Personvernnemnda (Norway) - 2021-05 (20/02912)

Datatilsynet (Norway) - 20/02912 (PVN-2021-05)
Authority:	Datatilsynet (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 17(1)(c) GDPR Article 21 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	18.05.2021
Published:
Fine:	None
Parties:	Complainant Google LLC.
National Case Number/Name:	20/02912 (PVN-2021-05)
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Norwegian
Original Source:	Personvernnemda (in NO)
Initial Contributor:	n/a

The Norwegian Privacy Board (Personvernnemda, PVN) upheld a decision by the Norwegian DPA (Datatilsynet) to reject a complaint requesting delisting of a search result connected to the complainant.

English Summary

Facts

The complainant objected that when he searched for his name, search results concerning him were listed on Google. The search result linked to a news/consumer report where the complainant was interviewed in his role for a company he represented. The complainant filed a complaint with Datatilsynet, which rejected his complaint based on an assessment of the balancing of interests in Google's favour. The complainant then appealed the complaint to PVN.

Holding

The PVN issued a split decision, where the majority agreed with Datatilsynet that the search result should not be delisted.

In particular the following elements in the decision were emphasised:

• None of the personal data concerned information covered by Article 9 or 10 GDPR.
• The data subject was interviewed as part of his role in the business, and not as a private individual.
• It had only been two years since the interview, and the data subject had the same role in the same company.
• The interview gave a correct impression at the time it was published (though the company later won in court concerning the same case).

Personvernnemda did not give the data subject's subjective feelings connected to the search result a decisive influence in the outcome.

Comment

Personvernnemda refers to Google Spain (131/12) and G.C. & Others v CNIL (136/17), as well as earlier decisions by PVN: PVN-2019-02, PVN-2020-08 and PVN-2020-14. In addition, they referred to guidelines by EDPB (05/2019 - and in particular para. 44-52).

While the decision is decided under Article 17(1)(c), it is not obvious how it reflects the standards for deletion/delisting under those articles in the GDPR, as opposed to the older CJEU-decisions referenced.

It follows from the EDPB guidelines (05/2019) and the wording of Article 21 itself that the search engine provider have the burden to provide compelling legitimate grounds to refuse the request (p. 9). It is not clear if that was a topic in the decision, although the minority vote emphasised that the presumption according to Article 21 is that the data subject should have the search result delisted.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.

    
                  
    The Data Inspectorate's reference: 20 / 02912-2 The Privacy Board's decision 18 May 2021 (Mari Bø Haugstad, Bjørnar Borvik, Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem, Morten Goodwin)

The case concerns an appeal from A against the Data Inspectorate's decision of 22 October 2020 rejecting a claim for deletion of search results in the search engine Google.

Background to the case

The case has its background in an interview in the TV channel TV2 with service manager A in [motorhome dealer AS]. A was interviewed in connection with the recording of the TV program «TV2 helps you». The interview, which is available on TV2's website https: […] comes up when searching for A's name in the search engine Google. The search meeting is dated 2019. In the interview with the headline «[…]», A elaborates on why [motorhome dealer AS] believes that the criteria for canceling the motorhome purchase in the case discussed in the specific program are not present. In a judgment from the district court, [motorhome dealer AS] was sentenced to cancel the motorhome purchase and to pay compensation to the buyer of the motorhome.

A contacted Google on February 6, 2020 and requested the deletion of the following search results for his name in the Google search engine:

a. https: […]

b. https: []

In an email to A on June 9, 2020, Google denied the deletion request.

A brought Google's refusal to the Data Inspectorate on 24 June 2020 and asked for assistance in deleting the search results that lead to the TV2 case by searching for his name in Google.

The Data Inspectorate only assessed search results a https: […], in that search results b https: […] do not appear in Google when searching for the name «A».

The Data Inspectorate made a balance of interests between the consideration of freedom of information and the public's interest in having access to the search match by name search and A's right to protest that the search match is displayed, and rejected A's request for deletion in a decision of 22 October 2020.

A submitted a timely appeal against the Data Inspectorate's decision on 3 November 2020.

The Data Inspectorate assessed the complaint, but found no reason to change its decision. The case was sent to the Privacy Board on 23 March 2021. The parties were informed of the case in a letter from the board on 26 March 2021, and were given the opportunity to comment. Google has submitted comments in a letter dated April 16, 2021, which A has commented on in an email on April 22, 2021.

The case was discussed at the tribunal's meeting on 18 May 2021. The Privacy Committee had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem and Morten Goodwin. Secretariat leader Anette Klem Funderud was also present.

The Data Inspectorate's assessment in outline

The Norwegian Data Protection Authority initially states in the decision that the authority is the right supervisory authority and has competence to process the case, and that section 3 of the Personal Data Act does not apply to cases concerning the deletion of search results.

