CNET también está disponible en español.

Ir a español

Don't show this again

Security

'Right to be forgotten' should include all Google domains, France orders

Google has rebuffed earlier calls by privacy watchdogs to expand "right to be forgotten" requests beyond the European versions of its search engine.

Europe's "right to be forgotten" ruling hasn't extended to google.com -- yet. Google

The controversial "right to be forgotten" rule, which allows Europeans to have more control over what is discoverable about them on the Internet, is again the subject of debate in France.

France's data-privacy regulator, the Commission Nationale de l'Informatique et des Libertes (CNIL) has issued an order to Google to remove requested content on all of its domains. Currently, French citizens who request information to be removed from Google see it nixed from google.fr. The CNIL wants Google to expand that to all Google domains, including its most popular, google.com.

The refrain is one Google has heard before in Europe since the "right to be forgotten" ruling went into effect in May 2014. The policy, which spans the entire European Union, allows Europeans to ask Google and other search engines to remove search results about them. The caveat is that those links must be no longer relevant or in some way invalid. The onus is on the user to prove their results fall into either of those categories. If they do, Google and other search engines remove the offending results from their search results.

Google, the dominant force in search in Europe with over 90 percent market share, has been vocal in its discontent with "right to be forgotten." The company argues that it simply shares Web page links and does not produce content. The search company has also complained that it's overrun with takedown requests and determining whether to allow or deny them is time consuming.

Google issues with the "right to be forgotten" ruling extend to the law's practicality. Google is solely removing the offending link from its search results; the source URL is still active on the page it was published and if users plug the link into their browser directly, they will be able to access it. If a user only asks Google to remove a link, it's possible the offending Web page will be available on other search engines that didn't receive a takedown request. Actually scrubbing the Web of a particular item, in other words, is practically impossible.

That hasn't stopped the requests from coming in. Between May, when the program kicked off, and October 2014, Google said that it had received nearly 145,000 . The company complied with 42 percent of requests, removing over 170,000 links from its search results. Facebook was the top target among people who requested results be removed.

In total, Google has removed nearly a million links in the last year.

The issue of keeping those takedown requests to European domains is one Google faced head-on in January. The company's chief legal officer David Drummond said that his company believes in "limiting the concept (of link removals) because it is a European concept."

Drummond's comments were a response to calls from a privacy watchdog group called the Article 29 Working Party. The organization, which is made up of the EU's 28 national privacy regulators, called on Google in November to erase links from all of its search engine domains.

"Limiting delisting to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling," the group wrote, referring to an EU court ruling last year that put the regulation into effect. "In practice, this means that in any case delisting should also be effective on all relevant .com domains."

The CNIL had little more to add in its ruling on Friday. The organization said that in order for a search result to truly be forgotten, it should extend worldwide.

"The CNIL considers that in order to be effective, delisting must be carried out on all extensions of the search engine and that the service provided by Google search constitutes a single processing," the group said. "In this context, the President of the CNIL has put Google on notice to proceed, within a period of fifteen (15) days, to the requested delisting on the whole data processing and thus on all extensions of the search engine."

The CNIL said that if Google fails to comply with its demand, it could face sanctions handed down by the CNIL Select Committee, which enforces the country's data-privacy laws.

A company spokesman provided a cryptic response to the order, saying that Google has "been working hard to strike the right balance in implementing the European Court's ruling, co-operating closely with data protection authorities." The spokesman added that "the ruling focused on services directed to European users, and that's the approach we are taking in complying with it."

Despite the prospect of facing sanctions, adding Google's .com domain could prove to be a hard sell in Mountain View. Less than 5 percent of European search traffic flows through to google.com; all other Google search traffic hits the company's country-specific domains.

Regardless, Google is now forced to deal with yet another issue in Europe. The company is already facing an antitrust complaint in the EU over its dominance in search and is under investigation by the European Commission to determine whether its Android mobile operating system is abusing its power.

The CNIL did not immediately respond to a request for comment.