APD/GBA (Belgium) - 37/2020: Difference between revisions

Latest revision as of 16:57, 12 December 2023

APD/GBA - 37/2020

Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	14.06.2020
Published:
Fine:	600000 EUR
Parties:	Google
National Case Number/Name:	37/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD (in FR)
Initial Contributor:	n/a
The Belgian DPA (APD/GBA) fined Google Belgium €600000 for failing to respect a citizen's right to be forgotten, after Google refused its request to delist obsolete articles that were damaging to its reputation.
English Summary

Facts

The complainant, who plays a role in public life in Belgium, applied to Google Belgium for the deletion of search results linked to his name on the search engine (so-called "de-listed"). Part of the pages that he wanted to be de-listed suggested his political preferences, which he refutes. A second part relates to a complaint of harassment against the complainant, which was dismissed several years before. Google has decided not to de-list any of the pages in question.
Dispute

- Competence of the Belgian DPA over Google BE
- Who is the controller, the main establishment (Google Ire, or Google LLC ?) , and what is the role of Google BE ? Can The DPA impose a fine against Google BE ?
- Delisting of the two categories of results (see here under)
Holding

I. On the Competence
In that case, Google argued that the complaint cannot be founded because it is brought against Google Belgium,whereas the controller is not Google's Belgian subsidiary, but Google LLC, based in California.
The Litigation Chamber did not follow this argument. In its view, the activities of Google Belgium and Google LLC are inextricably linked and, consequently, the Belgian subsidiary may be held liable.
This is crucial to ensure full and effective protection of the GDPR, as it is difficult for a DPA in Europe to exercise effective control and impose sanctions on a company located in the United States.
On the other hand, the Litigation Chamber followed Google's argument that its principal place of business in Europe (Google Ireland) is not responsible for the delisting.
Regarding the pages concerning the political preferences of the complainant, the Litigation Chamber of the BE DPA considered that, given the complainant's role in public life, the maintenance of such listing was necessary in the public interest and thus ruled in Google's favour.
II. On the delisting
Regarding the pages concerning the complaint against the complainant, the BE DPA believes that the request for delisting is well-founded and that Google demonstrated a serious breach by refusing it. Since the facts have not been established, are old, and are likely to have serious repercussions for the complainant, the rights and interests of the person concerned must prevail. According to the Litigation Chamber, Google was particularly negligent, given that the company had evidence that the facts were irrelevant and outdated. The DPA imposed a fine of 600 000 euros on Google.
Comment

Certain in-depth case commentaries have been published on the subject:
What does the new Google decision by the Belgian DPA mean for other organisations? (15 July 2020)
Belgian DPA imposes EUR 600,000 fine on Google for failure to comply with RTBF (15 July 2020)
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/49
Litigation Chamber
Substantive Decision 37/2020 of 14 July 2020
File No.: DOS-2019-03780
Subject: X c/ Google (dereferencing)
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke
Hijmans, Chairman, and Messrs Yves Poullet and Christophe Boeraeve, members ;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and to the
free movement of such data, and repealing Directive 95/46/EC (General Regulation on the free movement of data).
Data Protection), hereinafter DPMR ;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter LCA ;
Having regard to the internal rules of procedure as approved by the House of Representatives on
20 December 2018 and published in the Moniteur belge on 15 January 2019 ;
Having regard to the documents in the file;
has taken the following decision concerning:
- the complainant "X", represented by Me Carine DOUTRELEPONT;
- the controller: Google Belgium SA, Chaussée d'Etterbeek 180, 1040 Brussels,
represented by Me Louis-Dorsan JOLLY and Me Gerrit VANDENDRIESSCHE.
Decision on the merits 37/2020 - 2/49
1. Facts and retroacts of the proceedings
1. The complainant, a Belgian resident, lodged a complaint signed on 12 August 2019, against Google Belgium
SA, a company incorporated under Belgian law, concerning the deregistration of a series of contents numbered from 1 to
12 and whose twelve URLs are listed in the complaint. This complaint was declared admissible on 14 August.
2019 by the Front Line Service.
2. 2. In essence, the complainant complains that "Google" has refused to grant his requests to
dereferencing sent via online forms requesting deletion of information
personal. Whereas, according to him, a search based on his first and last name results in
the referencing of content that is detrimental to its honour and reputation in the written press
Belgian.
3. More specifically, two categories of content in Google's indexes are criticized. This is on the one hand,
content that portrays the complainant "as a person labeled party Y" (a political party
Belgium), whereas this would involve processing special categories of personal data in the Belgian
meaning of Article 9 of the GDR not covered by the exceptions provided for in the GDR and, moreover, inaccurate.
4. And, secondly, content referring to information suggesting that the
complainant was the subject of a harassment complaint, which would have been found not to be substantiated.
founded in 2010 by the body in charge of examining this complaint, ARISTA1
and that as a result,
the information concerned is no longer up to date.
5. As to the first category of content, content 1 to 8, Google replied: that it cannot
access content #22 (Google therefore requests that a screenshot of the content be sent to you).
of the page in question so that the application can be examined in more detail); that the content
No. 7 has been deleted or that the page is not displayed; and that it decides not to block the contents
Nos. 1, 3, 4, 5 and 83, as well as content No. 64.

1 SPMT-ARISTA is an external service for prevention and protection at work, which since 1 January 2020 has become cohezio
(see https://www.cohezio.be/fr, last accessed 20 February 2020).
2 Google therefore requests a screenshot of the full content of the page in question in order to
examine the application in more detail.
3 For this reason: "after consideration of the balance of interests and rights associated with the content in question, including any
factors such as its relevance to your professional life, Google has decided not to block them.
».
4 For this reason: "after consideration of the balance between the interests and rights associated with the content in question, including any
factors such as the apparent relevance of the latter, Google has decided not to block it".
Decision on the merits 37/2020 - 3/49
6. As for the second category of content, content nos. 9 to 12, Google is also said to have decided
not to block them5.
7. On 30 August 2019, the Litigation Chamber decided under article 95, paragraph 1, 1° and
section 98 of the CAA that the complaint could be dealt with on the merits. The parties were invited to
conclude. Google's submissions were received on 30 September 2019. On 15 October 2019, the
the Registry of the Litigation Chamber, in the absence of any clarification in the
LCA, the possibility of intervening in the case of Google Ireland Ltd and Google LLC.
It was replied on 21 October 2019 that, without prejudice to the decision that will be taken on this matter by
At the Litigation Chamber, the plaintiff was invited to introduce his request in his conclusions, which was
which will also allow the opposing party to position itself against him. On the same day, the complainant
submitted its findings in response, without requesting the intervention of other parties. On 12 November
2019, Google released its summary findings.
8. On several occasions and most recently in a letter dated 21 November 2019, Google has asked to be
I hear you. The parties were invited by the Litigation Chamber to be heard. In accordance with
under article 93 of the LCA, the Litigation Chamber may hear the parties concerned. On this basis
and in view of the submissions exchanged by the parties, it also offered Google LLC the opportunity to
Participate in the proposed hearing in order to make any submissions. One hearing was
organised on 6 May 2020 in the presence of Google Belgium SA and the complainant represented by a lawyer.
replacing Me Carine DOUTRELEPONT. Google LLC did not respond to the invitation that was sent to it.
sent and at the hearing. Google Belgium SA, when questioned on this point, explained that this
invitation had indeed reached Google LLC but that nothing was manually signed in California.
due to the outbreak caused by the Covid-19 Coronavirus. However, the Litigation Chamber wrote
by paper mail to Google LLC, and Google LLC responds in the same manner as the one by which
she's in demand. The e-mail address of the Litigation Chamber was, however, known to Google, which
could have used it to answer him. Because of the above-mentioned epidemic, the hearing was held in
distance, by videoconference.
9. Minutes of the hearing were provided to the parties on May 11, 2020. On May 13, the complainant
informed the Litigation Chamber that he has no observations. On 22 May 2020, Google Belgium SA
communicated its remarks on the minutes of the hearing of 6 May in the form of a track
changes'.
10. On 4 June 2020, the Litigation Chamber sent an e-mail to Google Belgium SA, informing it that it had received the following information
the amount of the fine envisaged against it and the reasons for the infringements

