Personvernnemnda (Norway) - 2021-18 (20/02059)

PVN (Norway) - 2021-18 (20/02059)
Court:	PVN (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 5(1)(d) GDPR Article 6(1)(f) GDPR Article 10 GDPR Article 17(1)(c) GDPR Article 21(1) GDPR
Decided:	15.02.2022
Published:	15.02.2022
Parties:	Google
National Case Number/Name:	2021-18 (20/02059)
European Case Law Identifier:
Appeal from:	Datatilsynet (Norway) 20/02059
Appeal to:
Original Language(s):	Norwegian
Original Source:	Personvernnemda (Norway) (in Norwegian)
Initial Contributor:	Rie Aleksandra Walle

The Privacy Appeals Board upheld a DPA decision agreeing with Google in keeping search results relating to a complainant's criminal past, including prison time and a $550,000 damages claim, because they were still of public interest, especially since the complainant now acted as CSO in a company planning to go public.

English Summary

Facts

This case is an appeal of a decision by the Norwegian DPA, in which they instructed Google to delete one search result, but denied the complainant's erasure request for the two other search results.

The Board agreed with the DPA in that Article 6(1)(f) legitimate interest is the correct lawful grounds and, in particular, their reasoning around the processing of personal data subject to Article 10 GDPR.

In their balancing of interests, they found the following matters to support the complainant's erasure request:

• First, when a data subject actively requests erasure, cf. Article 21(1) GDPR, their the interest should by default outweigh the search engine's interests. This is reinforced when Article 10 GDPR personal data is involved.
• Second, as the complainant was sentenced in 2011 and had served his prison time by 2016, the search results relates to old matters.
• Third, the personal data should be correct and up to date, cf. Article 5(1)(d), cf. the Article 29 Group's criteria number 4 and 7 in their WP225 guidelines. The 2011 ruling included a ban on the right to run a business, however in 2019 a court removed this ban so that the complainant could become a general manager in the company where he had worked as a project coordinator and project leader for several years. This is the same company where he was now working and which was planning to go public. One of the news articles where the search results are leading to, gives an imprecise description of this situation.
• The Board also pointed out that it is relevant whether a person is of public interest and they find that the complainant is not, even though he has a leading role in a company due to go public.
• Finally, the Board emphasised his personal burden relating to the search results.

On the other hand, the Board found the following matters not in favor of the complainant's erasure request:

• The information is of public interest, especially due to the serious nature of the complainant's crimes.
• The information was published due to journalistic interests and its news value.
• The information relates to his work life and not his personal life.

Holding

Due to the many conflicting factors in their legitimate interest assessment, the Board found the weighing of interests challenging and, as a result, four members found that there were sufficient reasons to deny the erasure request, whereas two members disagreed.

As the majority decides, the Board held that the DPA's decision to not instruct deletion of two search results, was upheld.

Comment

The Board noted that an erasure request to a search engine does not mean the information is fully removed from the Internet, only from their search results pages. The information will still be available from the original sources. Thus, as the case Google Spain and Google shows, the search engine's processing of personal data is different from the website publisher, because the conclusion of the legitimate interest assessment could vary depending on the party conducting it. The Google Spain ruling concluded that while the search engine operator might have to remove a search result, the website published could still have legal grounds for processing the personal data on their website. This position is repeated in G.C. & Others v. CNIL (section 52).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.

Decision of the Privacy Board 15 February 2022 (Mari Bø Haugstad, Bjørnar Borvik, Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem, Morten Goodwin)

The case concerns an appeal from A on the Data Inspectorate's decision of 17 August 2021, in which the Data Inspectorate rejected a claim for deletion of two search results in the search engine Google.

