Key takeaways

• In its 2014 Google ruling on the “right to be forgotten”, the European Court of Justice held that, because individuals had the right to control the use of their personal data, they could request that a link giving access to such data be delisted from a search engine’s results.
• Google may now face sanctions of up to € 300,000 from the France’s data protection authority, the Commission Nationale de l'Informatique et des Libertés (“CNIL”), which has ordered Google to de-list several third-party links from search results across all of Google’s worldwide search websites, including “google.com” – not only from its domains directed towards Europe, such as “google.fr.” Firms in the U.S. should be aware that they may face increasing compliance obligations with EU policies concerning data protection and privacy, so long as they have a subsidiary or branch in Europe.
• This is illustrative of current trends in European data protection litigation and enforcement – indeed, a draft policy proposed on June 15, 2015 by the Ministers in the European Justice Council shows an increasing trend in Europe towards the protection of individuals’ data and privacy.