Google Appeals French Order For Global 'Right To Be Forgotten' (reuters.com)

An anonymous reader quotes a report from Reuters: Alphabet Inc's Google appealed on Thursday an order from the French data protection authority to remove certain web search results globally in response to a European privacy ruling, escalating a fight on the extra-territorial reach of EU law. In May 2014, the European Court of Justice (ECJ) ruled that people could ask search engines, such as Google and Microsoft's Bing, to remove inadequate or irrelevant information from web results appearing under searches for people's names -- dubbed the "right to be forgotten." Google complied, but it only scrubbed results across its European websites such as Google.de in Germany and Google.fr in France, arguing that to do otherwise would set a dangerous precedent on the territorial reach of national laws. The French regulator, the Commission Nationale de l'Informatique et des Libertes (CNIL), fined Google 100,000 euros ($112,150.00) in March for not delisting more widely, arguing that was the only way to uphold Europeans' right to privacy. The company filed its appeal of the CNIL's order with France's supreme administrative court, the Council of State. "One nation does not make laws for another," said Dave Price, senior product counsel, Google. "Data protection law, in France and around Europe, is explicitly territorial, that is limited to the territory of the country whose law is being applied." Google's Transparency Report indicates the company accepts around 40 percent of requests for the removal of links appearing under search results for people's names.

Comments

US disagrees

[Anonymous Coward]

interestingly the country google is from completely disagrees with googles stance as they regularly make laws and rulings around data beyond its borders

Re: US disagrees

[Anonymous Coward]

Bullshit, bullshit, bullshit. The censorship practice that is commonly called "right to be forgotten" is not mandated by data protection laws. Otherwise there wouldn't need to be a special law about it, and also the original web pages would have to be censored, not just the search results. TFA contradicts you in that it speaks of information that is "inadequate or irrelevant", not of personal data that would fall under data protection.

If you agree with the EU's cynical interpretation of "Libertés", what about other jurisdictions? Shouldn't Iran's and China's rules about what is deemed inadequate or irrelevant also be respected worldwide? If not why not?

Re: US disagrees

[Anonymous Coward]

Bullshit, bullshit, bullshit. The censorship practice that is commonly called "right to be forgotten" is not mandated by data protection laws. Otherwise there wouldn't need to be a special law about it,

Uhm.. laws are laws, some are not more "special" than others, and this most definitely is a data protection law.

and also the original web pages would have to be censored, not just the search results.

Not at all, because this is not the purpose of the law. It is not to remove the information from being available in original sources or for people who for some reason actively want to investigate deeply. It is to avoid that casual searches on your name, that people do all the time, constantly resurfaces old stories that can ruin your life. When applying for a job as a 30-year old your pot possession conviction from when you were 19 shouldn't matter anymore. It is over and done with, but with the extreme information gateway role Google plays in today's society, it won't die.

You can agree or disagree and think it is stupid (as you are free to discuss any law), but that is the purpose of this law, so what you say do not at all follow

TFA contradicts you in that it speaks of information that is "inadequate or irrelevant", not of personal data that would fall under data protection.

If you agree with the EU's cynical interpretation of "Libertés", what about other jurisdictions? Shouldn't Iran's and China's rules about what is deemed inadequate or irrelevant also be respected worldwide? If not why not?

France and EU are not requiring that their law is implemented globally, that is just hyperbole reporting and Google PR spin (both of which we used to dislike on this site). They are requiring that the Google.com domain follow the law within the EU law domain. This is clear if you are going to the sources, and they use this specific example in their complaint to Google: Users in France searching on Google.com instead of Google.fr get a search result today where right to be forgotten in EU is not implemented.

Google is trying to call .com a global only search result, but that is disingenuous and appealing to tech illiterate users -- both they and all others already do geo-fencing and geo-tailoring on what is served through a "global" .com domain.

Re: US disagrees

[locofungus]

The censorship practice that is commonly called "right to be forgotten" is not mandated by data protection laws.

I am not a lawyer and I don't understand all the nuances around this but actually, in Europe, this is (apparently) mandated.

*Any* collection of personal information into a database is covered by data protection laws. *Any* european citizen can request a report of all the information held on them (subject to some exclusions that probably wouldn't apply to google) for a capped fee. *Any* citizen can request that incorrect information is corrected (again there are some exceptions where it's only necessary to note that the citizen disputes the item) and *any* citizen can request that any information held on them should be deleted unless it's continuing holding is necessary (for example, billing information for a continuing subscription, necessary regulatory regulations regarding data retention etc)

This is complicated by the fact that the highest European court did give a ruling that some of these regulations don't apply to search engines (a ruling that I approve of). Prior to that ruling it could have been argued that google was breaking the law just by building its search database as it should have obtained explicit permission from each person to collect any information on them at all.