Background to the case
In 2011, A was sentenced to four years in prison for gross corruption and for concealing the proceeds of his own criminal acts. In the same judgment, he was sentenced to pay in excess of NOK 5,400,000 in compensation to another company and sentenced to the right to run an independent business, including being a general manager or holding another senior position on a company's board, indefinitely time. The Court of Appeal increased the sentence to four years and six months in prison. The actions he was convicted of took place in the period from 2003 to 2010 and were related to his role as chairman of the board and general manager of B. The case was mentioned in several newspaper articles.
The district court mitigated the convicted loss of rights in a ruling on 6 August 2019 so that he was given the opportunity to become general manager of a company where he had worked as a project coordinator and project manager for five years. The loss of rights was otherwise maintained.
A contacted Google on February 3, 2020 and asked for the deletion of four search results in Google that led to articles that discussed the criminal case against him. A sent a similar request to the search engine Bing. Bing complied with A's request for deletion in March 2020. Google rejected the deletion request in an email on March 5, 2020 for the following reasons:
«Having assessed the balance of relevant rights and interest relating to the content in question, including factors such as its relevance to your professional life, Google has decided not to block this content.
At this time, Google has decided not to take action on these URLs ».
A complained about Google's refusal to the Norwegian Data Protection Authority on 28 March 2020 and requested assistance in deleting the relevant search results. The Norwegian Data Protection Authority has notified Google of a decision with an order to delete one of the search results and has at the same time asked Google to comment on one of the other search results. For the other two search hits, the Data Inspectorate rejected the request for deletion in a decision on 17 August 2021. The rejection concerned two search hits that lead to two newspaper articles in the online edition of […] and […]
a) […]
b) […]
A submitted a timely appeal against the Data Inspectorate's decision of 6 September 2021.
The Data Inspectorate assessed the complaint, but found no reason to change its decision. The case was sent to the Privacy Board on 3 November 2021. The parties were informed of the case in a letter from the board on 8 November 2021 and were given the opportunity to comment. A has submitted comments by e-mail to the tribunal on 25 November 2021. Google has submitted comments in a letter on 25 November 2021.
The case was considered at the tribunal's meetings on 7 December 2021, 11 January and 15 February 2022. The Privacy Board had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem and Morten Goodwin. Secretariat leader Anette Klem Funderud was also present.
The Data Inspectorate's assessment in outline
The Norwegian Data Protection Authority initially states that the authority is the right supervisory authority and has the competence to process the case, and that section 3 of the Personal Data Act does not apply to cases concerning the deletion of search results.
The Data Inspectorate then explains the legal starting points for the assessment of deletion of search hits and refers to the data subject's right to protest against the processing of personal data when the processing is based on the Privacy Ordinance Article 6 No. 1 letter e or f, cf. Article 21 No. 1. The audit is based on the guidelines prepared by the Article 29 Group, 14 / EN WP 225, for how privacy and freedom of information are to be weighed in cases concerning the deletion of search results. Of the relevant management practice, the audit refers to PVN-2020-08.
The Data Inspectorate's assessment of the case is based on the fact that consideration for the data subject generally weighs heaviest if the person in question actively requests that the search result does not appear when searching for the name, cf. Article 21 no. dictates that the interests of the complainant's privacy must give way to public interests.
The audit points out that relevant aspects of the assessment will be, among other things, the context in which the search hit is published, whether the search hit relates to the data subject's private life or professional practice, whether the information is published by the data subject himself, and whether the information is relevant and up to date.
The Data Inspectorate assumes that the information the search results lead to is covered by Article 10 of the Privacy Ordinance, which in principle prohibits the processing of personal data on criminal convictions and offenses. This is a matter which in principle indicates that the search results should be deleted, cf. G.C. & amp; Others v. CNIL, section 67 (C-136/17 of 24 September 2019).
The Norwegian Data Protection Authority points out that search hits a) and b) lead to articles with objective factual information about what A was convicted of and what punishment he received. The Authority believes that it speaks against deleting search results a), cf. the Article 29 group's guidelines criterion 5.
Furthermore, the audit has emphasized that the search results are published in a journalistic context. The newspapers […] and […] are both established newspapers, subject to the Vær Varsom poster with special experience in assessing what is in the public interest. The context of the articles is published in speeches that the search hits are in the public interest, and speaks against deleting the search hits.
The Data Inspectorate further refers as an argument against deletion that the personal information relates to the data subject's working life as such information will to a lesser extent be considered to be private.
