A Question Over the Reach of Europe's 'Right to Be Forgotten'

A Danish lawyer who has lived in Paris for 30 years, Shefet has been accused online of professional malpractice, fraud and even having connections to the Serbian mafia - accusations he strongly denies.

"It's been nightmarish. It's affected my entire family," Shefet, 60, said at his somewhat cluttered office in central Paris. "As a lawyer, I live and die by my reputation."

So in 2013, Shefet asked Google to take down links to the defamatory material. The search engine complied, but only on its French site, meaning anyone outside France could still see the items in question.

Then last year, after Europe's highest court ruled that anyone with connections to Europe could ask that links about themselves be removed from search results, Shefet took a different approach.

He sued Google's French unit - citing the so-called right-to-be-forgotten decision - and asked a Paris court to force the company to remove the links not just in France but in all of the company's global search engine domains.

(Also see: EU Says Google Should Apply 'Right to Be Forgotten' on Global Results)

And he won - perhaps setting a precedent that the European ruling should apply far more broadly than originally understood.

In the judgment for Shefet, the French judge relied on a specific point of the recent privacy ruling that said a company's local subsidiary could be held liable for the activities of its parent. The judge ordered Google's French subsidiary to pay daily fines of roughly $1,100 until links to the defamatory content were removed from all searches worldwide.

"Google put up a hell of a fight. But they lost," Shefet said. "Now if Google doesn't comply, they will be fined."

Google says it has already removed the defamatory links from its search results in Europe, and it argues that the Paris court's decision does not specifically demand that the company's non-European domains must comply with the judgment. Although Google is being fined, no payments have been made.

Still, Shefet's case has raised a central question about Europe's data protections rules: How far can the Continent impose its own strict privacy laws on sites that operate outside Europe, including those of Google, Microsoft and Facebook?

The ability for Europe to enforce the region's privacy rules beyond its borders will be a major part of a report soon to be published by a committee set up by Google. The report, expected to be released by mid-February, will counsel the company on how to handle Europe's right-to-be-forgotten standard. The company has complied with roughly 40 percent of the 760,000 link-removal requests that it has received over the past eight months, according to the company's latest transparency report.

The advisory group includes Jimmy Wales, the founder of Wikipedia, who has been a vocal opponent of the European privacy decision, as well as a number of leading data protection academics.

But after holding a number of public meetings across Europe, the committee remains divided over whether Google should impose the right-to-be-forgotten decision on all of its global search results, according to several people with direct knowledge of the matter who spoke on condition of anonymity because the report had yet to be completed.

Despite the differing views, however, the majority of the group is expected to recommend that Europe's standard should only apply within the 28-country bloc, according to one of the people. That would support Google's efforts to limit the privacy decision so that its search results outside the European Union would remain unaffected.

"It's our strong view that there needs to be some way of limiting the concept because it is a European concept," Google's top lawyer, David Drummond, told an audience in Brussels in January, referring to the right-to-be-forgotten ruling. "We've had a basic approach. We've followed it; on this question we've made removals Europewide, but not beyond."

Google's position has put it at odds with many of Europe's privacy watchdogs, which are concerned that people - both inside and outside Europe - can sidestep the region's stringent privacy rules simply by using a non-European web address. While links on European sites like Google.fr and Google.de may be removed, for example, other domains like Google.com would not be affected.

Already, European regulators have issued guidelines calling on Google to apply the right-to-be-forgotten ruling to its entire search empire.

As people like Shefet increasingly take Google and others to court to force them to remove links from global search results, the battle over whether people have the right to be forgotten online is set to intensify.

"The European court's judgment will have profound consequences," said Shefet, who now advises others on how to demand that links to content be removed worldwide. "The floodgates have opened."

© 2015 New York Times News Service