5 For the following reason: "after consideration of the balance of interests and rights associated with the content in question, including
factors such as your role in public life, Google has decided not to block it".
Decision on the merits 37/2020 - 4/49
recorded in the DMPP justify the said amount. Google Belgium SA was invited, by the same e-mail, to
put forward its defences to the proposed amount of the fine. The Litigation Chamber
received such means by e-mail on June 24.
11. On 9 June 2020, the Litigation Chamber introduced an informal notification of mutual assistance
voluntary under Article 61 of the RGPD in the system of cooperation between supervisory authorities,
asking for a reaction within two weeks. The Spanish, Portuguese, Hungarian authorities..,
Slovak, German (Hamburg, as well as Baden-Württemberg), French, Italian and Irish
have submitted comments within this time limit.
2. Structure of the decision
12. By the present decision, the Litigation Chamber addresses the issue of dereferral of the case from the
by an Internet search engine, of content following searches relating to an
natural person. This question is the subject of case law of the Court of Justice of the European Union.
The European Court of Justice (hereinafter CJEU) is well known, in particular in the Google Spain6 judgments,
Google/CNIL7 and GC et al./CNIL8. The Belgian Court of Cassation also ruled on the
dereferencing and the right to oblivion.9
13. For the Litigation Chamber, this is an opportunity to adopt a decision of principle and to decide
a few fundamental aspects related to dereferral, based on the case law of the
CJEU on the matter, or on other points relating to the determination of its competence to act
(in particular the ECJ ruling Wirtschaftsakademie10 ).
14. Firstly, the Litigation Chamber analyses the competence of the Authority for the Protection of Human Rights and Fundamental Freedoms (the
Data (ODA) in the case submitted under Article 55(1) and Recital 122 of the GDR.
To this end, the Litigation Chamber demonstrates that the case in question does not need to be submitted under Article 55(1) and Recital 122 of the GDR.
The "single window" mechanism of the DP Regs (Section 3 infra).

6 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González
7 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL).
8 CJEU, 24 September 2019, C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL).
9 See, in particular, Cass. 29 April 2016.
10 CJEU, 5 June 2018, C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie.
Schleswig-Holstein GmbH. 
Decision on the merits 37/2020 - 5/49
15. Second, having concluded that such jurisdiction exists, the Chamber turns to the concept of "jurisdiction".
as controller within the meaning of Article 4(7) of the DPMR, with the purpose of deciding whether
Google Belgium SA - the defendant in this case - can be held responsible for the
processing and/or having its activities inextricably linked with those of the controller
(Google LLC), and whether the ODA can exercise its jurisdiction over Google Belgium (Section 4 infra).
16. Thirdly, it determines the territorial application of the de-referral, with a view to the judgment of the Court of First Instance in the
Google/CNIL. (Section 5 infra).
17. Fourthly, the Litigation Chamber is considering applications for de-listing from the List of Counsel.
submitted by the complainant, which relate to the political labelling and harassment complaint
(Section 6, infra).
18. Fifthly, the Litigation Chamber considers that certain facts that have been brought before it by the
knowledge in the present case constitute a breach of the GDGR (Section 7 infra), and
details the related corrective actions.
3. Jurisdiction of ODA and the inapplicability of the "single window" mechanism
19. The competence of ODA is defined and framed in Chapter VI of the DPR.
20. In accordance with Article 55(1) of the DPR, a supervisory authority is competent to exercise its powers of control.
tasks and powers in the territory of the Member State to which it belongs. Recital 122 provides
that this should cover - inter alia - the processing of data in the context of activities carried out by
an establishment of the controller in that territory, as well as a processing operation affecting
persons concerned in that territory.
21. Territorial jurisdiction is a major principle of the RGPD, which should be read in conjunction with Article 3, 1,
on the territorial application of the GDGR. The territorial competence of the authority is a rule of the
the principle in public international law that a State has the power to determine its own jurisdiction.
to impose the law on its own territory. This principle of the RGPD should be read in conjunction with the objective (ratio legis) of the
Regulations to ensure effective and comprehensive protection of fundamental human rights 
Decision on the merits 37/2020 - 6/49
concerned. Territorial jurisdiction may include the activities of a local subsidiary of an enterprise
established in a third State11.
22. Territorial jurisdiction shall also apply where the processing is carried out by a third State.
controller not established on the territory of the European Union, as provided for, and
in accordance with the conditions of Article 3(2) of the GDMP. This is confirmed by the European Committee for
Data Protection (EDPB)12.
23. On the other hand, an exception to this founding principle of the DPMR is provided for in Article 56(1), read in conjunction with Article 56(2), read in conjunction with Article 56(3), read in conjunction with Article 56(4), read in conjunction with Article 56(5), read in conjunction with Article 56(6), read in conjunction with Article 56(7), read in conjunction with Article 56(8).
in conjunction with Article 60, on the cooperation of the lead authority and the authorities of
(the "Single Window"). In a cross-border processing situation in
the European Union, the lead authority guides the cooperation. The scope of this
The exception is limited to situations of "cross-border processing", as defined in Article 4(23) of the DPMR,
i.e. a processing operation that is carried out in several establishments in the European Union
of a controller, or a processing operation that significantly affects data subjects
in several Member States (or is likely to affect them). In the present case, the complaint
is brought against Google Belgium SA, a subsidiary of Google LLC (USA). That Belgian establishment,
a corporate law subsidiary, of Google is the defendant. However, Google Belgium SA defends
the position that only Google LLC (USA) is the data controller.
24. The Litigation Chamber points out that even if Google LLC and not Google Belgium is the data controller, the
SA would be the data controller (hypothesis not followed by the Litigation Chamber13 ), ODA
would be competent to deal with the complaint of a Belgian national. The processing of data at
personal nature in the context of an establishment of an external data controller
of the European Economic Area is not covered by Articles 56.1 and 60 of the GDR. The company
"Google" based in the United States does have a main office in the European Union:
in Ireland, more precisely via the company Google Ireland Ltd. In the event that the processing in
The work involved in the present case would be carried out as part of the activities of that principal place of business,
this processing would fall within the scope of Article 56(1) of the RGPD and the system of
One-stop shop" cooperation, with the Irish authority as lead authority.
25. 25. At the hearing, the division of responsibilities within the Google group of companies made it clear that the
part of the debate, as provided for in the letter of invitation sent by the House
Litigious. In that letter, the House had clearly expressed its desire to be informed of the