The Data Inspectorate then explains the legal starting points in the case and refers to the Privacy Ordinance, Article 6, No. 1, letter f, as the relevant valid basis for processing, as well as Article 21, No. 1 on the data subject's right to protest. Furthermore, reference is made to the former Article 29 group's (the forerunner of the Privacy Council under the Privacy Ordinance) guidelines on how privacy and freedom of information are to be weighed in cases concerning deletion of search hits, which are still considered relevant even after the entry into force of the Privacy Ordinance.

The Data Inspectorate assumes that consideration for the data subject, as a general rule, weighs heaviest if the person in question actively requests that the search result should not appear when searching for the data subject's name. The question in the case is whether there are compelling justifiable reasons which indicate that considerations of A's privacy must give way to public interests. Relevant aspects of the assessment will include the context in which the search match is published, whether the search match relates to the data subject's private life or professional practice, whether the information is published by the data subject himself, and whether the information is relevant and up to date.

After a concrete balancing of interests out of consideration for A's privacy weighed against the public's interest in continued processing, the Data Inspectorate concludes that A's protest that search results a: https: […] displayed by name search cannot be taken into account. The freedom of information and the public's interest in having access to the search match by name search constitute in this case compelling justified reasons that precede A's protest, cf. the Privacy Ordinance Article 21 no. 1, cf. the Personal Data Act § 1.

In the assessment, the Data Inspectorate attaches crucial importance to the fact that the search meeting does not relate to the complainant's personal life, but that the complainant acts on behalf of the company he is employed in, it is a relatively short time since the search meeting was published, complainants still work in the same company. the search hit is published by an established news medium under the Vær Varsom poster.

The Data Inspectorate reports that the audit, when searching for A's name, gets a search result that leads to a feature on TV2. It is this search result that the Data Inspectorate has considered in the case. Search hits b do not appear when searching for A's name and there is therefore no basis for assessing whether Google should be ordered to delete this.

A view of the case in outline

When searching for his name in the search engine Google, the feature from the TV2 case appears on page one in the list of search results. His face is clearly visible. He has not approved that his name should be used in such a context, and he does not want any connection to the TV2 case.

The web editor of TV2 will not delete the links to his name.

Search hits on his name in Google that lead to the feature from "TV2 helps you" must be removed. [bobilforhandler AS], in which he works, must be linked to the TV2 feature, but the link to his name must be removed.

He accepted that the feature was shown on TV2 for the first time as a broadcast feature on TV, but not that the search hit for years would appear in Google by searching for his name.

He stood out as a representative of the company, not himself. The TV2 case is not about him or his life.

It is stressful to receive sarcastic comments and slanderous remarks "there is he who was on TV, etc.", two years after the case is resolved. He experiences his privacy and private life violated.

Google's views on the matter in outline

Google has received a request for deletion of two search hits from A, and concluded on 9 June 2020, after a specific balancing of interests, that there are compelling justified reasons for the processing of search hits a, cf. the Privacy Ordinance Article 21 no. 1, cf. the Personal Data Act § 1 For search match b, it was pointed out that the relevant search match did not appear when searching for A's name.

Google agrees with the Data Inspectorate's assessments in the case. The Authority's decision of 22 October 2020 is correct.

The URL (search hit a) contains a video, which is produced and published by the news channel TV2, an established news medium under the Vær Varsom poster. The video interview was deliberately published in the public space in a case concerning [bobilforhandler AS ’] professional activities in connection with an investigated consumer case. It is the role of the media to judge what is in the public interest and to disseminate the information to the public. Where the media has decided to publish a particular case, Google takes into account the news media's journalistic assessments when Google assesses what information is relevant and in the public interest.

In the video, A expresses himself in the role of service manager for [bobilforhandler AS], which he has agreed to. He acts as a representative of the company and explains the reasons why the company does not reimburse an allegedly defective motorhome. The search match does not relate to A's personal life.

As far as Google understands, A still holds the same role in the company. The case may therefore be relevant for future customers and business partners who relate to A in his role as service manager.

The post was published in 2019. In a news context, this is a short time, which clearly indicates that the case still has news value and that the search hit is in the public interest.

There is no information to indicate that the search result entails a particularly burdensome strain for the registered person.

Google has a legal basis for the processing of the Privacy Regulation Article 6 (1) (f), and it is therefore not necessary for the data subject to consent to the processing of Google.

The Privacy Board's assessment

The Privacy Board will decide whether Google should be ordered to delete the relevant search match in A's name that leads to a video interview with A in the feature from TV2 helps you, search match a: https: […]

With regard to search results b: https: […], the tribunal agrees with the Norwegian Data Protection Authority that this is not a search result that now appears when searching for A's name, and it is therefore not necessary to consider whether Google should be ordered to delete this search result.

