webpage links from its search engine result (“right to de-referencing or right to be forgotten”).
Indeed, in 2017, the Authority carried out an audit on how Google handled individual’s rights request to remove Google search results popping up using their name as a keyword, especially where these results lacked accuracy, relevance or were considered unnecessary. Following this audit, the DPA ordered Google to remove some of the search result listings.
As Google did not comply with the request, the authority carried out a second audit and issued a fine for the following reason:
– Google did not properly remove two of the search result listings it was requested to remove by the Authority. Indeed, it either made a too narrow interpretation of the web addresses to be removed from the search result listing or it failed to remove the search result listing without undue delay.
– As part of its procedure, Google notifies the website owner of the removed link of the dereferencing request in a way that enables the latter to identify the concerned webpage link and the person making the request. This allows the site-owner to re-publish the webpage in question under a new URL that will appear again in a Google search. This practice renders the right to dereferencing ineffective.
– Besides, Google’s request form mentions that Google notifies the site owner of the request in a way that may deter individuals from exercising their right. According to the Authority, Google does not have a legal basis for notifying site-owners and provides individuals with misleading information in the statement made in the request form.
