Decision no. 2016-054 of March 10, 2016 of the Restricted Committee issuing Google Inc. with a ?nancial penalty The Restricted Committee of the Commission Nationale de 1 ?Informatique et des Liberte?s composed of Mr Jean-Francois CARREZ, Chair, Mr Alexandre LINDEN, Vice-Chair, Marie-Helene MITJAVILE, Dominique CASTERA and Mr Maurice RONAI, members. Pursuant to Convention no. 108 of the Council of Europe of 28 January 1981 for the protection of individuals with regard to automatic processing of personal data; Pursuant to Articles 7 and 8 of the Charter of Fundamental Rights of the European Union of 7 December 2000; Pursuant to Eur0pean Parliament and Council Directive of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; Pursuant to French Act no. 78-17 of 6 January 1978, as amended, in particular Articles 45 and following; Pursuant to French Decree no. 2005-1309 of 20 October 2005, as amended, in accordance with Act no. 78-17 of6 January 1978; PursUant to Decision no. 2013-175 of 4 July 2013 pertaining to the adoption of the by?laws of the Commission National de anormatique et des Libert?s; Pursuant to the ruling handed down by the Court of Justice of the European Union on 13 May 2014 in case Google Inc. Spain SL and Google Inc. versus Agencia Espan'ola de Proteccio?n de Datos (AEPD) and Mario Costeja Gonzalez; Pursuant to referrals no. 14020486 received on 14 July 2014; no. 14021808 received on 28 July 2014; no. 14021787 received on 28 July 2014; no. 13023478 received on 26 July 2014; no. 14022964 received on 7 August 2014; no. 14024210 received on 22 August 2014; no. 14025050 received on 2 September 2014; no. 14025413 received on 8 September 2014; Pursuant to the decision of the Chair of the Commission Nationale de I ?Informatiqne ei des Libert?s pertaining to appointment of a reporting judge (rapporteur), on 25 September 2015; Pursuant to the report by Mr Philippe LEMOINE, Commissioner and Reporting Judge, sent to Google Inc. on 17 November 2015; Pursuant to the written observations sent by Google Inc. on 18 January 2016, the letter received on 21 January 2016 and the oral observations made during the meeting of the Restricted Committee; Pursuant to the other documents in this case. With the following in attendance at the Restricted Committee meeting of 28 January 2016: This document is an uno?icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. - Mr Philippe LEMOINE, Commissioner. who drafted the renort: Representatives of Google Inc: (i'onsultanls for (jungle Inc. luuyun; at Mr can-Alexandre SILVY, Government Commissioner, who did not make any observations; Representatives of Google Inc. spoke last; After deliberation, adopted the following decision: I. Facts and proceedings Google Inc. (hereinafter ?the company?) was founded in 1998 and its head of?ce is in the United States. It operates in around forty countries with approximately 40,000 employees around the world. One of its major activities is operating the Internet ?google search? engine, the most widely used tool in the world with thirty billion URL addresses indexed since the start of 201 3. In its Decision of 13 May 2014 (Case no. the Court of Justice of the European Union (CJEU) ruled that the activity of a search engine of searching for, automatically personal data and the free movement of such data (hereinafter the ?directive?). The Court of Justice also ruled that the search engine operator was the data controller and thereby subject to the abovementioned directive. Said operator is consequently required to comply with the rights to erase data and to object set out in Articles 12 and 14 of the directive, by ?dc-listing? some web links under the conditions for application of these provisions. This technique consists of deleting links to web pages published by third parties that contain information about a person from the list of results displayed following a search containing this person's name. The Court stated that a de?listing request made directly to the search engine operator without prior appeal to website publishers, could be accepted even if the information published on the relevant websites was lawful. The Court of Justice ruled that, in order to assess the validity of a de?listing request, the ?mdamental rights to privacy and protection of personal data ?override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general 2 This document is an unofficial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. public in having access to that information upon a search relating to the data subject?s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his ?tndamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question (paragraph 99). The Court also stated that the processing in question, which provides any Internet user with a structured overview of information about an individual on the Internet, and creates a more or less detailed pro?le of said individual, may signi?cantly affect the ?mdamental rights of individuals as guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Finally, the Court of Justice clari?ed that de-listing refusals or inadequate responses ?'om the operator could be contested, in particular before the national data protection authority. On 26 November 2014, the European data