The legal basis for the assessment

When a search engine collects personal data and presents search results to the public, this represents a processing of personal data regulated by the Privacy Ordinance, cf. Article 4 no. 2. The search engine provider is responsible for the processing of personal data that takes place in that connection, cf. Article 4 no. 7. This is also based on the European Court of Justice, both in judgment C-131/12 of 13 May 2014 (Google Spain and Google) and in judgment C-136/17 of 24 September 2019 (GC & Others in CNIL). This is also in line with established administrative practice from the Norwegian Data Protection Authority and the Privacy Board, see for example PVN-2019-02, PVN-2020-08 and PVN-2020-14.

Although the above-mentioned judgments of the European Court of Justice directly clarify the understanding of the EU Privacy Directive (Directive 95/46), the judgments are relevant for the interpretation of the new Privacy Regulation. This is because the provisions in the regulation on what constitutes the processing of personal data and who is to be regarded as the data controller is a continuation of the provisions in the directive.

Like the Norwegian Data Protection Authority, the tribunal assumes that it is the Privacy Ordinance, Article 6, No. 1, letter f, which in principle provides Google with a processing basis for collecting personal data and presenting search results to the public.

As A has protested against the processing of personal data, cf. Article 21 (1) of the Privacy Ordinance, it follows from Article 17 (1) (c) that Google has a duty to delete the data (ie remove the search hit) unless it is more weighty. justified reasons for the processing that take precedence over the data subject's interests, rights and freedoms. In other words, a balance of interests must be struck between the data subject's interest in having the search match deleted, against the public's interest in gaining easy access to this information via a search engine. In this connection, the tribunal would like to point out that deleting search results from a search engine is not about removing the information from the Internet as such. All information will still be available on the original websites, such as the websites of newspapers and other mass media, and on these websites the information will still also appear by name search. Furthermore, the information will be available from search engines, but then keywords other than personal names, such as the subject of the case, must be used, or it must be searched via a non-European IP address.

In the case of Google Spain and Google, the European Court of Justice points out that the search engine provider's processing of personal data differs from, and represents something in addition to, the processing done by the publisher of websites (section 35). This means that the outcome of the balance of interests that the directive provides guidance on may be different for the search engine provider than for the publisher of the Internet pages. This may be partly due to the fact that the interests that justify the processing of personal data may be different, and partly it may be due to the fact that the consequences of data processing will be different. The European Court of Justice ruled in Google Spain and Google that anyone who offers search engine services may have an obligation to delete a search result at the request of the search result, even if the publisher of the website has a processing basis for publishing the information on his website (section 88). This position is continued in G.C. & Others v CNIL (Section 52).

As this case concerns a published video interview on one of TV2's platforms, the processing of personal data that takes place there will be covered by the exception in the Personal Data Act § 3, and the data subject will have no claim to have the data deleted. from TV2's website.

Regarding the specific balance of interests for the search engine's processing of personal data, the European Court of Justice in Google Spain and Google, section 81 (official Danish translation) says:

'Although the rights of the person concerned protected by these Articles also generally outweigh the interests of Internet users, this trade-off may in specific cases depend on the nature of the information in question and how sensitive it is to the person concerned. person's privacy, as well as the public's interest in having this information, which i.a. may vary depending on the role of this person in public life. "

The Privacy Council has published a guide concerning the right to be forgotten by a search engine, cf. «Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engine cases under the GDPR (part 1) - version adopted after public consultation »Of 7 July 2020. The guide has been published in the wake of Google Spain and Google and GC & Others v CNIL, replacing the guide previously developed by the Article 29 Working Party. The tribunal assumes that the Privacy Council's guide, like the Article 29 Working Party's guide, has limited weight as a source of law, but provides useful guidance as an expression of administrative practice in the audits in the EU and the EEA. For the balancing of interests to be done in this case, the tribunal refers to sections 44 to 52 in the guide from the Privacy Council.

The concrete balance of interests

In the specific balancing of interests, the tribunal has been divided into a majority and a minority. The majority - consisting of Haugstad, Coll, Blinkenberg and Goodwin - have come to the conclusion that the Data Inspectorate's decision must be upheld.

The majority points out that the information that emerges in the video interview applies to [motorhome dealer AS], where A as service manager speaks on behalf of the company about a cancellation claim directed at the company. The information is therefore related to A's professional life and not his private life. It is also not about information that is covered by the special categories of personal data, cf. Article 9 of the Privacy Ordinance, or other information that is subject to special rules, cf. Article 10. There is therefore, in the majority's view, nothing about the nature of the information in itself which indicates that the search match should be deleted.

