Google to France: We can’t pick this Bonaparte
Today’s announcement from Google that the company will appeal a French agency’s order to abide by France’s version of the so-called “right to be forgotten” all over the world doesn’t just represent Google’s principled commitment to support the rule of law. It also signals to the world served by Google’s search and other products that the company supports the rights of ordinary users to read lawful content and know lawful facts.
What’s the “right to be forgotten”? Sometimes called “the right to delisting,” it’s a right articulated by the European Court of Justice in a 2014 case called Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (we can call it “the Costeja decision” for short). In that case, the European court found a Spanish attorney had the right to demand that Google remove links to a newspaper account of a government-forced sale of his property to pay debts. His argument was not that the newspaper story was false; instead, Costeja’s complaint was that search results including that newspaper story, “appear to be inadequate, irrelevant or no longer relevant or excessive in the light of the time that had elapsed.”
In effect, the decision created an obligation for Google and other search engines to suppress access to factually accurate newspaper stories, at least within the European Union. That obligation also has been codified in the updated General Data Protection Directive passed by the European Parliament last month.
Despite disagreeing with the Costeja decision, Google has since 2014 taken steps to bring its Europe-facing services into compliance with the “right to be forgotten,” as it’s being applied in Europe. The company developed a straightforward method for complainants seeking “delisting” of webpages, and it has taken pains to respond to those demands thoughtfully, rather than reflexively, by evaluating whether a demand is consistent with European law. As a first step, Google complied with requests for its services with EU Country Code Top Level Domains (e.g., google.fr, but not google.com). This year, it has done even more, as Google General Counsel Kent Walker describes in an op-ed printed today in the French newspaper Le Monde:
Following feedback from European regulators, we recently expanded our approach, restricting access to delisted links on all Google Search services viewed from the country of the person making the request. (We also remove the link from results on other EU country domains.) That means that if we detect you’re in France, and you search for someone who had a link delisted under the right to be forgotten, you won’t see that link anywhere on Google Search – regardless of which domain you use. Anyone outside the EU will continue see the link appear on non-European domains in response to the same search query.
(The original French version of Walker’s op-ed can be found here; an English version is available here.)
This means that if you’re in Paris or Berlin and using Google.com to search, you won’t see websites that have been delisted by Google under French law, as interpreted by CNIL.
Unsurprisingly, however, the French privacy regulator, CNIL Commission Nationale de l’Informatique_et_des_Libertés, has decided that Google’s painstaking efforts to comply with lawful invocations of the “right to be forgotten” are not enough. As I wrote last year in Slate, CNIL’s ambitions are global. The French agency wants to compel “delisting” of content a French resident has demanded be removed in any country in which that content might appear.
The Costeja decision itself did not find that an EU citizen could demand delisting of true material everywhere it might lawfully appear in the world. And it wouldn’t make sense to do so. The internet may connect us globally, but we still have nation-states. It’s generally (although not quite universally) understood that there are still limits on what the government of any nation can demand from the rest of the world.
Google’s argument in its appeal focuses partly on the precise language of the Costeja decision—that only a listing whose “processing” is “inextricably linked” to an EU member state (by being associated with advertising and/or search results displayed within the member state) can be subject to a demand like CNIL’s. It also relies on a generally accepted interpretation of France’s data-protection law; if the search results and the display results take place outside of France, the French data-protection law should not apply.
I’m grateful that Google is committed to challenging CNIL’s global (one is tempted to say “imperialistic” assertion of authority). If France’s privacy regulator has its way, this French regulatory agency will have unilateral authority to limit content that is lawful in the Philippines or Chile or the United States from being seen in those countries. As Google’s Walker puts it:
The CNIL’s latest order, however, requires us to go even further, applying the CNIL’s interpretation of French law to every version of Google Search globally. This would mean removing links to content – which may be perfectly legal locally – from Australia (google.com.au) to Zambia (google.co.zm) and everywhere in between, including google.com.
Walker goes on to make the same argument that every thoughtful observer has made with regard to any country’s assertion of extraterritorial authority to remove content:
But if French law applies globally, how long will it be until other countries – perhaps less open and democratic – start demanding that their laws regulating information likewise have global reach? This order could lead to a global race to the bottom, harming access to information that is perfectly lawful to view in one’s own country. For example, this could prevent French citizens from seeing content that is perfectly legal in France. This is not just a hypothetical concern. We have received demands from governments to remove content globally on various grounds — and we have resisted, even if that has sometimes led to the blocking of our services.
This is the argument every democratically oriented citizen and government must make. Even as we are increasingly globally interconnected through the internet, we still live in a world of nation-states that reasonably expect to have their national sovereignty respected and protected. As a nation, we may choose, through our governments and representatives, to agree to be bound by international treaties. But the rest of the world has not yet agreed to the expansive, grandiose assertions of authority from France’s officially officious privacy regulator.