Eventually this will get pushed up to the highest courts in Europe and they will clarify what the current law actually means with regards to search engines.

After that there will probably still be arguments about what is right and wrong but pretty much the only way it will change is if the EU states can get together and agree a European wide change to the law (For this particular type of treaty I don't know if it would be majority or unanimity that would be required.)

It should also be noted that many of the requirements of data protection laws in Europe come from treaty but the individual laws are set at a national level - i.e. the treaty says what must be allowed or prohibited but the individual nations are responsible for writing laws into their books that enforce the treaty. So sometimes a national law might gold plate a european treaty - so the EU courts might find that the French law is legal in EU land but not required or they might find that the French law is illegally overbroad and will have to change or, indeed, they might find that French law is deficient in failing to protect some right.

The British government (of all persuasions) is a great fan of gold plating EU regulations, either in rhetoric when they want to beat on Europe or in law when they want an excuse to pass some new draconian legislation. "Europe made us do it" when what they mean is "Europe required us to change the law but didn't require this law which is a superset of what Europe required"

Re: US disagrees

[Opportunist]

That would work, until politicians learn the meaning of the three letters VPN.

Let's hope they never. So far it's created the equilibrium where they get to play in their own little world where they can make laws and we can play in ours where we can simply ignore them.

Re: US disagrees

[silentcoder]

Not to mention, as I recall (and memory could be faulty) the original court case that led to this law in the first place - was brought by somebody who was entirely innocent of the bad behavior which was showing up in a google search from a defamation piece false written by a third party. If I recall he was also suing said aleged defamer but I don't know the outcome of that case.

The point is - not everything that is on the net about your is automatically relevant or useful information, much of it may not even have a shred of truth to it. Look at the many cases world wide of people having their credit records ruined because some credit agency confused them with somebody else who just happens to have the same name. We even had a case here in my country where it happened to an airforce intelligence officer. Those guys are literally legally prohibited from ever having bad debts - it would create too much of an incentive for things like bribery andyou seriously do not want high-level military personnel who handle classified data to be easily tempted people. But a credit agency confused him with somebody else, from the opposite end of the country who had the same name and a bunch of bad debts. Took years to clear his record. Cases like that happen all the time.

  There are plenty of perfectly legitimate times when what information is available about you could be utterly false. The EU's laws in this regard are addressing a very real problem that seriously impacts on citizens liberty and lives - the only thing wrong about these laws is that they do not have equivalents in EVERY free country like the seriously ought to.

Re: US disagrees

[AmiMoJo]

The censorship practice that is commonly called "right to be forgotten" is not mandated by data protection laws.

This if factually incorrect. The EU issues directives on data protection in the mid 90s. The way the EU works is there is no "federal law", they just have directives that each member state must them implement in their own local laws. So in the UK we have the Data Protection Act which covers the right to be forgotten, and in France they will have their own specific data protection law implementing the directive.

You can think of it kinda like an API for law. The EU defines the API, and then member states write an implementation into their laws. Any EU citizen can expect the same basic API in every country, although some extend it with even greater (but non-breaking) protections.

There was some confusion because the EU was considering something called the "right to be forgotten", which would enable individuals to require companies to delete their data. So for example, Facebook would have to really permanently delete accounts instead of marking them dormant. That is going ahead, but in the mean time the media has assigned the name "right to be forgotten" to requests made under the existing 90s legislation. Companies that hold data about individuals and provide it to others, such as credit reference agencies and search engines, must abide by those rules.

the original web pages would have to be censored, not just the search results

This rule doesn't apply to journalists or individuals writing about someone else, for example. So a newspaper could publish and archive a story about your bankruptcy forever, but a credit reference agency or search engine must abide by the rules governing how long that information can be reported for when responding to a request for data on an individual.

That's why the results are only removed for searches of that person's name, and not for other search terms.

Shouldn't Iran's and China's rules about what is deemed inadequate or irrelevant also be respected worldwide?

It's not world wide. I didn't RTFA but the summary lies. It's only for results served in the EU. The "world wide" bit is actually just that Google has to remove the results if a French person goes to google.com instead of google.fr for their searches. An American using google.com will not have the results removed.