11 THE EU GENERAL DATA PROTECTION REGULATION (GDPR), A Commentary, Edited by Kuner, Bygrave and Docksey, OUP
2020, pp. 903, 906-908. See also the Google Spain judgment, paragraphs 34 and 53.
12 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) - for public consultation, adopted on 12 November.
2019 available at www.edpb.europa.eu.
13 Infra, No. 32-53
Decision on the merits 37/2020 - 7/49
roles and responsibilities of the Google group of companies, including the existence of an
possible principal place of business (within the meaning of Article 4 (16) of the GDPR)14.
26. Google Belgium SA acknowledged that Google Ireland Ltd was Google's principal place of business within the meaning of Article 4(16) of the GDR.14 26.
Article 4(16) of the RPMR, i.e. the location of the central administration of Google LLC in the Union
European. Although the role of Google Ireland is referred to in these proceedings, the Chamber
Litigation considers that the data processing in the case at hand is not carried out in the
the activities of Google Ireland Ltd.
27. First, at the hearing, Google Belgium SA argued that the reference to Google
Ireland Ltd. was out of contention. According to Google Belgium SA, this reference was not included in the
conclusions of the complainant and the debate is between Google Belgium SA and Google LLC: it is therefore not
There's no way Google Ireland Ltd. is going to get involved. In the present proceedings, the parties have not
exchanged on "Google Ireland or Google BE", the debate takes place between Google Belgium SA and Google
LLC. Therefore, for procedural reasons, the Litigation Chamber was not required to rule on this matter.
on the role of Google Ireland Ltd. However, the Litigation Chamber reiterates in this respect that it has
expressly invited the parties to comment on the existence of a possible principal place of business of the company.
Google on the territory of the European Economic Area15 , and that it did appear at the hearing
that Google Ireland Ltd. was that establishment.
28. Second, in the context of the pleadings, Google Belgium SA insisted that the activity of Google Ireland Ltd was that establishment.
Google Ireland Ltd as data controller concerns a different hypothesis from the one that
concerns the indexing activities of the search engine. It concerns the processing of data
users", i.e., for example, when a person uses the search engine, their
search history can be processed by Google for the adaptation of search results. It
This is a processing operation for which Google Ireland Ltd is the data controller. For the
Google search engine and the treatments corresponding to the three steps necessary for the
operation of the search engine (exploration, indexing, selection of search results)
searches) at issue in the proceedings, Google Ireland Ltd is not the data controller.
This division of roles is explained by the fact that Google Ireland Ltd acts as an interface with
users residing in the EU but not involved in the development and management of the
searches, exclusive competence of Google LLC.

14 The invitation letter contained the following passage: "Without prejudice to any arguments they may wish to develop
before the Litigation Chamber, all parties are invited, in the context of the present case, to express their views on the
activities, roles and responsibilities of Google LLC, Google Belgium SA, and the existence of a possible principal place of business
(within the meaning of Article 4(16) of the GDR) of Google in the territory of the European Economic Area".
15 Supra, note 14.
Decision on the merits 37/2020 - 8/49
29. Thus, the evidence raised by Google Belgium SA at the hearing, according to which Google Ireland
Ltd would be responsible for the processing of users' data when, for example, their
search histories are processed to adapt the results communicated to them by the
search engine are potentially contradictory with the position defended by Google.
Belgium SA that Google LLC is the sole data controller in the context of the
operation of the search engine and its three phases, i.e. the exploration phase, the search phase and the search phase.
indexing and result selection.
30. 30. Therefore, the data processing (i.e. dereferencing) in the present case is only
not carried out as part of the activities of Google Ireland Ltd. In conclusion in the present case,
the Irish supervisory authority may not be the lead supervisory authority within the meaning of Articles 56 and 60
of the DP Regs, implying that the "single window" mechanism does not apply and that the
competence of the Litigation Chamber can be assessed in the light of the principle of territoriality.
enshrined in section 55(1) of the GDR.
31. This conclusion is corroborated by the position taken by Google LLC in a letter to the authority of the
Irish control dated 23 June 2020, in which Google LLC explains that it will no longer oppose
that a local supervisory authority has local jurisdiction over the treatment of
personal data that comes within the sphere of responsibility of Google LLC.16 This statement
of position does not mean that the system of cooperation cannot be applied17.
4. As to the controller
32. The purpose of this section is to establish whether Google Belgium SA - the defendant in this case - can
be considered as the data controller for the processing of
complainant, i.e. the entity that determines the purposes and means, and/or whose activities are
inseparably linked with those of the data controller, in this case Google LLC.
33. At this stage, the Litigation Chamber makes a preliminary observation on the territorial application
of the RGPD. Section 3 of the EDR covers two distinct scenarios with respect to its applicability
territorial :
a. the first scenario involves the application of the DPMR to the processing of data at
personal nature carried out as part of the activities of a

16 This letter is added to the file by the Litigation Chamber.
17 Infra, No. 89.
Decision on the merits 37/2020 - 9/49
data controller within the Union, whether or not the processing operation takes place
in the Union (Article 3.1);18
b. the second scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.1);18 b. the second scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.2);19 b. the third scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.3)
(b) the staff of the Commission shall be entitled to receive information on the
controller not established in the Union (Article 3(2)).
34. The Chambre Contentieux notes that these two paragraphs must be aligned. Failing that, on the basis of
on a purely textual reading, a certain legal vacuum might exist in the circumstances or
a processing operation is carried out by a data controller which has an establishment in
the Union, and that the processing is not carried out in the framework of the activities of that institution but
by a controller established in a third country.
35. In the present case, it is not disputable that the data subject (the complainant) is on
the territory of the European Union (in this case, Belgium). Google LLC having various
establishments in the Union, Article 3.2 shall not apply. Therefore, the territorial application is
triggered by section 3.1 of the EIHWR. Indeed, if none of these provisions are considered to be
applicable, the effective and comprehensive protection of the data subjects as required by the Court of Justice
of the European Union19 would not be guaranteed.
36. Furthermore, the Litigation Chamber points out that, since the GDR and the case law of the
Court of Justice provide for effective and comprehensive protection of persons, the application of Article
3.1 is to be regarded as the main rule, for the sole reason that effective control becomes
complex if the processing of personal data is carried out by an establishment in
outside the European Union. It is, for example, not obvious for a supervisory authority to
to exercise powers of investigation or to take corrective action in respect of such
establishment referred to in Article 58 of the GDR in respect of an establishment outside the Union.
4.1 Position of the controller and Google Spain's judgment
37. In essence, Google Belgium SA considers the complaint against it to be unfounded since the only
responsible for the processing of personal data related to the search engine service

18 The scope of the DPR is extended to the 3 States of the European Economic Area (EEA), namely Iceland, the Czech Republic, Hungary, Poland, Slovakia and Slovenia.
Norway and Liechtenstein by a Decision of the EEA Joint Committee of 6 July 2018, which entered into force on 20 July 2018.
This Decision is of no consequence in the present case. However, this Decision refers to the EEA to several
opportunities.
19 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González. Item 58.
Decision on the merits 37/2020 - 10/49
Web offered by Google is not Google Belgium SA but the American company Google LLC. It
relies in support of its arguments on the judgment in Google Spain 20.
38. In that case, the Court of Justice found that an establishment such as Google Spain satisfied the requirements of the
to the criterion laid down in Article 4(1)(a) of Directive 95/46/EC21, Whereas in substance
that the activities of the search engine operator (Google Inc. then, now Google LLC) and
those of its establishment located in the Member State concerned were therefore inseparably linked
that advertising space activities were the means to make the engine of
economically profitable research and that this engine was, at the same time, the means of
enabling these activities to be carried out22.
39. The Court also held in the same case, as Google Belgium SA argued, that the
The "operator of a search engine" is responsible for the processing of personal data.
personnel carried out as part of its activity, which is distinct from and in addition to that carried out by the
website editors23.
40. The objective of this case law is to "ensure, by a broad definition of the notion of 'responsible
"effective and comprehensive protection of the persons concerned "24. According to Google Belgium SA, this
The decision would imply that Google LLC would be the sole data controller. This position does not convince
not. The Court of Justice did not clearly distinguish between the responsibilities of the American company and its
European establishment, but - on the contrary - stressed that the activities of both entities were
inseparable. Even assuming that such a theoretical distinction of the responsibilities of the
and the subsidiary company would be valid, the challenge against Google Belgium SA would remain valid.
the need for effective and efficient protection of the rights of the child, precisely because of these inseparable links and the need for effective and efficient protection of the rights of the child.
of the people involved.
41. In addition, Google Belgium SA argued at the hearing that the processing is covered by Article 3(1) ,
of the DPMR, which provides that 'This Regulation shall apply to the processing of personal data relating to the
personnel carried out in the framework of the activities of a controller's establishment, or
of a processor on the territory of the Union, whether or not the processing takes place within the Union", such that the processing is carried out on the territory of the Union.
Court of Justice's case-law can be transposed into it, to which the Court of Justice has held that the