protection authorities in the Article 29 Working Party ad0pted guidelines designed to ensure the uniform application of the CJEU ruling. These guidelines contain a common interpretation of the ruling and criteria designed to guide national authorities on how to handle complaints received following de-listing refusals. Since this decision, and in order to comply with its obligation, Google Inc. has published a special online form, entitled ?search removal request under data protection law in EurOpe? for European Internet users, where they can request for search results about them to be removed. The company has handled approximately 80,000 requests for France, 51.5% of which have been accepted according to data ?om the company website. The Commission Nationale de ?Informatique et des Liberte?s (hereinafter or the ?Commission?) is regularly contacted by Internet users residing in France to contest refusals from Google Inc. to grant their de-listing request. While assessing these complaints, the Commission reminded the company in a letter dated 9 April 2015, that de-listing, in order to be effective, should not only be limited to the Eur0pean extensions of its search engine. By letter dated 24 April 2015, the company stated that it was continuing discussions but would not make any modi?cations to its system, considering that it was capable of effectively guaranteeing the right to de-listing in its current state. On 21 May 2015, the Chair of CNIL consequently issued formal notice ordering Google Inc. to de-list the relevant pages on all extensions of its search engine domain name within a period of ?fteen days. In accordance with Article 46 of French Act no. 7 8-17 of 6 January, as amended (hereinafter the ?French Data Protection Act?), the Chair requested that the Executive Committee of the Commission make a decision on the opportunity of making public this decision to issue formal notice. 3 This document is an uno??icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. On 8 June 2015, the Executive Committee, of?cially comprising the Commission Chair and two Vice-Chairs, decided to make public the formal notice, in accordance with the provisions of Article 13-1 of the French Data Protection Act. It took into account the need, on the one hand, to inform search engine operators, Internet users and content publishers of the reach and sc0pe of the rights to erase data and to object and, on the other hand, to ensure that these rights are fully effective by extending de?listing requests previously granted by the company to all of the search engine?s domain names. Goo gle Inc. was informed of the formal notice and Executive Committee decision in French and English versions of a letter dated 9 June 2015, also sent to Google France on 11 June 2015 for information. On 18 June 2015, a meeting was held at the CNIL of?ces at the company?s request. It was intended to clarify the expected procedures for compliance. By letter dated 23 June 2015, the company requested an extension of the deadline in order to complete the necessary legal and technical analyses. On 30 June 2015, the Commission granted a deadline extension until 31 July 2015. On 30 July 2015, the company submitted an appeal to the CNIL Chair with a View to the repeal of the decision to issue formal notice and the associated publication measure. This appeal was rejected by a letter dated 16 September 2015, copied to the French office of the processing controller by a letter dated 21 September 2015. In the absence of a reply such as to con?rm compliance with the injunction addressed by the formal notice within the deadline set, the Commission Chair decided on 25 September 2015, on the basis of Article 46 of French Act no. 78-17 of 6 January 1978, as amended, to begin proceedings against Google Inc., by appointing Mr Philippe LEMOINE as Reporting Judge. Following his assessment, Mr Philippe LEMOINE noti?ed the company on 17 November 2015 via a report detailing the violations of the French Data Protection Act he considered to be in place, and requesting a public ?nancial penalty to be handed down. A summons to the Restricted Committee meeting of 28 January 2016 was also attached, specifying that the company had a period of one month to submit its written observations. On 18 January 2016, the company produced written observations on the report, which were repeated orally during the meeting of 28 January 2016. II. Grounds for the decision Failure to comply with the obligation to respect the rights of individuals to erase data and to object. The protection of private life and personal data is guaranteed for European residents, in particular by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and by Article 1 of Directive 4 This document is an uno?ict'al translation of Decision no. 201T 6-054 of March 10, 2016. Only the French version of th is document is deemed authentic. In this context and in order to protect their private lives and personal data, individuals have the right to ask the data controller to erase their data, in particular if said data is incomplete or inaccurate (Article 12 of the Directive) and to object to the processing of their data for any legitimate reasons (Article 14 of the Directive). These Eur0pean provisions were