Other Big CJEU Case Says Google Must Put Certain Links At The Top Of Search Results

from the must-carry dept

While most of the attention today was focused on the CJEU "right to be forgotten" ruling concerning global censorship, the court actually released another ruling concerning the right to be forgotten, again around disagreement between French regulators and Google. And, as intermediary liability expert Daphne Keller notes, this ruling may turn out to be more interesting in the long run.

This case involved how Google should deal with "sensitive data," when it's a part of a RTBF request. The court does decide that a "notice and takedown" regime makes sense for such sensitive content, which is better than the possible alternative advanced by some: that the law requires Google to pro-actively stop the indexing of such sensitive information (or even to first get consent). The court points out that this wouldn't make any sense at all, given how search engines work:

In practice, it is scarcely conceivable — nor, moreover, does it appear from the documents before the Court — that the operator of a search engine will seek the express consent of data subjects before processing personal data concerning them for the purposes of his referencing activity.

But what really stands out is what appears to be a totally uncalled for random aside by the court towards the end of the ruling:

It must, however, be added that, even if the operator of a search engine were to find that that is not the case because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and protection of personal data with the freedom of information of potentially interested internet users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.

This seems like it could be a very big deal. It's the court saying that Google is required to make sure that top search results "reflects the current legal position." In other words, if someone was exonerated after being accused of a crime, that must now be the top link. As Keller notes, this is going to have some strange consequences that probably won't be very good:

Having a court come in and tell a search engine what is "required" to be the top search result, tossed off without much detail or thought in a world where getting certain links to certain places on search engines is literally an entire industry, is going to have pretty significant consequences -- nearly all of them I can guarantee you the court did not even begin to think about.

Filed Under: cjeu, cnil, eu, links, must carry, right to be forgotten, rtbf, search engines, search results, seo
Companies: google

France Still Thinks It Regulates Entire Internet, Fines Google For Not Making Right To Be Forgotten Global

from the not-how-it-works dept

This isn't necessarily surprising, but it is incredibly stupid. As you hopefully recall, in the summer of 2014 the EU Court of Justice came out with a dangerous ruling saying that a "right to be forgotten" applied to search engines and that Google needed to "de-link" certain search results from the names of individuals. We've discussed at great length the problems with this ruling, but it continues to be a mess.

Last summer, French regulators began to whine about Google's implementation of the right to be forgotten, saying that it should apply worldwide. Google, instead, had only applied it to its EU domainspace. That is, if you were on Google.fr, you wouldn't see those results, but Google.com you would. Since Google tries to default you to the right top level domain for your country, that would mean that most people in the EU would not see the results that people wanted censored. But French regulators still demanded more. Google responded, telling the French regulators that this was crazy, because it would be a threat to free speech globally. If Google had to moderate content globally based on the speech laws of a single country, we'd have the lowest common denominator of speech online, and a ton of ridiculous censorship. Furthermore, Google pointed out that 97% of French users were on the Google.fr domain, so demanding global censorship was pointless.

The French regulators came back, saying "don't care, censor globally." Finally, last month, Google made a small change to try to appease the regulators, saying that it wouldn't just censor based on the top level domain, but entirely on whether or not it thought you were in France, based on your IP address or other indicators. So, even if you were in France, you couldn't get around the block by typing the ".com" address in instead of the ".fr."

And now, the French regulators have decided, once again, that this just isn't good enough. It's issued a fine for failing to censor the global internet:

On Thursday, France’s privacy regulator said its citizens’ rights could be upheld only if the European privacy decision was applied globally, and that Google had failed to remove — or “delist” — links from search results outside the European Union.

"For people residing in France to effectively exercise their right to be delisted, it must be applied to the entire processing operation, i.e. to all of the search engine’s extensions,” the agency, known as the Commission Nationale de l’Informatique et des Libertes, or CNIL, said in a statement.

CNIL also claims that Google's concerns about regulating speech outside of France are misplaced, since it only applies to speech about people in France, so it's their "data protection rights" that are the issue. That seems... shortsighted at best.

Google is planning to appeal the decision, and this is a big, big deal. Again, France -- or any country -- should have no authority to regulate or censor the global internet. It shouldn't be difficult to recognize why this is.

In the decision, CNIL directly notes that a non-global solution is no good since people can use VPNs:

... technical solutions exist to circumvent the filter measure proposed by the company that allow Internet users to select the geographical location of their IP address (e.g. use of a VPN).

Um, yes. Of course not many people do that, but some do. Is that really a reason to argue that the global internet must be censored? Would France be comfortable if, say, China or Iran or North Korea suddenly decide that Google must also be censored to block out links to content they dislike, and that such content must be inaccessible in search results in France? Or are French data protection regulators really so short-sighted to not see the impact of this ruling?

Filed Under: cnil, france, jurisdiction, right to be forgotten, search engines
Companies: google

French Privacy Agency DDoS's Itself In Ordering Google To Link To It From Google France Home Page

from the what-you-get-when-you're-technologically-clueless dept

Last month, Google got hit with a €150,000 fine for its new privacy policy, which French regulators claimed violated the law. Google has been disputing this and has appealed, but as part of the ruling by the French National commission for Computing and Civil Liberties (CNIL), Google was ordered to post a statement to the home page of Google.fr about the fine, along with a link back to CNIL's website which had the full ruling. Google had asked to suspend the order to post the message until after the appeals process was complete, but that was denied. In response, Google posted the message, and promptly caused CNIL's website to go offline, as apparently the technologically clueless folks over there never realized that having a link from Google's home page in that country might lead to a bit of extra traffic.

Filed Under: cnil, ddos, france, google home page, link, privacy
Companies: google