20 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González.
21 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data.
on the processing of personal data and on the free movement of such data, OJ L281/31 .
22 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González, point 56.
23 Ibid, points 32 to 38.
24 Ibid, point 34.
Decision on the merits 37/2020 - 11/49
In its Google/CNIL ruling on the scope of dereferrals, the Court of Justice also ruled on the scope of dereferrals.
that may be imposed on Google25.
42. The Litigation Chamber points out that this position implies that Google Belgium SA appears to be
Admit that the processing operation is carried out in the context of the activities of an establishment of the controller.
processing in the European Union, i.e. Google Belgium SA. A further reading of this
position would - as ruled in the Google/CNIL judgment - "result in the processing of
personal data [...] or exempted from the obligations and guarantees provided for in [the] Act [...].
Directive 95/46 and] by the GDMP". In other words, such a reading would jeopardize the useful effect
of the application of the DP Regs.
43. The Litigation Chamber certainly acknowledges that this jurisprudence concerning the application of the principle
of the "indissociable link" was drawn up in the context of the application of Directive 95/46/EC whose
territoriality provisions are distinct from those of the DPGR. Nevertheless, in Google v. CNIL
the Court confirms its willingness to extend its case-law in this area to the GDR. The Chamber
Litigator cites the following paragraphs:
« 50. Indeed, in such circumstances, the activities of the operator of the
research and those of its establishment located in the Union are inseparably linked.
related [...]. 51. In these circumstances, the circumstance that this search engine is
carried on by an enterprise of a third State may not result in the
processing of personal data carried out for the purposes of the
operation of the said search engine in the context of advertising activity, and
of an establishment of the controller in the territory of a Member State.
Member State is exempted from the obligations and guarantees provided for in Directive
95/46 and by Regulation 2016/679 [...]".
Furthermore, it is clearly established and recognised that the intention of the authors of the RGPD has been to increase
The aim is to make the protection of the persons concerned even more effective and to make it more effective.
4.2 Role of Google's establishments.
44. 44. In its reply, the complainant argues, inter alia, that Google Belgium SA is a 'subsidiary' of Google.
a subsidiary of Google LLC. primarily active in digital marketing, headquartered at

25 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), points
48 à 52.
Decision on the merits 37/2020 - 12/49
Brussels and its activities are aimed at the inhabitants of Belgium, and that the activities of Google Belgium SA and
of Google LLC are inseparable within the meaning of the Google Spain judgment referred to above.
45. Google Belgium SA does not dispute that. It is also not disputed that Google Belgium SA exercises
actually and effectively activities in Belgium.
46. During the hearing, Google Belgium SA was questioned about the different roles of the establishments of
Google it. The Commission confirmed that it has no role with respect to the data processed in the context of the three
phases of the operation of the Google search engine, i.e. its exploration phase, its
indexing and its phase of selecting results according to the request made by the user.
Google LLC would be solely responsible for the processing in this context. In substance at the hearing,
Google Belgium SA explained that it was a subsidiary of Google established in Belgium which was likely to
lead to the application of European and Belgian law. Google Belgium SA considers that Google LLC is
therefore submitted to the GDMP pursuant to Article 3(1) of the GDMP, and therefore should not designate an
representing in accordance with Articles 3, 2 and 27 of the GDR.
47. 47. Google Belgium SA explained that it only offers consultancy services related to the
marketing the services of other Google entities on the Belgian market. Requests from
referrals are directly and exclusively processed by Google LLC from the
online forms introduced by the data subjects without any involvement of Google
Belgium SA. The latter explains that when it is approached by data subjects
requesting dereferral, it systematically refers them to the online forms that
are sent (and addressed) to Google LLC. On the basis of the country and language chosen by the individual
the form, Google LLC's front-line service agents are selected to provide the service.
to answer the case in question. In cases where the content in question requires an evaluation
In more detail, a process of "escalation" is followed and, in this case, it is an
a Belgian person established in the United States (who is not an employee of Google Belgium SA) and working for
for Google LLC that was accessed. The analyses carried out by this Google employee are on
the basis of information from public sources and his good knowledge of the specificities of the company
to the country concerned of which he or she is a national.
48. The Litigation Chamber concludes that, on the basis of the foregoing, that in applying the
In the present case, the Google Spain judgment, the DPMR is indeed applicable to Google LLC pursuant to Article 3(1)(a) of the EC Treaty,
of the RGPD and that the subsidiary Google Belgium SA does indeed constitute an establishment capable of causing
the application of the EDR under Article 3(1) of the EDR. The Litigation Chamber invokes in this 
Decision on the merits 37/2020 - 13/49
context of the Google/CNIL26 judgment in which the Court stressed that it is irrelevant whether the processing has been
place or not in the Union.
49. Although it is true that Google Belgium SA does not determine the purposes or means of the processing
in the strict sense - these are determined by Google LLC -, Google Belgium SA is a subsidiary of Google
LLC and it follows from the position of Google Belgium SA that the activities of this subsidiary trigger
the application of section 3.1 of the DP Regs. In other words, the processing in question is carried out in the
framework of the activities of Google's establishment in Belgium. Another interpretation would imply
the application of Article 3.2 of the RGDP, as well as Google's obligation to appoint a representative
in the European Union under Article 27 of the GDR. This is not provided for by Google and is not
not necessary either in view of the role of Google Belgium SA.
50. The Litigation Chamber emphasises that this interpretation is corroborated by the Google Spain judgment,
although the situation is not identical. In that judgment, the Court held - under the
Directive 95/46 - "that processing of personal data is carried out in the framework of the
activities of an establishment of the controller in the territory of a Member State, on the territory of a Member State, at
meaning of that provision, where the operator of a search engine creates in a Member State
a branch or subsidiary for the promotion and sale of advertising space
proposed by that engine and whose activity is aimed at the inhabitants of that Member State. »27
51. Moreover, its activities are inextricably linked to those of Google LLC, its subsidiary in Belgium,
in light of the role it plays and describes, may be treated in the same manner as a
data processing carried out within the framework of the operation of the Google search engine and
the management of delisting requests in Belgium.
52. In short, the Litigation Chamber considers that Google Belgium SA should be treated in the same way as Google Belgium SA.
so that a controller on the basis of the elements of the case file and the case law
Google Spain from the Court of Justice of the European Union.
53. 53. In any event, even if Google Belgium SA could not be considered to be a 'competitor', it would still be a 'competitor'.
responsible for the processing, the Litigation Chamber would remain competent with respect to Google.
Belgium SA due to the presence of this entity on Belgian territory, such as the following elements
demonstrate this.

