View source for Persónuvernd (Island) - Case no. 2021101963

{{DPAdecisionBOX

|Jurisdiction=Iceland
|DPA-BG-Color=
|DPAlogo=
|DPA_Abbrevation=Persónuvernd
|DPA_With_Country=Persónuvernd (Island)

|Case_Number_Name=Case no. 2021101963
|ECLI=

|Original_Source_Name_1=Icelandic DPA
|Original_Source_Link_1=https://www.personuvernd.is/urlausnir/birting-leitarnidurstadna-i-leitarvel-google-2
|Original_Source_Language_1=Icelandic
|Original_Source_Language__Code_1=IS
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Complaint
|Outcome=Upheld
|Date_Started=
|Date_Decided=
|Date_Published=11.01.2023
|Year=
|Fine=
|Currency=

|GDPR_Article_1=Article 17 GDPR
|GDPR_Article_Link_1=Article 17 GDPR
|GDPR_Article_2=
|GDPR_Article_Link_2=
|GDPR_Article_3=
|GDPR_Article_Link_3=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=Google LLC
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The Icelandic DPA ordered Google LLC to remove a search result containing an article with a data subject's personal data due to the time that has passed since the events covered in the article occurred and the fact that the data subject no longer held a position of public relevance.

== English Summary ==

=== Facts ===
The data subject is an individual whose personal data was shared through a news article. As the news article was findable by a search query through Google's search engine, Google LLC being the controller, the data subject requested the controller to remove the search result from its database pursuant the data subject's right to be forgotten (Article 17 GDPR). Google denied the request, justifying it by the fact that the news article concerns the data subject's employment in a public setting, which is relevant for the public interest. 

Following Google's response, the data subject submitted a complaint to the Icelandic DPA.

=== Holding ===
In its decision, the DPA noted that it is necessary to assess the legality of the continued processing of the data subject's personal data by weighing the legitimate interests of third parties against the interests and fundamental rights of the data subject. In the case at hand, the financial interests of Google LLC related to its search engine as well as the public interest in being able to access the concerned information were weighed against the data subject's interest in privacy and data protection. 

For such an assessment, the DPA noted that it is particularly relevant if the concerned data subject is a public figure or if they occupy a public position. Should that be the case, this may result in the data subject not enjoying the same privacy protection as private persons due to the importance of the freedom to discuss public matters openly. Although the data subject occupied a public position at the time when the news article was published, the data subject was not involved with projects of public importance at the time when the complaint was filed.   

Due to the amount of time that has passed since the events covered in the news article took place and due the fact that the data subject no longer retained a public decision, the DPA held that the data subject's interest in privacy superseded the public's interest in the information and Google LLC's financial interests. The DPA concluded that the controller should have removed the search result based on the data subject's right to be forgotten and ordered it to do so.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

<pre>
Solutions

Display of search results in the Google search engine

Case no. 2021101963

11.1.2023

In certain cases, people may have the right to have information displayed about them in search engines, e.g. on Google, will be removed. Although the results are removed from search engines, the content will still be on the Internet, but in some cases it is also possible to get it removed.

In this case, it was considered that the complainant's privacy interests and his right to be forgotten outweighed the public's interest in having access to the said information about him. It was therefore proposed to Google LLC to remove certain websites from the search results for the complainant's name in the Google search engine.

----

Personal protection ruled in a case that dealt with the right of a person to have information about him deleted that was published in the search results of the Google search engine, when searching for the person's name.

The conclusion of the Data Protection Authority was that, taking into account the circumstances of the case, the situation of the complainant and the time that has passed since the event discussed in the specified search results, the privacy interests of the complainant and his right to be forgotten were stronger and took precedence over the public's interest in having access to said information about the complainant. It was therefore also the conclusion of the Personal Protection Authority that Google LLC should remove the websites that the complaint covered from the search results for the complainant's name in the Google search engine.

Given that the decision contains detailed information about the complainant, even if personal identifiers were erased, the Personal Protection Agency has decided not to publish the decision in its entirety. However, Personal Protection has compiled an extract from the ruling, which follows.

