France fines Google over ‘right to be forgotten’ privacy violations

(Reuters) – The French data protection authority said it has fined Google 100,000 euros ($111,720) for not scrubbing web search results widely enough in response to a European privacy ruling.

The only way for Google to uphold the privacy ruling was by delisting results popping up under name searches and linking them instead to outdated information across all its websites, the Commission Nationale de l’Informatique et des Libertes (CNIL) said in a statement on Thursday.

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":1905044,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"big-data,business,security,","session":"B"}']

The U.S. Internet giant has been at loggerheads with several European Union data protection authorities since the European Court of Justice ruled in May 2014 that people could ask search engines, such as Google and Microsoft’s Bing , to remove inadequate or irrelevant information – dubbed the “right to be forgotten”.

Google complied, but it only scrubbed results across its European websites such as Google.de in Germany and Google.fr in France on the grounds that to do otherwise would have a chilling effect on the free flow of information.

In May last year the CNIL ordered Google to expand its application of the ruling to all its domains, including Google.com, because of the ease of switching from a European domain to Google.com.

“Contrary to Google’s statements, applying delisting to all of the extensions does not curtail freedom of expression insofar as it does not entail any deletion of content from the Internet,” the CNIL said.

A spokesman for Google, now a unit of holding company Alphabet, said the company had worked hard to implement the “right to be forgotten ruling thoughtfully and comprehensively in Europe.”

“But as a matter of principle, we disagree with the CNIL’s assertion that it has the authority to control the content that people can access outside France, and we plan to appeal their ruling,” Al Verney, Google’s spokesman, said.

The company did try to assuage the regulator’s concerns in February by delisting search results across all its websites – including Google.com – when accessed from the country where the request came from.

That meant that if a German resident asks Google to de-list a link popping up under searches for his or her name, the link will not be visible on any version of Google’s website, including Google.com, when the search engine is accessed from Germany.

[aditude-amp id="medium1" targeting='{"env":"staging","page_type":"article","post_id":1905044,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"big-data,business,security,","session":"B"}']

But the CNIL rejected that approach, saying that a person’s right to privacy could not depend on the “geographic origin of those viewing the search results.”

“Only delisting on all of the search engine’s extensions, regardless of the extension used or the geographic origin of the person performing the search, can effectively uphold this right,” it said.

(Reporting by Julia Fioretti; Editing by Alastair Macdonald and Elaine Hardcastle)