The Norwegian Data Protection Authority assumes that A, who is currently Chief Security Officer at Y AS, still has a role in Norwegian business and industry. The search results are therefore relevant both in the sense of being related to his participation in the public, and in that it is related to his work. This speaks in the Authority's assessment against deleting the applicant meetings.
The Data Inspectorate also emphasizes that even though the news articles the search results lead to are old (nine and ten years old), they are still relevant because company A is currently working on a stock exchange listing. This emerges from news articles in […] from 2020 where the headline reads «[…]». In another article from […] published in 2021, it appears that «[…]». The company is now planning an IPO in 2022. The audit points out that an IPO of a company means that the public has a clear interest in who holds key positions in the company and their professional background. The Data Inspectorate assumes that search results a) and b) are relevant in light of A's position in Y, the company's plans for listing and later search results in the search engine that mentions the listing, especially considering that in the judgment he was imposed restrictions on what roles he can have in business.
The Data Inspectorate considers that the search results a) and b) are relevant and that the number of search results or information that emerges from these is not excessive either. The Data Inspectorate concludes that the freedom of information and the public's interest in having access to the search results when searching for A's name in this case constitute compelling justified reasons that precede his protest, cf. the Privacy Ordinance Article 21 no. 1, cf. no basis for ordering Google to delete search results a) and b).
A view of the matter in brief
He wants to delete search results a) and b) from the search engine Google which leads to articles in two newspapers that cover the criminal case where he was convicted of financial crime.
The information that appears in the search results is no longer relevant and no longer has a public interest. Nor is he a person who plays a role in the public eye. These conditions indicate that the search results are deleted.
He has accepted that the case at the time in question was in the public interest, even though it represented a heavy additional burden. However, the public's interest in a criminal act weakens over time. Today, the case is 11 years back in time and constitutes an old relationship. In addition, he has made up for it. The sentence was completed in 2016.
He has never had a high profile, and he does not see himself as a public figure. He is not a key player in Y as the Data Inspectorate assumes. He is no longer the general manager of the company, but only had this role in the company's start-up phase. Y is part of the Z group and the function as general manager is currently handled by Z's founder and owner. B is in an important phase of the company's development where the company is trying to raise capital.
He has no connection to financial matters in Y. All financial matters related to his job in the company are handled by group teams in Z. This includes the right to dispose of funds, certifications / approvals, deposits and payments.
This case gives him a practice ban for the rest of his life. It is impossible for him to move on in life as long as the search results in his name related to a criminal relationship remain in the search engine.
That he has been granted his deletion request from the search engine Bing and not Google appears to be an arbitrary assessment of actual circumstances.
The case from the Privacy Board to which the Data Inspectorate refers (PVN-2020-08) is not comparable with his case. Although both cases are of older date and concern conviction for financial matters, the complainant in the case before the tribunal was convicted, among other things, of attempting to gag public access by making threats and behaving harassingly against journalists who mentioned the business. That is not the situation in his case.
Google's views on the matter in outline
Google assessed the relevant search results on March 5, 2020 and found that the public's interest in continued access to the content behind the search results outweighs the interest of the data subject.
Google agrees with the Data Inspectorate's assessment of search results a) and b). In assessing the data subject's request, Google emphasized that the search results lead to journalistic content from editorially controlled media relating to criminal acts committed by the data subject in his professional role.
Google also agrees with the Data Inspectorate's assessment that the articles still have a predominant public interest, given the data subject's professional role and the fact that the company in which he currently has a prominent role will be listed on the stock exchange in the near future.
Google believes that the freedom of information and the public interest in having access to the search results when searching on the data subject's name constitute compelling legitimate reasons which take precedence over the data subject's interest in this matter. The search results should therefore not be removed.
The Privacy Board's assessment
The Privacy Board will decide whether Google should be ordered to delete the two search hits a) and b) mentioned in the introduction to the decision.
The legal basis for the assessment
When a search engine collects personal data and presents search results to the public, this represents a processing of personal data regulated by the Privacy Ordinance, cf. Article 4 no. 2. The search engine provider is responsible for the processing of personal data that takes place in that connection, cf. Article 4 no. 7. This is also based on legal and administrative practice, see for example PVN-2021-17.
