Google snubbed in France over attempt to limit right-to-be-forgotten requests

Google is battling with a French agency over how far its right-to-be-forgotten requests should extend.

On Monday, French data protection agency Commission Nationale de l'Informatique et des Libertés, or CNIL, rejected Google's appeal of a notice that would require it to apply user requests to remove websites from its search results across all of its domains, meaning the entire world. In its appeal, Google had argued that such user requests should be restricted to a certain domain or country. For example, if a French citizen requests that search result links should be taken down, that request should be honored on Google's search engine in France or the European Union but not to those in other nations outside of Europe.

In May 2014, European lawmakers ruled that Google and other search engines must honor requests from individuals seeking to have their websites removed from search results because they may no longer be relevant or may infringe upon that person's privacy. Google has since been contending with the hundreds of thousands of requests it has received but has restricted them to only European domains.

The battle strikes as the heart of the always challenging issue of privacy versus free speech. European regulators have argued that Google should apply takedown requests outside of Europe since European citizens can still easily find the removed links on the main Google.com website. But Google has countered that the ruling is a European one and should not be applied to its websites outside of Europe as that would limit the free speech and right-to-know freedoms available in other nations.

In its ruling on Monday, the CNIL attempted to explain why it rejected Google's appeal of the notice requesting it to apply the takedown requests beyond Europe. The agency said that its decision does not mean it's trying to apply French law outside the nation. Instead, the ruling asks companies that offer services in Europe, such as Google, to observe European laws.

"The Charter of Fundamental Rights of the European Union gives a number of fundamental rights to European residents, including the respect for private and family life and the protection of personal data," the CNIL said in an FAQ. "If these rights cannot lead to a protection of non-European residents, they apply however to companies processing data about European residents. In order to be effective, the protection granted to a European citizen must apply to the search engine as a whole, even if this has one-off effects outside of this territory.

Since Google's appeal has been rejected, the company must now comply with the notice, the CNIL said. If Google continues to ignore the notice, the CNIL said it may refer the matter to the agency's sanctions committee. That could lead to fines totaling up to $340,000.

Google did not immediately respond to CNET's request for comment. But the company told The New York Times that it disagreed with the CNIL's effort to expand the right-to-be-forgotten requests beyond Europe.

"We've worked hard to implement the right to be forgotten ruling thoughtfully and comprehensively in Europe, and we'll continue to do so," the company told The Times in a statement.

The initial ruling applies not just to Google but to other search engines such as Bing and Yahoo. The search engines are not asked to take down any actual data, which would be beyond their capabilities, but to remove search engine links to data upon the request of a user. Google must evaluate each such individual request and decide whether or not it should honor the request.

So far, Google has received 318,269 requests encompassing 1,126,518 website URLs, according to its latest Transparency Report. Among all the requests received, the company has removed 41.6 percent, with 58.4 percent left alone. In France, Google has received 66,707 requests pointing to 219,124 URLs. Of those, the search giant has taken down 48.2 percent and left 51.8 percent alive.