Re:US disagrees

[oobayly]

Is it illegal for French people to call somebody abroad and find out the information? Or is it just this new fangled thing called the internet?

Re:US disagrees

[StormReaver]

interestingly the country google is from completely disagrees with googles stance as they regularly make laws and rulings around data beyond its borders

Google is not the U.S. Government, and your statement is an irrelevant strawman. Google is correct (logically, morally, and practically) that a country's laws cannot extend beyond its territories.

Re: US disagrees

[KingMotley]

Google is trying to call .com a global only search result, but that is disingenuous and appealing to tech illiterate users

No, google is **correctly** claiming that google.com is a US based search result, and your EU laws can go pound sand.

Re: "One nation does not make laws for another" ??

[Anonymous Coward]

Wrong. Italy routinely makes laws that are meant to be valid all throughout the universe. They just lack the firepower to enforce them.

So the moment a tech company has to obey EU laws

[Anonymous Coward]

...it becomes an American company again?

I sure wish they took the same view come tax time.

EU is making laws for Google, not for other countries. If you want to keep operating there, play by their rules.

Re:Radical idea: My data is NOT google's property

[Zandamesh]

Google just links to the information, they don't remove it. Why does none of this responsibility to preserve privacy fall on the shoulders of people who host it in the first place? I'll tell you why, because it's too much of a hassle to go after each of the ones hosting the info, so they go after Google, mainly because it's easier. But the information does not go away, and if people really have an interest about searching about people, alternatives will become available. Especially because technology is constantly improving, how long until every newspaper ever written fits on a single hard disk? This law to censor Google will soon become obsolete but it won't be removed because that would be too much of a hassle as well.

Google's reasoning makes no sense.

[silentcoder]

The law is NOT being enforced externally at all. Nobody on the ECJ is going to give Google any grief if they ignore a request by me to be forgotten - I'm not a European citizen and my country does not have such a right.

But Google has to comply with the laws of the countries it operates in, in so far as it concerns data about people from those countries. By Google's reasoning, if you kidnap somebody and take them to a country where kidnapping is legal - you cannot be prosecuted ? Their right not to be kidnapped dissappeared after you took them to a country that doesn't recognize it ? Of course not. They are still citizens from a country where that is a right - and their government still has a duty to protect that right, even if they are not currently within it's borders.
I see no reasonable reason why a person's data should be any different.

Re:Simple question

[silentcoder]

> However, what happens if a French citizen requests they be forgotten by Google while US investigators are looking into that same person on suspicion of terrorism and have a court order demanding preservation of the data?

No problem. There is nothing in the right to be forgotten that requires Google to delete data, it only needs to delete the data PUBLICLY. Remove it from search results, nobody will check if they deleted the entry from the database or just flagged it for "do not display".

It's a ridiculously easy problem to solve.

But it's interesting how your basic assumption begs the question: what the fuck makes you think US investigators have the right to investigate somebody in another country ? He is NOT subject to their authority. Unless he commits a crime IN the US they have no right to be doing that investigation in the first place. If he does, their right ends when he crosses the border and they are supposed to hand the investigation over to Interpol and work with the authorities in the country the person is in now through this interpol. If the person was planning a terrorist attack in another country, then the authority to investigate him lies EXCLUSIVELY with the law enforcement of that country. You bet your ass no sane court would grant a right-to-be-forgotten request if it's opposed by legitimate law enforcement. US investigators do not have the right to investigate non-US citizens who are not currently in the US. We didn't vote for the US government, we get no say in your laws and we are not required to comply with them and your investigators have no right to so much as know our names. We have our OWN investigators thank you very much and we will investigate and prosecute our own criminals.
No country has yet invited the FBI to come investigate their criminals for them and no country is likely to ever do so. Countries do sometimes invite highly successful investigators from other countries (the FBI is frequently one) to come TRAIN their local investigators and bring some of those skills across, but the authority to USE them belongs to the local government. The US government's authority to do anything ends at your own borders and it's high time Americans figure that out.

Unfirst post

[wonkey_monkey]

I demand that this failure to get first post be forgotten.

Re:Unfirst post

[Errol backfiring]

In all probability it was probably someone else than the victim on the soapbox. And a foreign company should have no right to that information whatsoever. I know the company cannot be expected to check all the information for such issues, which is why the right to be forgotten actually exists. Google should stop whining about it.