transposed into French legislation in Articles 38 (?Any natural person is entitled, on legitimate grounds, to object to the processing of any data relating to them and 40 of the French Data Protection Act (?Any individual providing proof of identity may ask the data controller to, as the case may be, rectyy, complete, update, block or delete personal data relating to them that is inaccurate, incomplete, equivocal, expired, or whose collection, usage, disclosure or retention is prohibited?). These articles must be interpreted in light of the aforementioned decision of the CJEU of 13 May 2014, which demanded the concrete implementation of the right to erase data or to object via a de?listing procedure, guaranteeing the effective application of the fundamental rights of the individuals involved, i.e. the right of privacy and protection of their personal data, with no possible circumvention. The Court of Justice states in several places that the purpose of the directive is to guarantee the full and complete protection of the fundamental rights, which include the right to privacy: ?The objective of Directive 95/4 6 [is to ensure] e?ective and complete protection of the fundamental rights and ?eedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data (paragraph 53), - ?Directive 95/4 6 seeks to ensure a high level of protection of the ?tndamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (paragraph 66). ?the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the ?amework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 9.5/46 in order that the guarantees laid down by the directive may have e?'ect and that e??ective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved? (paragraph 38). It also states that the protection granted by Directive must be applied to all European residents, with no possible circumvention: ?it is clear in particular from recitals 18 to 20 and Article 4 of Directive 95/46 that the EurOpean Union legislature sought to prevent individuals from being deprived of the protection guaranteed by the directive and that protection from being circumvented, by prescribing a particularly broad territorial scope (paragraph 54). - ?it cannot be accepted that the processing of personal data carried out for the purposes of the operation of the search engine should escape the obligations and guarantees laid down by Directive 95/46, which would compromise the directive ?s e?ectiveness and the efective and complete protection of the ?tndamental rights and ?eedoms of natural persons which the directive seeks to ensure (see, by analogy, L'Or?al and Others U: 74, paragraphs 62 and 63), in particular their right to privacy? (paragraph 58) 5 This document is an uno?icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. The Court adds that the individual in question must be able to, ?in the light of his ?tndamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results? (paragraph 99). In its correspondence, the company contests the validity of the injunction sent by the Commission Chair requiring it to de-list ?all extensions of the search engine domain name First, the company af?rms, on the one hand, that the formal notice has no legal foundation as it is based on an imprecise and unpredictable legal rule and, on the other hand, that it is not based on speci?c complaints. With regard to the ?rst point, the Restricted Committee considers that by ordering de-listing across all search engine extensions, the Chair of CNIL acted in accordance with Articles 38 and 40 of the French Data Protection Act, which transpose the articles ?'om the 1995 Directive, as interpreted by the CJ EU in its aforementioned decision, thereby ful?lling its general mission imposed by the legislator of ensuring compliance with said Act (Article 11 of the French Data Protection Act). The accusation of unpredictability must therefore be excluded. The Restricted Committee also notes that the demand made in the formal notice of 21 May 2015, which was previously expressed in a letter dated 9 April 2015 and set a deadline for compliance, was unambiguous. With regard to the second point, the Restricted Committee notes that the formal notice is founded on eight complaints expressly targeted by the decision. Whatever the circumstances, the use of CNIL punitive powers is not subject to the existence of a complaint and does not aim to remedy any damages done to a complainant, but only to correct or sanction any violation of the French Act of 6 January 1978, as amended. Second, the company af?rms that the CNIL is exceeding its powers by imposing a measure with extraten'itorial scope. It af?rms that French Act no. 78?17 of 6 January 1978, as amended, is not applicable to queries made on search engines outside of France, which represent an activity that neither targets French Intemet users nor is inextricably linked to the activity of its French subsidiary. With regard to this point, the Restricted Committee considers that the company is working on the assumption that there are as many ?Google Search? processing systems as local search engine extensions, whereas in reality, it is a single processing system with multiple technical paths. The means of using the search engine, whether the geographic location of the Internet user making the search, the language used to display results, the order of results in the list and even the search terms themselves, are all operations that use the same processing system. In this regard, the company is hereby reminded that the search engine?s various geographic extensions were created by the company over time in order to offer a service adapted to the national language of each country, whereas at ?rst, its service was only Operated via the single domain name ?googlecom?. 