Questions relating to the applicable law and identifying the correct defendant are particularly complex when the dispute concerns the Internet, and in particular when dealing with data protection issues.

Consider the following hypothesis: a data controller (website publisher, ISP, search engine, etc.) is located on foreign soil, but has a subsidiary in France that is potentially liable for the failure to respect data privacy rights of a French Internet user.

The French Internet user who intends to bring an action against the data controller must ask himself the following questions:

• Is French law applicable to rule on the liability of the data controller?

• Which entity must the French Internet user sue? Can he hold the French subsidiary liable for the violation the data privacy rights he suffered?

These questions were answered very recently by the courts of Paris, in two summary judgments rendered on September 16^th, and December 19^th of 2014, relating to the search engine giant Google. In both cases, individuals, invoking their right to be forgotten, asked Google to remove certain hyperlinks.

1/ Regarding the Applicable Law

It should first be noted that article 5 of the French Data Protection Act (dated January 6^th, 1978) provides:

« The processing of personal data is subject to this act when:

1° The data controller is deemed to be established on French territory. The data controller who carries out his activity on French territory within an establishment, whatever its legal form, is considered established on French territory ».

Accordingly, pursuant to this Article, the establishment on French soil by a data controller renders French law applicable.

What of Google?

It is first important to note that the processing of personal data via Google’s search engine is directed and controlled by Google, Inc., based in the United States. The American giant only uses its subsidiaries (including its French subsidiary) to promote, facilitate, and carry out the sales of its online advertising products and services in the country in which the subsidiary is established. Such a subsidiary does not perform any processing of personal data.

However, the Paris civil court of first instance, held that notwithstanding that Google France does not perform any data processing, it qualifies as an establishment under article 5-1 of the French Data Protection Act because its activities relate to the sale of advertising space are inextricably linked to those of Google Inc. that operates the search engine.

French law is consequently applicable in respect of the data processing performed by Google.

2/ Which entity to sue?

Now that we have resolved the question of applicable law, it remains to be determined against which company legal action should be taken. In this respect, the above-mentioned summary judgments of the Paris civil court of first instance are in complete opposition.

In its summary judgment dated September 16^th, 2014, the Court held that the plaintiff’s claims against Google France were admissible and ordered the company to remove several links to content deemed defamatory.

The Court advanced arguments previously formulated by the ECJ in its notworthy decision dated May 13^th, 2014, that established the right to be forgotten, and in particular noted that:

1. If Google Inc. is in fact the operator of the search engine, the activity of Google France, its wholly-owned subsidiary, which sells advertising space connected the U.S. search engine, finances Google Inc. through such activities.
2. The “activities of the operator of the search engine and those of its establishment located in the Member State are inextricably linked”.

On the other hand, surprisingly, in its most recent summary judgment, dated December 19^th, 2014, the Paris court held that the right to be forgotten could only be exercised against Google, Inc. given that Google France does not exploit, whether directly or indirectly, the search engine, and does not qualify as the data controller.

As a result, the question of which entity to sue, that seemed to have been resolved by the ECJ, remains unclear. Until such time as there is established case law on the matter, any plaintiff who wishes to invoke the right to be forgotten by removing links to defamatory content, would be prudent to sue both Google France and Google, Inc.

The current legal uncertainty is problematic for any potential plaintiff who will be compelled to sue Google, Inc. and will thus be faced with long and expensive court proceedings. Further, in the event of legal action, the plaintiff will have to endure the damaging articles published online for a longer period of time.