Re:Radical idea: My data is NOT google's property

[AmiMoJo]

Why does none of this responsibility to preserve privacy fall on the shoulders of people who host it in the first place?

Actually it does. Any business handling personal data has to abide by data protection rules.

Re:Open letter

[oobayly]

What are they doing wrong? They're obeying a local law. France wants its laws to apply outside of their borders. Imagine their reaction if Saudi Arabia demanded that they repeal their ban on face covering in public places.

Re: Simple question

[silentcoder]

As trainers not active duty. If an FBI agent tries to arrest me in my home country I have every right to use deadly force against him because outside US jurisdiction it is not a legal arrest. It is kidnapping and shooting him is self defense. No sane judge would convict me.

Re:Simple question

[Jason Levine]

What France is doing is no different. They expect Google to obey French law for information they serve up in France, even if the information is located outside of France.

I have three problems with this statement.

First of all, Google is complying with the French version of Google (Google.fr) but not the main Google.com. Google.fr serves up automatically if someone from France tries to load Google. So if someone from France goes to the Google.com website, they are purposefully going around the system - possibly in an effort to get the blocked content.

Secondly, complying with this law - the way France wants Google to comply - would mean removing/blocking this content for EVERYONE due to a law in one country. This would mean that I (in the USA) wouldn't be able to find content simply because France said no to is. How far does this extend? Can Saudi Arabia demand that Google censor search results worldwide to comply with their laws? What if two countries have conflicting laws? Is Google compelled to observe the conflicting laws at the same time?

Finally, this can be extended beyond Google. I run a few websites. Suppose I post something that is perfectly fine in the US but that someone in France decides is against their law. Right now, there's no problem. My websites only need to comply with the laws of the country I live and operate in. However, if we insist that I must "obey French law for information [I] serve up in France, even if the information is located outside of France", then suddenly French law applies to me merely because someone from France loaded up my website. Adding Point #2 into this, it means that I might be forced to comply with the laws of ANY nation that decided their laws extend beyond their borders because websites can be loaded via the Internet onto computers in their country.

Re:Radical idea: My data is NOT google's property

[ooloorie]

If owning another person's personal information without their permission was a crime

Google doesn't claim "ownership" over information about you; they simply provide a link to information that is already on the web. The search results will disappear as soon as the original pages disappear. If you have a problem with that, you need to take it up with the people who put the information on the web in the first place, not Google.

Secondly, the information that is at issue in "right to be forgotten" cases usually isn't "personal" information, it's public information: legal judgments against you, articles others have written about you, etc. You don't own that information and you shouldn't be able to control it, even according to the EU and proponents of the "right to be forgotten", because they don't force the original publishers of that information to take it down.

Right to be forgotten....

[mark-t]

... is nothing but censorship. Plain and simple.

The biggest problem with censorship is that at its fundamental level, it is an attempt to control what people will know or believe, (since what information they are being allowed to access in the first place is controlled), and is an attempt to try and legislate what kinds of things people are even allowed to *THINK* about.

Nobody, no agency, no authority, no government, absolutely no power absolutely anywhere has any right to decide what any other human being should be allowed to think. Period.

While it certainly may suck if somebody makes an unfair decision about you because you did something spectacularly stupid or wrong a long time ago when that person is too narrow minded to consider how much time has actually elapsed since it occurred, but in the end that decision is still on them. Unfair shit happens to everybody in this world... heck, half of the people in this world are starving to death, and somebody living in a privileged nation thinks its unfair that an employer won't hire them because of some stupid shit that went down over a decade ago? It doesn't fucking matter whose fault it is when bad stuff happens to any us, it is still that person's individual responsibility to deal with it... and to continue to be the best person that they know how to be, and blaming past mistakes or blaming the fact that other people might not forgive us for them to justify why we aren't being better is just acting like a fucking crybaby. People who do so need to grow the hell up, act like adults, and and take responsibility for their OWN lives in the here and the now, instead of letting what people might believe about them dictate what choices they make.

(huff, puff, huff, puff, huff, puff.. Well, that turned into more of a rant than I first thought it would).

French logic

[ooloorie]

France doesn't have jurisdiction over Google in the US; all they have jurisdiction over is Google's French subsidiary.

So, in effect, France is trying to fine Google France for actions committed by the owner of Google France outside of France. If France wants to set that precedent, they are welcome to it; I suspect it will strongly discourage future investment in France and French companies.