6 This document is an uno??icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. This is also the position held by the CJEU, which states in its decision of 13 May 2014: ?it must be found that, in exploring the Internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine ?collects? such data which it subsequently ?retrieves?, ?records and ?organises within the ?amework of its indexing programmes, ?stores on its servers and, as the case may be, ?discloses and ?makes available to its users in the form of lists of search results. As those operations are referred to expressly and unconditionally in Article 2(b) of Directive 95/46, they must be classified as ?processing within the meaning of that provision (paragraph 28) The French Data Protection Act therefore applies to all processing associated with the ?Google Search? service, since, within the meaning of Article of the French Data Protection Act, Google France contributes, in French territory, to the activity of the search engine operator based in the United States, as stated in the aforementioned Decision: ?It follows ?'om the foregoing that the answer to Question I is that Article of Directive 95/46 is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space o?ered by that engine and which orientates its activity towards the inhabitants of that Member State (paragraph 60). Furthermore, the Commission is empowered to determine the de-listing methods if the processing in question is carried out, as per Article 48 of the French Data Protection Act, ?whether ?dly or partially, on the national territory, including where the data controller is established in another Member State of the European Union The company also asserts that de-listing on all search engine extensions violates the international right of ?comity? and infringes on the sovereignty of States due to its extraterritorial effects. In response to this argument, the Restricted Committee reminds the company that this decision only concerns individuals residing in France, whose rights are to receive ?e?ective and complete protection, as required by the Court of Justice in its Decision (paragraphs 34, 38, 53, 58 and 84). In the casein point, the right to de-listing, derived from the rights to erase data and to object, is associated with an individual. When applied, it must be effective without restriction for all processing, even if it con?icts with foreign rights. Third, the company af?rms, in substance, that ?global? de-listing would represent a disproportionate attack on ??eedorn of expression and information. On the one hand, the Restricted Committee reminds the company that de?listing does not erase any content on the Internet or deindex the web pages in question (which would involve purer and simply removing the links searched for from search engine results). It consists only, at the request of an individual, of removing links to website pages from the list of results of a search made using only his/her ?rst name and surname. These pages remain accessible when the search is made using other terms. 7 This document is an uno?icial translation of Decision no. 2016?054 of March 10, 2016. Only the French version of this document is deemed authentic. On the other hand, as stated by the Court of Justice, the decision to de-list is only taken if the conditions for application of the right to object (subject to proof of legitimate interest) or erase data (subject in particular to demonstrating the obsolete, incomplete or erroneous nature of the information in question) are met. It is therefore only applied following a proportional check designed to retain the tight balance between reSpect for the rights to privacy and personal data protection of individuals and the bene?t to the public of accessing information, in particular in the event that the applicant plays a role in public life. Limiting de?listing to Eur0pean extensions appears, on the one hand, unfounded insofar as the different domain names (google.fr for France, google.es for Spain, goo gle.com.au for Australia, etc.) are only technical paths to access a single processing system, and on the other hand, incomplete since the de-listed links remain accessible from the search engine?s non- Eur0pean extensions. As such, any Internet user, wherever he or she is located, can access de?listed web pages by carrying out the search using a non-European extension of the search engine. Such a measure does not meet the requirements for ef?cient, complete and effective protection without circumvention imposed by the aforementioned CJEU Decision as the violation of the right to privacy and protection of personal data remain for the individuals in question. That being the case, only de-listing across the entire search engine would