A complaint was made about the publication of search results in the Google search engine, which referred to articles where the complainant was discussed. The articles discussed a unique incident where a complainant was involved, but nothing criminal took place. Google LLC denied the Complainant's request to remove the aforementioned search results on the basis that the information was related to the Complainant's employment status and his role in the public domain where the Complainant currently holds a management position. In Google's opinion, the personal information that appeared in the press coverage was still considered to serve the public interest.

Personal protection considered that when assessing whether the complainant has the right to delete certain search results that appear when his name is entered into the Google search engine, it is first necessary to examine whether the processing of personal information that takes place during the use of the search engine is supported with authorization according to law no. 90/2018 on personal protection and processing of personal information. Secondly, it would have to be assessed whether the complainant has the right to receive the personal information, i.e. the links and the information that would be published with the search results, deleted on the basis of Article 20 of the same law, cf. also Article 17 of regulation (EU) 2016/679.

The conclusion of the Personal Protection Authority states that it will not be seen that the said processing of personal information can rely on other sources in Article 9. Act no. 90/2018 but No. 6 of the provision. It stipulates that the processing of personal data is permitted if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, in particular when the data subject is a child. In the case, on the one hand, the financial interests of Google LLC related to the search engine, as well as the interests of the public in being able to access information on the Internet, were tested. On the other hand, the complainant's privacy protection interests were tested, but Personal Protection considered that the goal of Act no. 90/2018 to promote the handling of personal data in accordance with the basic principles and rules on personal protection and privacy, cf. Paragraph 1 Article 1 of the law.

In the decision of the Personal Protection Authority, it is stated that when assessing whether the right to be forgotten according to Article 20. Act no. 90/2018, cf. Article 17 of Regulation (EU) 2016/679, is available, can determine whether processing is necessary to exercise the right to freedom of expression and information according to point a, paragraph 3. Article 17, cf. also Article 6 Act no. 90/2018, which stipulates that the provisions of the law and the regulation may be deviated from in favor of the media, art or literature to the extent that it is necessary to harmonize views on the right to privacy on the one hand and freedom of expression and information on the other. It would therefore also have to be considered whether the aforementioned processing by Google LLC was necessary for the public to enforce the right to freedom of information and it could thus set aside the complainant's right to be forgotten according to Article 20. Act no. 90/2018 and Article 17 of regulation (EU) 2016/679, cf. point a, paragraph 3 of the article.

It is stated in the ruling of the Personal Protection Authority that the conclusion on whether the processing of Google LLC is supported by authorization in Act no. 90/2018, on the one hand, and on the other hand, whether the complainant's right to be forgotten should be set aside, turns on an assessment of the different interests weighed in the case. In both cases, the public's interest in being able to access information about the complainant on the Internet, and thus in being able to exercise their right to freedom of information, must be assessed against the complainant's privacy interests. In such an assessment of interests, it is particularly relevant whether the person registered is a public figure or has played a public role. This can lead to the fact that the registered person, due to his position, does not enjoy the same privacy protection as unknown persons due to the importance of discussions on issues that may be relevant to the public. In the opinion of the Data Protection Authority, it was not considered that the complainant was in a similar employment position as he was in when the event that was discussed in the news articles that required removal from search results on the Google web search engine took place. It was also not considered that the complainant's current employment status involved projects that affected the important interests of the public.

The conclusion of the Data Protection Authority was that, taking into account the circumstances of the case, the situation of the complainant and the time that has passed since the event discussed in the specified articles, the privacy protection interests of the complainant would be considered to outweigh the interests of the public in having access to the relevant information. Was the processing by Google LLC of personal information about the complainant that was under review therefore not considered compatible with law no. 90/2018, on personal protection and processing of personal information. In accordance with the complainant's right to be forgotten under Article 20 of the law, cf. c- and d-points 1. paragraph Article 17 Regulation (EU) 2016/679, it was the conclusion of the Data Protection Authority that Google LLC should remove the websites to which the complaint relates from the search results for the complainant's name in the Google search engine.
</pre>