26 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), point
48.
27 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González, point 60.
Decision on the merits 37/2020 - 14/49
4.3 ODA's jurisdiction over Google Belgium
54. Account should now be taken of the judgment of the Court of Justice in the Wirtschaftsakademie case, delivered on 5 July 2001.
June 201828 concerning Directive 95/46, which gives a supervisory authority the power to
to exercise its powers with respect to an establishment of the controller even if that
institution is not a joint controller. Further developments
will demonstrate that it is appropriate to extend the application of this case law to the case at hand29.
55. In the Wirtschaftsakademie case, the Court held that the German supervisory authority was a "supervisory authority".
for the purpose of ensuring compliance on German territory with the rules on the protection of the environment and the
of personal data, to implement, with regard to Facebook Germany, all the
the powers it enjoys under the national provisions transposing Article 28(2) of the Treaty, and
3 of Directive 95/46 (recitals 50 et seq.). However, in the same case, the Court also had
clearly held that "Facebook Inc. and, in the case of the Union, Facebook Ireland should be looked at
as the main determinant of the purposes and means of the processing of personal data, and
staff of Facebook users as well as people who have visited the hosted Fan Pages
on Facebook, and thus fall within the notion of 'controller' within the meaning of Article 2(2)(a) of the Regulation.
(d) of Directive 95/46 '30 (italics added by the Chambre Contentieuse). In other words, Facebook
Germany was not responsible (or jointly responsible) for the disputed data processing.
56. The Court of Justice recognised that competence to the German supervisory authority following the verification of
satisfaction of the two conditions laid down in Article 4(1)(a) of Directive 95/46 :
"for the purpose of determining whether a supervisory authority is well founded, in circumstances such as
those in the main proceedings, to be carried on in respect of an establishment situated in the territory of the Member State
the powers conferred on it by national law, it is necessary to verify whether the
two conditions laid down by Article 4(1)(a) of Directive 9[5]/46 are satisfied,
namely, on the one hand, whether it is an 'establishment of the controller', within the meaning of this Regulation.
and, on the other hand, if such processing is carried out 'in the course of the activities' of that
establishment, within the meaning of the same provision "31.
57. As to the first condition, the Court found it to be met by considering that it was "constant that
Facebook Inc. as controller of personal data,

28 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v
Wirtschaftsakademie Schleswig-Holstein GmbH.
29 Infra, no. 64 et seq.
30 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH.
Wirtschaftsakademie Schleswig-Holstein GmbH, paragraph 30.
31 Ibid, paragraph 53.
Decision on the merits 37/2020 - 15/49
together with Facebook Ireland, has a permanent establishment in Germany, namely
Facebook Germany, located in Hamburg, and that the latter company actually operates and
activities in that Member State "32.
58. Mutatis mutandis, this is also the case of Google Belgium SA33 , which actually carries out and
activities in Belgium.
59. As to the second condition, in order to ensure effective and comprehensive protection of persons with
concerned and applying the Google Spain case-law referred to above, the Court of Justice has
considered that the activities of Facebook's establishment in Germany were
inseparably linked to those of the joint data controllers Facebook Inc. and
Facebook Ireland34.
60. Mutatis mutandis, this is also still the case for Google Belgium SA, as this one has also
confirmed, since it does not refute the complainant's argument on this point35.
61. On these bases, the Court concluded in the Wirtschaftsakademie case that German law was
applicable pursuant to Article 4(1)(a) of Directive 95/46, and that the authority of
the German supervisory authority was competent, in accordance with Article 28(1) of that Directive, to carry out the checks required by Article 28(1).
to apply German law to the processing, and that it therefore had all the powers
available to it under its national law transposing Article 28(3) of Directive
No. 95/46 with regard to the German establishment of Facebook36.
62. The Court further held that "the circumstance ... that decision-making strategies regarding the
to the collection and processing of personal data relating to persons residing on the
territory of the Union are taken by a parent company established in a third country, such as, in
In this case, Facebook Inc. is not such as to call into question the jurisdiction of the authority of
supervision governed by the law of a Member State over an establishment situated in the territory of that Member State.
the same State, of the controller of the said data "37.
63. The entry into application of the GDPMR does not change the relevance of this case law or even reinforces it,
at least in the context of this case. Article 3(1) of the GDR is considered to be a "general rule".

32 Ibid, point 55.
33 Supra, No. 44-47.
34 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v
Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 56 to 60.
35 Supra, No 44-47, in particular No 45.
36 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 56-60.
Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 61 and 62.
37 Ibid, paragraph 63.
Decision on the merits 37/2020 - 16/49
the successor to Article 4(1)(a) of Directive 95/4638. In the Google v CNIL judgment, those two
provisions are also mentioned jointly39.
64. The Litigation Chamber considers that, for the three reasons set out below, it is appropriate, in order to
to ensure the effective application of the RGPD, to follow the lessons of the Wirtschaftsakademie judgment
in the present case, and that it is therefore competent to exercise its powers against Google
Belgium SA on the basis of a complaint lodged against the latter with the Authority.
65. Firstly: the controller is established outside the Economic Area (EEA).
European. Mutatis mutandis, and a fortiori with a view to ensuring effective and comprehensive protection of
persons concerned in a situation such as the one in question where the legal person that is
data controller is not located in the European Economic Area (EEA) (the
Google LLC), it is necessary to transpose the case-law of the Court of Justice of the European Communities in the case of
Wirtschaftsakademie under the RGPD. The new rules enshrined in the RGPD do not
do not call into question the principles established by the Court in that case law: the GDMP standardizes
the tasks and powers of the supervisory authorities (see Articles 57 and 58), whose competence remains
subject to the principle of territoriality (see Article 55(1) of the GDGR).
66. 66. On the contrary, the DPMR intends to strengthen the effectiveness of data protection rules and to make them more effective.
protect the persons concerned as best as possible. However, while the Court has held that even where the person responsible
of the processing operation was established in the territory of a Member State, the supervisory authority of another State
Member where an institution which is not jointly responsible for the processing operation is located was
competent authority for such an establishment, this reasoning applies a fortiori when the person responsible for the
treatment is established outside the European Union.
67. Second: the controller should not appoint a representative, since it is established outside the EU.
in the territory of the European Economic Area. In view of the roles played by Google Belgium SA40
and Google LLC, the latter being a data controller subject to the DMPP pursuant to the
Google LLC was therefore not required to appoint a representative in accordance with Article 27 of the
RGPD. Recital No 80 of the GDPMR provides that :
"The representative should be expressly designated by a written mandate from the head of the
or of the subcontractor to act on its behalf in respect of the obligations that it
shall fall within the scope of this Regulation. The appointment of such a representative shall not

38 THE EU GENERAL DATA PROTECTION REGULATION (GDPR), A Commentary, Edited by Kuner, Bygrave and Docksey, OUP
2020, p. 77.
39 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), point
48.
40 Supra, No. 44-47.
Decision on the merits 37/2020 - 17/49
breach of the responsibilities of the controller or processor under the
this Regulation. This representative should carry out his/her tasks in accordance with the mandate
received from the controller or the processor, including cooperation with the authorities
competent control authorities in respect of any action taken to ensure compliance with the provisions of this Directive.
of this Regulation. The designated representative should be subject to coercive procedures
in the event of non-compliance with these rules by the controller or sub-contractor".
68. Article 27(4) of the DPMR provides that the "representative shall be mandated by the controller or the processor".
processing or the processor to be the person to whom, in particular, the supervisory authorities and the
data subjects must contact, in addition to or instead of the data controller or the
processor, in all matters relating to the processing, for the purposes of ensuring compliance with this Regulation.
regulation".
69. If the European legislator did not consider it useful, when adopting Article 3(1) of the GDPMR, to oblige a
data controller in a situation such as that of Google LLC at issue in the judgment
Google Spain to appoint a representative,41 is that it considered that the presence of an establishment
of the controller in the territory of the Union within the meaning of Article 3(1) of the PGRD should
have a sufficient territorial link with the territory of the European Union in order to ensure a proper
application of the DMPR: it is implicit but certain that an establishment within the meaning of this provision does not
may be less responsible for the applicability of the DP Regs than a section 27 representative.
of the RGPD.
70. On the contrary, the Wirtschaftsakademie case law can be seen in this logic: in
For the effective application of the DPMR in respect of the person concerned, it is appropriate to apply
this case-law also to the establishment of a controller located in the territory of
the Union such as Google Belgium SA, when the manager, subject to the PMPR pursuant to Article
3, 1. of the GDR, did not have to designate a representative within the meaning of Article 27 of the GDR. Not allowing
the supervisory authorities to disregard the legal, social and functional division of a
controller established outside the European Economic Area, where its
However, an establishment on this territory carries on an activity that is inseparably linked to its own,
would unduly restrict the territorial jurisdiction of these authorities by systematically obliging them
to have to exercise jurisdiction extraterritorially, despite the existence of such a connection which
constitutes at the same time a strong territorial connection. In such a situation, the recourse
necessary for the exercise of extraterritorial jurisdiction, taking also into account its limits
legal, procedural and practical aspects, would be such as to directly undermine the useful effect of the