Furthermore, the majority point out that the actual publication of the video interview took place for journalistic purposes. Although the search engines' processing of personal data differs from, and represents something in addition to, the processing of personal data made by the person who publishes a video interview on a website, the fact that the original publication took place for journalistic purposes will be a factor that indicates that the search hit should not be deleted.

It is the majority's assessment that A, by being the person who speaks on behalf of the company in the media in the case, must also in principle find that the media's coverage of this appears when searching for his name. This applies even if you find the same information if you search by company name.

How much time has passed is also important. In this case, the search hit is just over two years old (published in 2019). The dispute that the TV2 broadcast mentioned was dealt with in the district court one year later, in 2020, where the customer's cancellation claim was upheld. It shows, in the majority view, that the case in question is of current public interest, including for future customers and business partners [motorhome dealer AS], where A is still the service manager and holds the same role.

In the majority's opinion, the published interview gives a correct representation of the case and the company's view of the case at the time the interview was published, in 2019. The fact that the company subsequently lost in the district court and the motorhome seller prevailed is not a matter in a case. as this indicates that the search results for the TV feature should be deleted.

The search results' consequences for the registered person are also important. It is expressly stated by the European Court of Justice in Google Spain and Google that the right to be forgotten is not conditional on the relevant personal data having entailed negative consequences ("damages") for the data subject. If there are sufficient grounds for such consequences, there will, however, be a factor that points in the direction of the registered person being granted the claim for deletion. For the question of what consequences the treatment has actually had, it must be possible to use a more objective assessment based on the facts of the case.

A has pointed out that he as a private person experiences the search hit, where his face is clearly visible, as stressful. The majority sees no reason to doubt this. However, no decisive weight can be attached to the majority's assessment. The information that emerges is not related to A's private life, and it is clear from the feature that A speaks on behalf of his employer.

The majority of the tribunal then agrees with the Norwegian Data Protection Authority that the public's right to information when searching for A's name, taken as a whole, outweighs A's right to privacy by having the search hit deleted. In the majority's opinion, there are compelling justifiable reasons for further processing of the application and A is not upheld in his appeal.

The minority - consisting of Borvik, Graasvold and Tessem - views the specific balancing of interests differently, and believes that A should be upheld in its demand for deletion of search results a.

The minority agrees with the majority that the information in the TV2 interview that the search results lead to does not concern A's private life, but his work as service manager at [motorhome dealer AS]. In this sense, there is nothing about the nature of the information per se that draws particularly heavily in the direction that A should be upheld in its claim.

However, the minority will note that A does not hold a position that brings him into the categories of people who must find themselves in a greater degree of publicity than the general population. As the minority sees it, A acts as a representative of the company in the interview with TV2, and he explains the company's assessment of the relevant complaint case. The fact that A is the service manager in the company is, in the minority's assessment, of secondary importance in the balancing of interests. In other words, there are no circumstances in his person that indicate that the public must be able to find this search result by searching for A's name.

Central to the minority's assessment is that the public's need for information is fully taken care of, even if A is upheld in the requirement that search results a should not appear when searching for his name. The minority assumes that the general public has a legitimate need for information about how [bobilforhandler AS] generally treats its customers, and that there is a special need for information about how the company handles complaints. Such information will be made available to the public by a search of the company name [bobilforhandler AS]. The minority, on the other hand, finds it difficult to see that people who are considering buying a motorhome find it obvious to search for A's name. Searching for the company name [bobilforhandler AS] results in a hit that leads to an updated article on TV2.no about the current complaint case. The article is entitled «[…]», and it appears, among other things, that [bobilforhandler AS] has accepted the judgment from the district court which upheld the buyer. This article also contains the video that the search results lead to. The minority therefore believes that the public's need for information is secured.

The minority also finds reason to point out here that the TV2 interview that the search results a lead to is accompanied by the headline […]. In other words, the search meeting leads to information about the current complaint case that is no longer updated. The minority does not deny that the headline accompanying the TV2 interview that the search results lead to was adequate at the time of publication, but when it comes to assessing the public's need for information today, the minority finds it difficult to see that out-of-date information is particularly suitable. to meet the public's need for information. The principle in Article 5 (1) (d) of the Regulation ("correctness") therefore also dictates that A is upheld in its claim that search a be deleted.

In the minority's opinion, there is no reason to deviate from the main rule of the Privacy Ordinance, namely that if the data subject objects to the processing of personal data, cf. Article 21 (1) and Article 17 (1) of the Regulation. letter c, then there is a presumption that the registered person will be granted the claim for cancellation of the search match.

After this, the tribunal makes decisions in line with the majority's view.

Conclusion

The Data Inspectorate's decision not to order the deletion of search results is upheld.

The decision was made with the dissent stated above.



Oslo, 18 May 2021

Mari Bø Haugstad
Manager