enable effective protection of the rights of individuals. Consequently, the Restricted Committee considers that there are legal grounds for the decision to issue formal notice dated 21 May 2015 to the company for failing to de?Iist ?all extensions of the search engine domain name Insofar as no changes have been made by Google Inc. within the deadline set out in the formal notice, despite an explanatory meeting with Commission representatives and an extension of the deadline, there is a clear violation of aforementioned Articles 38 and 40. In a letter sent to the Chair of Art. 29 WP on 21 January 2016, after expiry of the deadline for compliance, the company promised to improve its de-listing procedure. It stated that this procedure would be extended to all of its search engine extensions (including derived versions for countries located outside of the European Union) when the query appears to ?come from the country of the applicant, with the country primarily determined by the user IP address. The Restricted Committee notes that this method is an improvement. Nevertheless, it notes that the IP address geolocation criterion, which varies the protection given to a Eur0pean resident according to the geographical location of the individual using the search engine, is, on principle, unsatisfactory insofar as, on the one hand, the de-listed information remains accessible to all Internet users outside the territory affected by the ?lter measure, and on the other hand, this measure can still be circumvented by any affected users. 8 This document is an unq?'icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. Applied to France, this solution prevents French residents from accessing de-listed content from France, but not outside of this territory. They could still access it during a trip within the European Union by using a non-European Union extension of the search engine via a i connection, or during a trip outside the European Union, whatever the connection type used, via the local version of the search engine. Furthermore, areas close to national borders often receive dual cover ?om both French and foreign telecommunications networks. A French resident could avoid the ?lter measure by being allocated a foreign IP address even though he or she is located on national territory. Finally, technical solutions exist to circumvent the ?lter measure proposed by the company that allow Internet users to select the geographical location of their IP address g. use of a VPN). Whatever the circumstances, any Internet users outside of French territory will not be affected by the ?lter measure and will be able to continue to access de-listed information using non- European extensions of the search engine if they reside in the European Union, or any version of ?Google Search? if they are located outside the European Union. The protection of a ?lndamental right cannot vary depending on the data recipient. Both European and French legislation states that an individual can exercise his or her rights with regard to data processing regardless of the recipient. The solution proposed by the company therefore remains incomplete. This additional measure does not meet the objective set by the Directive and restated by the Court of Justice to give EurOpean residents effective and complete protection of their fundamental rights. The Commission is responsible for ensuring compliance with regard to de?listing requests made by French residents. Only a measure that applies to all processing by the search engine, with no distinction between the extensions used and the geographical location of the Internet user making a search, is legally adequate to meet the requirement for protection as ruled by the CJEU. The Restricted Committee considers that, whatever the circumstances, the solution proposed after expiry of the deadline set has not demonstrated compliance with the formal notice procedure and ensured full compliance with the aforementioned Articles 38 and 40. Concerning the penal? and publication In light of the persistent violations of Articles 38 and 40 of the French Act 78-17 of 6 January 1978, as amended, as previously recorded in the formal notice decision adapted by the Commission Chair on 21 May 2015, Google Inc. is hereby issued a public ?nancial penalty to the amount of ?100,000 (one hundred thousand Euros). Given the need to inform search engines and Internet users of the scope of their respective obligations and rights with regard to de-listing, following the Decision of the CJEU of 13 May 2014, which con?rmed the existence of this right, the Restricted Committee has decided to make its decision public. 9 This document is an uno??icial translation of Decision no. 2016-054 of March 10, 2016. Only the French version of this document is deemed authentic. ON THESE GROUNDS The Restricted Committee of CNIL, after deliberation, hereby decides: To issue a ?nancial penalty to the amount of ?100,000 to Google Inc.; To publish its decision. Chair can-Francois CARREZ This decision may be appealed before the French Council of State within two months of noti?cation. 10 This document is an uno??icial translation of Decision no. 2016-054 of March 10, 201 6. Only the French version of this document is deemed authentic.