41 Judgment that could not be ignored in the process of adoption of the RGPD: the judgment dates from 13 May 2014 and the RGPD has been adopted.
almost two years later, on April 27, 2016.
Decision on the merits 37/2020 - 18/49
RPGD. One might ask how the regulator would be in
the exercise of the powers conferred on it on the basis of Articles 58 and 83 RGPD, in such a way that it is able to
efficient and effective.
71. Thirdly: Google as a multinational entity does not allow the identification of the
clearly the controller. The two previous arguments are reinforced by the
makes the communications of Google LLC and Google Belgium SA, vis-à-vis the persons concerned,
lack clarity as regards the identification of the controller. It is therefore
all the more necessary to transpose the Wirtschaftsakademie case-law to the present case, with a view to
to ensure the usefulness of the DP Regs.
72. Google Belgium SA notes, in its summary conclusions, inter alia, that the complainant 'has addressed
its initial delisting request to Google LLC (Exhibits B.1 and B.2), through the form
standard made available by the latter (Exhibit A.3)". He did not contact Google Belgium.
SA. The data deletion request form in French is indeed referenced,
to a certain extent, to the company Google LLC: reference is made to Google LLC concerning
the use of the information provided with a view to identifying the data subject, also
concerning the use of the information provided via the form, and the "copyright" also makes
reference to Google LLC.
73. 73. However, the introduction of the form simply refers to "Google" as does the latest
check mark states "I understand that Google will not be able to process my request.
[…] ». On this first reference (in the introduction of the form), Google Belgium SA explained that
at the hearing that the objective was to be the least "pompous" towards users and that the
references to Google LLC were made explicit in important legal passages of the form.
74. 74. Google's French-language responses also refer to "Google" and "Google LLC.
"The Google Team".
75. As regards the possibilities to challenge Google's decision on the requests for
dereferencing, the response form is limited to specifying the following: "If you are not
agree with our decision, you have the right to submit your problem to the authority responsible for
data protection in your country. In this case, we advise you to include the number of the
reference of your application [...] and a copy of the confirmation that you received after you have
sent the application form. If Google is the webmaster of the site, you can try to
contact the owner or author of the page and send him/her directly your request to
deletion". 
Decision on the merits 37/2020 - 19/49
76. Neither the form nor Google's (LLC) responses explicitly identify an
treatment. On the basis of these elements, the Litigation Chamber considers that the process of
dereferencing thus maintains a certain ambiguity, for the persons concerned, as regards
the identity of the controller.
77. 77. In that connection, at the hearing, Google Belgium SA expressed its surprise at the fact that the
data subjects may still have doubts as to the identification of the controller in case of
de-referencing, in the light of the Google Spain judgment already referred to, which identifies Google Int.
as solely responsible. It therefore fails to understand that this established case-law still leaves
some doubts as to the identity of the person in charge in respect of the persons concerned and their
advice.
78. The Litigation Chamber considers on this point that this would in no way relieve the person responsible for the
processing of its obligation to inform the data subject in accordance with Articles 12(1) and 12(2).
of the DPMR, in a transparent, comprehensible and easily accessible manner, in clear and easily understandable terms and
simple, and by facilitating the exercise of his rights by the data subject (on this point, see infra point
Nos. 168). Thus, the data controller is obliged to provide precise information, such as
provided for in Articles 13 and 14 of the GDGR.
79. 79. In conclusion, this ambiguity regarding the roles and responsibilities of Google LLC and Google Belgium in the
SA which may legitimately create doubts on the part of the persons concerned as to
the interlocutor responsible for the processing (or not) to which they are addressed, constitutes a third
reason for transposing the Wirtschaftsakademie case-law in the present case, of
the Litigation Chamber is competent to act on the basis of a complaint lodged with it.
by a person concerned against Google Belgium SA alone.
80. Conclusion. On the basis of these elements, the Litigation Chamber decides that the plaintiff could
direct his complaint, concerning the dereferencing of contents of the search engine indexes
Google, against Google Belgium SA alone. For the Litigation Chamber, it is of little importance
that the processing of its data is in fact carried out outside the European Union by
employees of Google LLC. 
Decision on the merits 37/2020 - 20/49
5. Territorial application of dereferencing
81. In the present case, the complainant is requesting a worldwide de-listing on the grounds that he is a senior executive
of a large corporation.
82. In the case of a request for dereferral addressed by a data subject to the authority of
the centre of its interests, which is the case of the plaintiff in this case, the Chamber
Litigation also considers that this authority is best placed to make a ruling.
In another area, that of the international jurisdiction of courts and tribunals in civil matters
or commercial law, the Court of Justice decided in its judgment of 25 October 2011 eDate
Advertising42 :
« 48. It is therefore necessary to adapt the connecting criteria set out in point 42 of this report.
judgment in the sense that the victim of an infringement of a personality right by means of the Internet
may, depending on the place where the damage caused materialises in the Union
European Communities by that infringement, a forum for the entirety of that damage. Given that
that the impact of online content on a person's personality rights can
be best appreciated by the court of the place where the alleged victim has the centre of his or her
interests, the conferral of jurisdiction on this court is consistent with the objective of a good
administration of justice, recalled in paragraph 40 of this judgment.
« 49. The place where a person's centre of interests is generally the place where he or she has his or her
habitual residence. However, a person may also have a centre of interest as well.
in a Member State in which he or she does not ordinarily reside, in so far as other
indications that the exercise of a professional activity may establish the existence of a link
particularly close with that State" (emphasis added by the Litigation Chamber).
83. Mutatis mutandis, these considerations are also relevant in the present case. Indeed, in the present case
not only is the complainant habitually resident in Belgium, but also in the United Kingdom.
Belgium that his professional career is unfolding43. It is therefore the Data Protection Authority
which is best placed to assess the impact on its rights as a result of the content put online.

