FiS - 7565-20: Difference between revisions

Revision as of 09:18, 22 December 2020

FiS - 7565-20

Court:	FiS (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(b) GDPR Article 17 GDPR
Decided:
Published:	23.11.2020
Parties:	Google LLC
National Case Number/Name:	7565-20
European Case Law Identifier:
Appeal from:	Datainspektionen DI-2018-9274
Appeal to:
Original Language(s):	Swedish
Original Source:	The Administrative Court of Stockholm (in Swedish)
Initial Contributor:	Kave Noori

The Administrative Court of Stockholm ( FiS ) rejected Google's request to overturn the Swedish DPA's decision on the company's Article 17 violations. However, the court reduced the fine imposed by the DPA from €7 million to €5,091,000.

English Summary

Facts

This case was initiated when the DPA followed up on an earlier supervisory decision against Google. In the earlier decision, the DPA had ordered Google to remove certain search results relating to a handful of data subjects who had exercised their right to be forgotten under Article 17. Upon follow-up, the DPA found that Google had not fully complied with the previous supervisory decision in relation to two complaints from data subjects.

Additionally, Google routinely notifies webmasters when a search result has been removed from the search results list. This allows the website owner to republish the webpage in question at a different web address, which will then show up in a Google search. This effectively overrides the right to delist. Google considers that informing webmasters is necessary for purposes related to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information under Article 17(3).

The DPA issued a sanction fee because Google failed to comply with the two complaints and because it found that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).

Dispute

Did Google process personal data in breach of the GDPR by not removing some search results relating to the two complaints without undue delay?
Was Google's practice of routinely notifying webmasters of removed search results lawful under the GDPR?
The sanction fee.

Holding

The two complaints

On the question of whether Google had failed to remove search results without undue delay, the court upheld the DPA's decision on one of the complaints and dismissed the other. The latter was dismissed because the court concluded that the actual date on which the DPA's supervisory decision became legally binding was three days after Google removed the search result at issue.

Informing webmasters

The court ruled that Google's routine of regularly sending information to webmasters constituted a processing of personal data incompatible with the purpose for which the data was originally collected, and that there was no legal basis for the processing.

The court clarified that where a search engine invokes a legitimate interest and considers that the removal of a search result infringes freedom of expression and information [Article 17(3)], an assessment of the legitimate interest must be carried out before the search engine agrees to remove the search result. The court held that once a search engine removes a search result, this means that the competing legitimate interests have already been weighed against each other and the result was considered to be in favor of the data subject. The court concluded that a search engine should not undertake a new balancing of legitimate interests as to whether the webmaster should be notified. The court found that carrying out a new balancing of legitimate interests would mean that the data subject's right to be forgotten was not effectively and fully protected.

Sanction fee

While the court found Google's practice unlawful, it also ruled that the fine imposed on Google for failing to delete individual search results without undue delay should be substantially reduced. The reduction was due to the fact that the findings of the DPA on one of the complaints were rejected. The Administrative Court therefore reduced the penalty fee from a total of SEK 75 million to SEK 52 million.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Google's routine violates the GDPR
Dimensions: 7565-20
Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". In a judgment today, the Administrative Court has found that this is not permitted under the Data Protection Regulation (GDPR).
The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name.

Google believes that webmaster information is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information.

On the other hand, the Court has ruled that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.

- The court has found that Google's procedures regarding requests to remove search hits are contrary to the Data Protection Ordinance, says lawyer Stefan Holgersson

However, the Court finds that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The Administrative Court therefore reduces the sanction fee from a total of SEK 75 million to SEK 52 million.

