In Google Spain SL, Google Inc. v Agencia Española de Protección de Datos(2014), the Court of Justice of the European Union recognised the right to delisting (A.K.A "right to be forgotten"), whereby individuals are able to apply to search engines (in this case Google) to remove certain linked results which appear when the applicant's name is searched. Google was found to be a "data controller" as defined in Directive 95/46/EC on personal data. Article 12 of the directive requires the controller to ensure "the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data".
According to an article by CNIL, the French National Commission on Informatics and Liberty, Google has received tens of thousands of requests for delisting since the Court's decision, and has delisted names on a number of its European sub-domains (such as its .uk and .fr sites). However, Google has thus far resisted any delisting on its non-European sub-domains or its main .com domain, which is of course accessible globally.
This prompted a formal notice issued in May by CNIL's president requiring Google to comply with delisting requests concerning all of its domains which, according to CNIL's website, was followed in June by an informal appeal by Google for the removal of that public notice. In a statement issued 21 September, CNIL's President rejected this appeal, threatening to "designate a Rapporteur who may refer to the CNIL's sanctions committee with a view of obtaining a ruling on this matter".
A new General Data Protection Regulation was proposed in 2012 by the European Commission, whose website confirms that completion of this reform is a policy priority for 2015. Article 17 of the proposed Regulation would elaborate on the rights in the current directive, providing "the conditions of the right to be forgotten, including the obligation of the controller which has made the personal data public to inform third parties on the data subject's request to erase any links to, or copy or replication of that personal data".
Google's reaction to calls by CNIL for wider implementation of the right to be forgotten remains to be seen. In the meantime, following the Council's adoption of a general approach in June, a trilogue is now under way with a view to delivering the completed Regulation by the end of the year.
