France orders Google to scrub search globally in right to be forgotten requests
Naked Security Naked Security

France orders Google to scrub search globally in right to be forgotten requests

We do not care if a URL's got a .fr, a .uk or a .com glued to the end, France told Google - if a European makes a legitimate request to be forgotten in search results, make it so on all your search engines in all countries.

France orders Google to scrub search globally in right to be forgotten requestsWe do not care if a URL’s got a .fr, a .uk or a .com glued to the end, the French data protection agency told Google on Friday – if a European makes a legitimate request to be forgotten in search results, make it so on all your search engines in all countries.

A recap: An EU court decreed in May 2014 that people have the right to be forgotten online.

Google dutifully, unenthusiastically put up a form to let people request delisting in search results, but within weeks it got into trouble due to its rather picky approach, which consisted of burying search results for its subsidiary in a given country, as opposed to on worldwide search results.

A Canadian court, for one, ruled in June 2014 that Google had to bury search results for a Canadian company’s competitor, not just in Canada but around the world.

France has previously been on Google’s case about this issue.

In the autumn of 2014, a French court convicted Google over the same thing: i.e., failing to comply with a right to be forgotten case after it took down links on its French subsidiary but failed to do so globally.

Now, France’s Commission nationale de l’informatique et des libertés (CNIL), the country’s data protection authority, has ordered Google to apply delisting on all domain names of its search engine.

CNIL said in its news release that it’s received hundreds of complaints following Google’s refusals to carry out delisting.

According to its latest transparency report, last updated on Friday 12 June, Google had received a total of 269,314 removal requests, had evaluated 977,948 URLs, and had removed 41.3% of those URLs.

CNIL sized up the complaints it’s received from those whom Google had declined to forget and says that it requested that Google delist several results – not just based on the extension on the URL, it said, but on all results from the whole search engine.

From the release:

Although the company has granted some of the requests, delisting was only carried out on European extensions of the search engine and not when searches are made from "google.com" or other non-European extensions.

In accordance with the [Court of Justice of the European Union] judgement, the CNIL considers that in order to be effective, delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing.

Google was given 15 days to shape up, and the CNIL said it made the formal notice public to give other search engines and internet content providers a heads-up about the issue.

According to the BBC, Google had this to say in a statement:

We've been working hard to strike the right balance in implementing the European Court's ruling, co-operating closely with data protection authorities.

The ruling focused on services directed to European users, and that's the approach we are taking in complying with it.

The CNIL’s order doesn’t entail a sanction. Rather, it’s a pre-sanction.

If Google doesn’t comply, then the machinery to get a sanction recommended will be put into motion.

Image of Google courtesy of Liang Zou / Shutterstock.com .