42 CJEU, 25 October 2011, C-509/09 and C-161/10, eDate Advertising GmbH and Others v X and MGN LIMITED. The judgment was
pursuant to Council Regulation (EC) No 44/2001 of 22 December 2000 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters.
recognition and enforcement of judgments in civil and commercial matters, now replaced by Regulation (EU) No
° 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction, recognition and enforcement of judgments of the Court of Justice of the European Communities
and the enforcement of decisions in civil and commercial matters (without affecting this reasoning).
43 Infra, No 100-108.
Decision on the merits 37/2020 - 21/49
84. With respect to the complainant's request for a worldwide de-listing on the ground that he is a senior executive
of a large company, the Litigation Chamber first considers that it does not demonstrate to the aid
evidence that it is also affected in its interests in (the territory of) other States
members or third countries (which does not exclude that its interests in Belgium may be affected).
from these territories).
85. 85. Furthermore, in Google v. CNIL, the Court held that Article 17 of the GDR (on which it bases the right of access to information in the context of the
to dereferencing) cannot have the scope to impose on Google a worldwide dereferencing for
all versions of its search engine. In addition to this, it should be noted that in national law
nor the law of 3 December 2017 establishing the Data Protection Authority (see its
in particular Article 4), nor the Law of 30 July 2018 on the protection of natural persons with disabilities.
with regard to the processing of personal data, which define the scope of competence
of the Litigation Chamber, do not give the Chamber the power to order a
global dereferencing. The Litigation Chamber cannot therefore grant the request of the
complainant of a worldwide deregistration.
86. 86. Next, the Litigation Chamber examines the arguments in favour of a European scope for the
dereferencing. The Court has - in the Google/CNIL judgment cited above - established the following:
« 67. It is important to note, however, that the public interest in access to a piece of information
may, even within the Union, vary from one Member State to another, so that the result of
the balance to be struck between the latter on the one hand, and the rights to privacy on the other hand
and the protection of the personal data of the data subject, on the other hand,
is not necessarily the same for all Member States, especially since, under the terms of
Under Article 9 of Directive 95/46 and Article 85 of Regulation 2016/679, it is for the Member States to
members to provide, in particular for salaries solely for the purposes of journalism or
of artistic or literary expression, exemptions and derogations necessary for
reconciling these rights with, in particular, freedom of information.
68. 68. It follows in particular from Articles 56 and 60 of Regulation 2016/679 that, for the
cross-border processing within the meaning of, and subject to, Article 4(23) of the Regulation, and subject to that
Article 56(2), the different national supervisory authorities concerned shall
cooperate, in accordance with the procedure laid down in those provisions, in order to reach a consensus, and
to a single decision binding on all these authorities and whose controller
must ensure compliance with respect to processing activities carried out in the context of
all its establishments in the Union. In addition, Article 61(1) of the Regulation
2016/679 obliges the supervisory authorities, in particular, to provide each other with relevant information.
and to provide each other with mutual assistance in implementing and applying this Regulation 
Decision on the merits 37/2020 - 22/49
in a consistent manner throughout the Union and Article 63 of that Regulation states that it is
to this end, the consistency checking mechanism set out in Articles 64 and 64a of the Treaty is provided for.
65 of the same regulation. Finally, the urgency procedure provided for in Article 66 of the Regulation
2016/679 allows, in exceptional circumstances, where a supervisory authority
The Committee considers that there is an urgent need for action to protect the rights and freedoms of the
persons concerned, to adopt immediate interim measures to produce
legal effects on its own territory and having a specified period of validity which
does not exceed three months.
69. This regulatory framework thus provides national supervisory authorities with the tools to ensure that the
and the mechanisms needed to reconcile the rights to privacy and the
protection of the data subject's personal data with the interest of
the public at large in the Member States to access the information in question and thus to
be able to adopt, if necessary, a deregistration decision covering all the
searches made on the basis of that person's name from the territory of the Union".
(emphasis added by the Litigation Chamber).
87. This extract from the case-law of the Court of Justice emphasises that consultation of other authorities
The aim of the control system is also to be able to take account of the public interest in other areas of the economy.
Member States to have access to the information, if a decision on delisting is being considered
for all the European domain names of the Google website (google.be ; google.fr ; google.de ;
etc.) and European residents. Indeed in the opposite case of a more limited dereferencing, by
example to the Belgian top level domain name (.be) from Google and to a geoblocking of the
users resident in Belgium, the public in other Member States would not suffer any harm to its
opportunities to access information44.
88. To this end, two opportunities for international cooperation are opened by the GDMPR: either the
mandatory cooperation under Articles 56, 1. and 60 (competence of a lead authority)
and one-stop shop) of the GDMP, i.e. voluntary cooperation on the basis of Article 61 of the GDMP, which
allows you to limit yourself to communicating useful information.
89. Since the Litigation Chamber considered that the one-stop shop mechanism was not
case,45 it is therefore incumbent upon the Litigation Chamber, if it intends to apply the
pronounce a dereferencing for all (or several) of the domain names of the Google website

44 There are, of course, intermediate hypotheses in which, for example, cooperation with only two
authorities could be sufficient, for example, if it were to order deregistration for two other extensions
Google's national .fr and .lu domains, combined with a geoblocking of residents of these two countries, in which case they should only be consulted
than the authorities of the latter.
45 Supra, No. 19-31.
Decision on the merits 37/2020 - 23/49
reflecting the country codes of the European Economic Area, combined with a geoblocking of the entire
of European resident users (or parts thereof), to consult (all or part of, depending on) its
homologues on the basis of Article 61 of the GDR. Finally, as a follow-up to the Google/CNIL judgment and in
particularly in its paragraph 69, the Litigation Chamber has consulted informally with the other parties to the
European supervisory authorities pursuant to Article 61 of the RGPD, to ensure that the
referrals do not disproportionately infringe freedom of information
Internet users in other Member States. As a result of this consultation, it emerged that
follows: with the exception of one supervisory authority in Germany (Hamburg), the supervisory authorities which
have reacted have supported the intentions of the Litigation Chamber, including on dereferral.
for the entire European Economic Area.
90. The Litigation Chamber considers that a dereferral can only be effective if it applies
to searches carried out from outside Belgium. In the European area without borders
internal, it would not be useful to order a limited dereferencing of searches conducted from within the
of Belgian territory.
91. With regard to the geographical scope of the dereferral, the Litigation Chamber considers -
in accordance with the Google/CNIL judgment - to be deregistered with effect throughout the Union
(and the countries of the European Economic Area). On the one hand, the Chamber considers that
searches from outside Belgium (on the spot or by using a proxy server in Belgium).
to access the other versions of the search engine) may have a serious impact on the
data protection rights of the complainant. Indeed, it is perfectly conceivable that in the
in the course of his private or professional life, the complainant has contacts with other European countries
(from Belgium's neighbouring countries, for example) and that as a result, people are seeking to find out about
about the complainant via other versions of the Google search engine than the Belgian version (.be).
In this context, a dereferencing limited to Belgium would not be effective enough.
Decision on the substance 37/2020 - 24/49
6. On applications for deregistration
92. The complainant's requests to Google for de-listing at the
The criteria and rules laid down by the Court of Justice in its above-mentioned Google Spain judgment,
of the guidelines of the Working Group on Article 29 relating to this judgment,46 hereinafter "the guidelines".
Group 29 guidelines", as well as in the GC et al. v. CNIL judgment of 24 September 201947 and
the "Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases "48 in the
European Data Protection Committee (hereinafter the "EDPS Guidelines"), in order to ensure that
a fair balance between the human rights concerned and the freedom of expression of Internet users
as well as their right to information.
93. It should be noted as a preliminary point that if an invasion of privacy caused by a
referencing can be multiplied tenfold because of the unavoidable role of search engines in
access to information via the Internet, in the same way and for the same reason, de-referencing
may have an impact on the freedom of information of internet users.
94. In its GC et al. v. CNIL judgment, the Court of Justice states the following:
"66 In any event, the operator of a search engine, when seized with a
request for dereferral, must verify, as part of the significant public interest grounds referred to
in Article 8(4) of Directive 95/46 or in Article 9(2)(g) of Directive 95/46.
Regulation 2016/679 and in compliance with the conditions laid down in those provisions, if the inclusion of
the link to the web page in question in the list displayed after a search has been carried out
from the name of the data subject is necessary for the exercise of the right to liberty
information for Internet users potentially interested in accessing this web page at the
through such research, protected by section 11 of the Charter. If human rights
protected by Articles 7 and 8 of the Charter shall, as a general rule, prevail over the
information for Internet users, this balance may, however, in some cases depend on
the nature of the information in question and its sensitivity to the privacy of individuals, the nature of the information in question and its sensitivity to the privacy of
the person concerned as well as the public interest in having such information, which
may vary, inter alia, according to the role played by that person in public life....