It is the Privacy Ordinance Article 6 No. 1 letter f which basically provides Google with a processing basis for collecting personal information and presenting search results to the public by name search on Google. This case mainly concerns personal information about criminal convictions and offenses. This is information that is covered by Article 10 of the Privacy Regulation. & amp; Others v CNIL (C-136/17 of 24 September 2019), which in the Board's assessment provides the necessary clarification of the legal bases when the information collected either belongs to a special category of personal data in Article 9 of the Regulation, or applies to personal data that falls under Article 10, cf. PVN-2020-08. This means that the question must be decided on the basis of a balance of interests (a necessity assessment) where the consideration of privacy must be weighed against the consideration of freedom of expression and information.
As A has protested against the processing of personal data, cf. Article 21 (1) of the Privacy Ordinance, it follows from Article 17 (1) (c) that Google has a duty to delete the data (ie remove the search hit) unless it is more weighty. justified reasons for the processing that take precedence over the data subject's interests, rights and freedoms. It follows from the wording of Article 21 (1) that it is for the controller to demonstrate that there are compelling justifiable reasons for the processing. In other words, a balance of interests must be struck between the data subject's interest in having the search match deleted, against the public's interest in gaining access to this information by conducting a name search in a search engine. In this connection, the tribunal would like to point out that deleting search results from a search engine is not about removing the information from the Internet as such. All information will still be available on the original websites, and on these websites the information will still also appear by name search. Furthermore, the information will be available from search engines, but then keywords other than personal names must be used, such as the subject of the case.
In the case of Google Spain and Google (C-131/12 of 13 May 2014), the European Court of Justice points out that the search engine provider's processing of personal data differs, and represents something in addition to the processing done by the publisher of websites (section 35) . This means that the outcome of the balance of interests to be carried out may be different for the search engine provider than for the person who publishes the Internet pages. This may be partly because the interests that justify the processing of personal data may be different, and partly it may be because the consequences of the data processing will be different. The European Court of Justice ruled in Google Spain and Google that anyone who offers search engine services may have an obligation to delete a search result at the request of the search result, even if the publisher of the website has a processing basis for publishing the information on his website (section 88). This position is continued in G.C. & amp; Others v CNIL (Section 52).
Regarding the specific balance of interests for the search engine provider's processing of personal data, the European Court of Justice in Google Spain and Google, section 81 (official Danish translation) says:
'Although the rights of the person concerned protected by these articles also generally outweigh the interests of Internet users, this trade-off may in specific cases depend on the nature of the information in question and how sensitive it is to the person concerned. person's privacy, as well as the public's interest in having this information, which i.a. may vary depending on the role of this person in public life. "
The Privacy Council has published a guide on the right to be forgotten by a search engine, see «Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engine cases under the GDPR (part 1) - version adopted after public consultation» of 7 July 2020. This replaces the guide developed by the Article 29 Working Party in the wake of Google Spain and Google and GC & amp; Others v CNIL. It is pointed out in section 31 of the Privacy Council's guide that the criteria developed by the Article 29 Working Party are still relevant when deciding on requirements for deletion of search results. The tribunal assumes that the Privacy Council's supervisor expresses the administrative practice of the audits in the EU and the EEA, and in this way provides some guidance for the balancing of interests that is to be done. The tribunal refers to sections 26 to 33, which apply to the data subject's right to protest, and the exceptions to this in sections 44 to 54.
The Article 29 Working Party itself emphasizes that "no single criterion is, in itself, determinative", and furthermore that "the list of criteria is non-exhaustive and will evolve over time", cf. also the European Court of Justice's assessment in G.C. & amp; Others v CNIL, where the court in section 66 confines itself to stating that a balancing of interests must be carried out and then gives a fairly loose instruction on which criteria are to be included in this balancing. The tribunal emphasizes that the criteria are intended to provide national supervision with some guidance in the overall discretionary balancing of interests that must be done when assessing requirements for deletion of search results.
The European Court of Justice rules in Google Spain and the Google judgment that in the balancing of interests there is a presumption ("these rights in principle precede") that the data subject has the right to have the search hit deleted, unless special considerations apply. This presumption must, in the tribunal's assessment, be even stronger when it comes to information on criminal convictions and offenses covered by Article 10 of the Privacy Regulation. The European Court of Justice has pointed out the same in section 67 of G.C. & amp; Others in CNIL:
'In addition, in the case where the processing concerns the specific categories of information in Article 8 (1) and (5) of Directive 95/46 or in Article 9 (1), Article 10 (1) and Article 10 of Regulation 2016/679, the infringement of the data subject's fundamental rights to privacy and the protection of personal data as set out in paragraph 44 of this judgment could be particularly serious due to the sensitive nature of that data. "
