French data regulator, CNIL, ordered the tech giant in May to apply “right-to-be-forgotten” removals not only to its European domains, but also to its global domain google.com. The company filed an informal appeal to the president of CNIL in a few weeks against the order, explaining that such a move would impede the people’s right to information, represent a form of censorship and cause serious chilling effects on the web.

However, Google’s appeal was rejected, with CNIL saying that once a delisting has been accepted under the “right-to-be-forgotten” ruling, the search results must be delisted across all extensions of the search engine. Otherwise, this would allow the ruling to easily be bypassed. In the meantime, the data regulator stressed that this decision did not show any willingness of the watchdog to apply French law extraterritorially. CNIL insists that it just has to request full observance of European law by foreign companies offering their services in Europe.

Now Google must comply with the order and remove all search results under the “right-to-be-forgotten” ruling from its google.com and other non-European domains. At this stage, Google cannot appeal the order under French law. On the other hand, the French watchdog can apply sanctions including a fine about €300,000 against Google, if the company ignores its order. According to industry experts, under incoming European regulation the fine could increase to 2%–5% of global operating costs. Only after being fined, Google can appeal the decision with the French supreme court for administrative justice.

Google assured its users that the company has worked hard to implement the “right-to-be-forgotten” ruling in Europe, and will continue to do so. However, it respectfully disagrees with the idea that some local data protection authority has powers to assert global authority to control what people can access all over the world.

It should also be noted that the order is breaking new ground in making the local subsidiary of the company, Google France, liable for the activities of its parent company. Should the French data regulator succeed, it is likely to have a significant impact on the application of “right-to-be-forgotten” rulings.