A few months after the European Court of Justice ruled on May 13, 2014 that search engines are considered personal data controllers under the EU Data Protection Directive of 1995 and, as such, should provide data subjects with a right to be forgotten, a French Tribunal enforced this principle in X & Y v. Google France.

In a summary proceeding on September 16, 2014, the Paris Tribunal (Tribunal de Grande Instance) held that Google must erase from its search engine, under penalty of €1,000 per day, all links leading to defamatory content published on Facebook (see attached judgement: TGI Paris – Ordonnance du 16 septembre 2014).

The two claimants had previously obtained a court ruling that certain Facebook comments constituted defamatory material.  Even after Facebook removed the content, Google searches returned the defamatory comments.  When the claimants asked Google to erase the links, the company replied that they must first complete the specific form implemented by the search engine to request deletion of their information from search results.

As a result, the claimants filed suit against Google France to enforce their right to be forgotten.

In order to oppose the claim, Google France argued that:

• it was not a data controller because its objective was only to provide marketing services to clientele using advertising services and not to perform any editorial activity or operate websites;

• that the company liable for Google.fr website was actually Google Inc. which had issued a specific form to request delisting of information; and

• in any case, French court did not have jurisdiction to order erasure measures beyond those related to the Google.fr search engine and intended for a French audience.

However, using the same reasoning as the European Court of Justice, the Paris Tribunal dismissed Google’s arguments.

In that ruling, the European Court held that an individual is entitled to require search engines to remove links and URLs from the list of results displayed following a search of that person’s name.  This means that to enforce the right to be forgotten, an individual does not have to request the deletion of content by a website editor, but can make the request directly to the search engines instead, thereby making the content more difficult to locate on the Internet.

The Paris Tribunal found that: Google Inc. operated the Google.fr search engine; Google France was a wholly-owned subsidiary of Google Inc.; and Google France serves to promote advertising space to ensure the profitability of Google Inc.’s search engine.  As a result, the principles enacted by the EU Data Protection Directive of 1995 apply to Google France.  To justify its reasoning, the Paris Tribunal quoted the May 2014 holding of the European Court of Justice in stating that a subsidiary of Google Inc. established in a European Member State acts as the company’s representative in the Member State, because the activities of parent and subsidiary are indivisible.

According to the Paris Tribunal, the plaintiffs’ claims could not be limited solely to the links returned on Google.fr because Google France did not demonstrate the impossibility of connecting from within French territory by using other domains of Google’s search engine.

By rendering this ruling, the Paris Tribunal showed its willingness to give full effect to the right to be forgotten and consecrates a right to an ‘’e-reputation” and delisting in France.  But, it also suggests that subsidiaries of a search engine could be legally liable for all erasure requests – including those directed at its parent company – pursuant to data protection law.  This signals a possible deviation from traditional corporate law principles that generally respect the distinct boundaries between companies.

This being said, the right to be forgotten is not a new right under French data protection law.  Indeed, article 40 of French Data Protection Act of January 6, 1978 sets forth that “any individual providing proof of identity may ask the data controller to, as the case may be, rectify, complete, update, block or delete personal data relating to him that are inaccurate, incomplete, equivocal, expired, or whose collection, usage, disclosure or storage is prohibited.”

Nevertheless, this ruling raises concerns regarding the reach and application of the right to be forgotten.  Indeed, the right to be forgotten is not absolute and the European Court of Justice clarified that it must be evaluated on a case-by-case basis, accounting for the extent to which the right interferes with the economic interests of search engines.

The ruling also raises the question of how the right to be forgotten should be applied across geographic boundaries.  If search engines are required to erase certain data despite location, search engines could expose themselves to subsequent lawsuits in the event that foreign courts find that data should not have been erased under their own local laws.

However, very recently, Article 29 Group, the body representing the 28 Data Protection Agencies of the EU Member States, issued a set of guidelines on the implementation of the right to be forgotten to evaluate compliance with data protection law and encourage search engines to apply the right to be forgotten across all of their websites and not only to European domains.

The issues surrounding the implementation of the right to be forgotten are just beginning.