The concrete balance of interests
The tribunal then moves on to the specific balancing of interests, and will first look at the circumstances that suggest that the search results be deleted.
Firstly, as pointed out above, it is the consideration of the data subject that in the main rule weighs heaviest when the person in question actively requests that the search match does not appear when searching by name, cf. Article 21 no. 1. This starting point is even stronger when the search hits information covered by Article 10 of the Privacy Ordinance. These are matters which in principle indicate that the search warrant shall be deleted, unless special considerations apply.
Secondly, it has been a long time coming. The public interest in criminal acts committed by a business manager will weaken over time. It has now been more than ten years since A was convicted in the district court in 2011 and more than nine years since the Court of Appeal handed down a judgment following an appeal against the sentencing in 2012. The criminal offenses for which he was convicted were committed in a period from 19 to 12 years since (2003 to 2010). The sentence was served in 2016. Persons who have served their sentence shall be given an opportunity to put the past behind them.
A third factor of significance for whether search hits are to be deleted or not is whether the information is correct and up-to-date, cf. also the Privacy Ordinance Article 5 no. 1 letter d, cf. Article 29 group criteria no. 4 and 7. The tribunal assumes that the published articles, which specifically mention the district court judgment, have a correct reproduction of the case related to all the perpetrators who were involved in the case and the judgment against A, as well as the reason for it. The article from […] further states that the district court in 2011 ruled that A had the right to run an independent business. This is a correct reproduction of the verdict, but the information is not updated as it does not appear that the district court in 2019 eased the convicted loss of rights so that he was given access to become general manager of the company where he had worked as project coordinator and project manager for several years. , and which is now the company to be listed on the stock exchange and where A still works. The long time that has passed in combination with the fact that the information in one article gives a false impression that A cannot run a self-employed business at all, are factors that indicate that the search results should be deleted.
It is also important whether the person to whom the search match applies is a public person or a person who plays a role in the public sphere, cf. Article 29 Group Criterion No. 2. Public persons and persons who play a role in public life must circumstances tolerate invasion of privacy to a greater extent than others. The background is, among other things, the public's interest in gaining access to information about the exercise of the public role, cf. Borgarting Court of Appeal, LB-2020-18230.
Regarding who is to be regarded as a public person or to play a role in public life, the tribunal stated in PVN-2018-07:
"There is no clear definition of what a public figure is or who is considered to play a role in public life. The Data Inspectorate mentions as examples of public figures “public officials with senior positions, such as ministers, politicians or directors. […] Well-known business persons or persons in regulated professions such as lawyers, doctors or the like ”, but states that the examples are not exhaustive and that an overall assessment must be made. The tribunal agrees with that assessment. "
As the tribunal sees it, A is not a public person. He is also not a person who plays a role in public life, although he has a central role in the management of a company to be listed on the stock exchange.
As a final point that speaks in the direction that A should be upheld in his cancellation claim, the tribunal refers to the personal burden A experiences in that the relevant search results still appear when searching for his name. It is not a prerequisite for deleting the search results that the processing of the relevant personal data has had negative consequences for the data subject or his family. However, if there are sufficient grounds for such consequences, there will clearly be a factor that points in the direction of the registered person being granted the claim for deletion. This also follows from the Article 29 Working Party's guidelines:
"The data subject is not obliged to prove any damage in order to request the deletion of information, which in other words means that damage is not a condition for the exercise of the right recognized by the Court. However, if there is evidence that the availability of the search result is detrimental to the data subject, this factor clearly indicates that the information should be deleted. "
The tribunal considers that it has been sufficiently substantiated that A has in various contexts been confronted with the information that emerges when searching for his name in Google, and that he experiences this as a great burden that prevents him from leaving the past behind.
In the tribunal's assessment, there are also several factors that point in the opposite direction and indicate that A should not be upheld in his claim for cancellation of the search results.
An important factor is whether the information that appears in the search results is of public interest. The stronger the public interest, the weaker A's demand for deletion is. There is no doubt that the conviction of A for gross corruption in 2011 was in the public interest. The conviction meant that A was sentenced to pay several million kroner in compensation to another company for losses the company suffered as a result of the actions. It is also in the public interest that A was sentenced to lose his rights indefinitely to run an independent business, including being a general manager or holding another senior position in a company, or to sit on a company's board.