@@ Line 50: / Line 50: @@
 }}
-The Administrative Court of Stockholm (FiS) rejected Google's motion of repealing the Swedish DPA's decision on Article 17 violations by the company. However, the Court did lower the fine imposed by the DPA from €7 million to €5,091,000.
+The Administrative Court of Stockholm ( FiS ) rejected Google's request to overturn the Swedish DPA's decision on the company's Article 17 violations. However, the court reduced the fine imposed by the DPA from €7 million to €5,091,000.
 ==English Summary==
 ===Facts===
-This case was initiated when the DPA followed up a previous supervisory decision against Google. In the previous decision the DPA had ordered Google to remove certain search results concerning a handful of data subjects who exercised their right to be forgotten pursuant [[Article 17 GDPR|Article 17]]. During the follow up the DPA found that Google had failed to fully comply with the previous supervisory decision in relation to two complaints from data subjects.
+This case was initiated when the DPA followed up on an earlier supervisory decision against Google. In the earlier decision, the DPA had ordered Google to remove certain search results relating to a handful of data subjects who had exercised their right to be forgotten under [[Article 17 GDPR|Article 17]]. Upon follow-up, the DPA found that Google had not fully complied with the previous supervisory decision in relation to two complaints from data subjects.
-Additionally, Google routinely informs webmasters when a search result has been removed from the list of search results. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. This in practice puts the right to delisting out of effect. Google believes that informing webmasters is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information pursuant [[Article 17 GDPR#3|Article 17(3)]].
+Additionally, Google routinely notifies webmasters when a search result has been removed from the search results list. This allows the website owner to republish the webpage in question at a different web address, which will then show up in a Google search. This effectively overrides the right to delist. Google considers that informing webmasters is necessary for purposes related to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information under [[Article 17 GDPR#3|Article 17(3)]].
-The DPA issued a sanction fee because of Googles failure to comply with the two complaints and because it determined that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).
+The DPA issued a sanction fee because Google failed to comply with the two complaints and because it found that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).
 ===Dispute===
-#Did Google process personal data in violation of the GDPR by failing to remove some search results relating to the two complaints without undue delay?
+#Did Google process personal data in breach of the GDPR by not removing some search results relating to the two complaints without undue delay?
-#Was Google’s practice of routinely informing webmasters about removed search results lawful under the GDPR?
+#Was Google's practice of routinely notifying webmasters of removed search results lawful under the GDPR?
 #The sanction fee.
 ===Holding===
 ====The two complaints====
-Regarding if Google had failed to remove search results without undue delay, the Court upheld the DPA’s decision concerning one of the complaints and dismissed the other one. The latter was dismissed when the Court concluded that the actual date at which the DPA’s supervisory decision become legally binding, was three days after Google had removed the search result in question.
+On the question of whether Google had failed to remove search results without undue delay, the court upheld the DPA's decision on one of the complaints and dismissed the other. The latter was dismissed because the court concluded that the actual date on which the DPA's supervisory decision became legally binding was three days after Google removed the search result at issue.
 ====Informing webmasters====
-The Court held that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.
+The court ruled that Google's routine of regularly sending information to webmasters constituted a processing of personal data incompatible with the purpose for which the data was originally collected, and that there was no legal basis for the processing.
+The court clarified that where a search engine invokes a legitimate interest and considers that the removal of a search result infringes freedom of expression and information [Article 17(3)], an assessment of the legitimate interest must be carried out before the search engine agrees to remove the search result. The court held that once a search engine removes a search result, this means that the competing legitimate interests have already been weighed against each other and the result was considered to be in favor of the data subject. The court concluded that a search engine should not undertake a new balancing of legitimate interests as to whether the webmaster should be notified. The court found that carrying out a new balancing of legitimate interests would mean that the data subject's right to be forgotten was not effectively and fully protected.
-The Court made it clear that if a search engine relies on legitimate interest and believes that removing a search result goes against the freedom of expression and information [Article 17(3)], a legitimate interest assessment must be carried out before the search engine agrees to remove the search result. The Court found that once a search engine removes a search result, it means that conflicting legitimate interests have already been weighed against each other and the outcome was deemed to be in favor of the data subject. The Court concluded that a search engine is not supposed to conduct a new legitimate interest assessment regarding if the webmaster should be notified. The Court held that conducting a new legitimate interest assessment would mean the data subject’s right to be forgotten is not afforded effective and complete protection.
 ====Sanction fee====
-While the Court found Google's practice to be unlawful, it also ruled that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The reduction was due to the dismissal of the DPA’s findings regarding one of the complaints. The Administrative Court therefore reduced the sanction fee from a total of SEK 75 million to SEK 52 million.
+While the court found Google's practice unlawful, it also ruled that the fine imposed on Google for failing to delete individual search results without undue delay should be substantially reduced. The reduction was due to the fact that the findings of the DPA on one of the complaints were rejected. The Administrative Court therefore reduced the penalty fee from a total of SEK 75 million to SEK 52 million.
 ==Comment==
 ''Share your comments here!''