In assessing whether the information is of public interest, it is also important in what context the information was originally published, cf. Article 29 group criteria no. 10 and 11. The actual publication of the news articles in […] in 2011 and […] in 2012 happened for journalistic purposes. The general public basically has an interest worthy of protection in having easy access to information that is published in a journalistic context. Although the search engines' processing of personal data differs from, and represents something in addition to, the processing of personal data made by the person who publishes a news article on a website, the fact that the original publication took place for journalistic purposes will be a factor that indicates that the information is of public interest and that the search results are not deleted.
The information that appears in the articles in the search results also applies to A's professional practice, and is not related to his private life. The actions he was convicted of and which are discussed in the articles are related to A's role as chairman of the board and general manager of the company and thus apply to his professional life. This means that A's claim for deletion is weaker than if it was A's privacy that was mentioned.
As has been explained, there are different aspects of the balance of interests that pull in different directions. An overall assessment must therefore be made of all the factors that are included in the balancing of interests. The tribunal has found the balance difficult and in the weighting of the various interests, the tribunal has been divided into a majority and a minority.
The majority of the tribunal, consisting of members Coll, Graasvold, Blinkenberg and Goodwin, has come to the conclusion that there are sufficiently compelling justifiable reasons which indicate that consideration for A's privacy must give way, cf. Article 21 no. 1, and that A is thus not upheld in its deletion requirement.
The majority has emphasized that the information that appears in the search results still has a public interest. It is particularly pointed out that A holds a leading position in a company that will be listed on the stock exchange in the near future. This entails an increased public interest also in previously published information on A's conviction, as the articles in […] from 2020 and February 2021, respectively (discussed by the Norwegian Data Protection Authority) show. Possible listing of a company means that the public will have an increased interest in information about who holds key positions in the company and their professional background. Furthermore, it is pointed out that the information about A's conviction is still of interest to persons and companies in other contexts, including the establishment of commercial cooperation with A or companies to which he is affiliated.
The majority sees that the information in the relevant links does not contain references to the ruling from the district court from August 2019, where the loss of rights for A was reconsidered. However, the majority emphasizes that the information about the original criminal conviction still has such a public interest that it should still be available, and that A himself will be able to supplement with information about the ruling from the district court if necessary.
Overall, the timeliness of the information means that consideration for A's privacy must give way even if the information is more than ten years old. The majority also refers to the Data Inspectorate's assessment, which is accepted.
The tribunal's minority, consisting of members Haugstad, Borvik and Tessem, has come to the conclusion that there are not sufficiently compelling justifiable reasons which indicate that consideration for A's privacy must give way, cf. Article 21 no. 1.
For their assessment, the minority has placed great emphasis on the long time that has passed. The public interest in criminal acts committed by a business manager will weaken over time. This applies even if he is in the management of a company that is planning an IPO in the near future. Persons who have served their sentence shall be given an opportunity to put the past behind them, cf. Article 10, which sets special requirements for the processing of such information.
For the minority, it is also important that A is currently employed in a position without financial responsibility. In other words, A is employed in a position that has a different content than the one he was employed in when he committed the criminal acts for which he was convicted in 2011. In the minority's assessment, there is therefore nothing about A's role or current position that indicates that he to a greater extent than other persons must endure encroachment on privacy.
The minority has also noticed that there are no search results that lead to websites that mention the ruling from the district court from August 2019, where the loss of rights for A was reconsidered. The district court came to the conclusion that the conditions for mitigation of the loss of rights were met, which opened the door for A to then be employed in a position as general manager in the business he had worked for for five years. The minority sees it as the list of search results generated by name search on A contains deficiencies about the later development in the case. In view of the forthcoming listing of the company in which A is employed, it is the minority's view that the interests of potential investors must primarily be secured through procedures other than Google searches for individual employees.
The decision was handed down with a dissent. The conclusion is formulated in line with the majority's view.
Conclusion
The Data Inspectorate's decision not to order the deletion of search results a) and b) is upheld.
Oslo, 15 February 2022
Mari Bø Haugstad
Manager