46 Guidelines on the execution of the judgment of the Court of Justice of the European Union in the 'Google Spain and the United Kingdom' case
Inc / Agencia Espanola de proteccion de datos (aepd) and Mario Costeja Gonzalez', C-131/12 , adopted on 26 November 2014
by the Article 29 Working Group.
47 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL).
48 Version 2.0, after consultation, adopted on 7 July 2020, available at www.edpb.europa.eu.
Decision on the substance 37/2020 - 25/49
67 In addition, it should be noted that, if the processing operation relates to the categories of
particular data referred to in Article 8(1) and (5) of Directive 95/46, or to
In Articles 9(1) and 10 of Regulation 2016/679, interference with the duties
fundamental to the respect for privacy and the protection of personal data
of the person concerned is, as noted in paragraph 44 of this judgment, capable of
to be particularly serious because of the sensitivity of these data "49.
95. In the same judgment, concerning information relating to judicial proceedings in respect of a
criminal law, the Court held as follows:
"It is thus incumbent on the operator of a search engine to assess, in the context of a
request for dereferencing of links to web pages on which are
published information relating to legal proceedings in criminal matters conducted against
the person concerned, which relate to an earlier stage of this procedure and do not
are more in line with the current situation, if, taking into account all of the circumstances of
the nature and gravity of the infringement in question, the
the course and outcome of the said proceedings, the time elapsed, the role played by that person
in public life and its behaviour in the past, the public interest at the time of the
request, the content and form of the publication, and the implications of the publication for
the said person, the latter is entitled to have the information in question removed,
at the current stage, linked to its name by a list of results, displayed following a search
made from that name". 50
96. Group 29 also explains that :
"The general objective of these criteria is to assess whether the information contained in a result
are relevant to the public's interest in having access to these
information. Relevance is also closely related to the age of the data. Depending on the
facts of the case, information published long ago, for example 15 years ago, could
be less relevant than information published a year ago. The authorities responsible for
data protection will assess its relevance in the light of the parameters specified
below.
A. Does the data relate to the professional life of the data subject? At the time
to consider the application for de-referral, the

49 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL).
50 CJEU, 24 September 2019, C-507/17, Google LLC v Commission Nationale de l'Informatique et des Libertés (CNIL), point
77.
Decision on the merits 37/2020 - 26/49
data must first of all make a distinction between private and professional life. The
data protection - and, more broadly, legislation on respect for life
privacy - aims first and foremost to guarantee the fundamental right of individuals to respect for their lives
(and to the protection of their data) "51 .
97. In his complaint, under the complainant's "Party Y labelling" referrals, the complainant
provides eight SEOs and URLs numbered from 1 to 8. These are listed in Exhibit 1 of
its conclusions. The other contents, numbered from 9 to 12, are under the heading of references linked to
a "harassment complaint". These are also set out in Exhibit 1 of its findings.
In essence, in support of his claim, the complainant argues that the referenced content is
inaccurate and/or obsolete and/or contain sensitive data unlawfully disclosed to the
public. It does not challenge the lawfulness of the communication to the public of the content itself to which
return referrals.
98. Before analysing the disputed referrals one after the other,52 the Litigation Chamber assesses whether the
complainant plays a role in public life53 and whether the referrals contain about him or her special categories of data referred to in section 9 of the MGDR54.
6.1. The complainant's role in public life
99. Among the criteria to be taken into account in the analysis to be carried out,55 the role played by the person
concerned in public life appears decisive. In the EDPS guidelines, the EDPS, repeating the
Court of Justice, point out the following:
"The Court has also held that the rights of the persons concerned will prevail, in the event of a breach of the principle of equal treatment, over the rights of the data subject.
s interest in accessing information through the provider of the
search engine. However, it has identified several factors that can influence this
determination. These include: the nature of the information or its sensitivity, and especially
the interest of Internet users in accessing information, which may vary depending on the role
played by the person concerned in public life ... "56 .

51 Guidelines on the execution of the judgment of the Court of Justice of the European Union in the 'Google Spain and
Inc / Agencia Espanola de proteccion de datos (aepd) and Mario Costeja Gonzalez', C-131/12 , adopted on 26 November 2014
by the Article 29 Working Group, p. 18.
52 Infra, No. 123 et seq.
53 Infra, No. 99-107.
54 Infra, No. 109 et seq.
55 Supra, No. 93.
56 Free translation of point 48 of the English text of the Guidelines. 
Decision on the merits 37/2020 - 27/49
100. According to Group 29 guidelines (pp. 15-16) :
"What is a "role" in public life?
It is not possible to establish with certainty the type of role in public life that an
natural person must play a role in justifying public access to information on that natural person.
person by means of an Internet search.
However, as an example, politicians, senior officials,
business and professional (regulated) persons
can generally be considered to play a role in public life. There are
reasons for allowing the public to seek information about the role and
activities of these people in public life.
In general, it is appropriate to consider whether the fact that the public has access to the
specific information about a person by means of a search on the basis of his or her name
would prevent it from engaging in inappropriate public or professional conduct.
It is equally difficult to define the sub-group of "public persons". In good standing
public persons can be said to be persons who, because of the
the functions they hold or the commitments they have made, are more or less exposed
to the media.
Resolution 1165 (1998) of the Parliamentary Assembly of the Council of Europe on the right to the
The Privacy Act provides a possible definition of "public persons". It states
that "public persons are those who hold public office and/or use
of public resources and, more generally, all those that play a role
in public life, whether political, economic, artistic, social, sports or other".
Some information concerning public persons is of a purely private nature and does not
s should not normally be included in search results, such as
information about their health or family members. But as a general rule, if the
persons making an application are public persons and that the information provided by the applicant is
in question do not constitute information of a purely private nature, there will be moreover
strong reasons for refusing the dereferencing of search results concerning them. The
case law of the European Court of Human Rights (hereinafter the "ECHR") is
particularly relevant for assessing the balance of interests" (italics added by the
Litigation Chamber). »
Decision on the merits 37/2020 - 28/49
101 In this context, both the complainant and Google raise issues that demonstrate that the
complainant has played and continues to play a role in public life in Belgium.
102 It should first of all be pointed out that neither the Group 29 guidelines nor the
The EDPS does not require the data subject to be a political figure in order for him to be able to act as a
role in public life.
103 In his complaint, the complainant notes that he is an executive officer of Corporation Z and that "as [executive officer] of Corporation Z, he has a role to play in public life.
officer] of [Company Z], [he] undeniably has a significant degree of exposure
media". The complainant, however, points out directly following this statement, that
the facts concerned are not likely to contribute to a democratic societal debate, and that
the public has no or no longer a legitimate interest in having access to this information. He also notes that he was
not a political figure, which, however, as just mentioned, is not decisive.
in the analysis of its role in public life.
Company Z operates in Belgium, and the complainant has been a senior executive of Company W for some time.
years, i.e. a company that is closely related to Company Z.
105 In its conclusions, Google also lists a series of functions performed by the complainant
in the past and which illustrate, also in the opinion of the Litigation Chamber, that it has also, by
the past, played a role in public life.
106.Thus, in addition to the complainant's current responsibilities already mentioned, among the duties of the position are the following
have, over a period of some twenty years, held the following positions: a member of a political cabinet of a
Minister of Party Y; Government Commissioner in Entity A; Member of Entity B; Agent
within the public service; Government Commissioner in Entity D; a very senior position
responsibilities in organization E; and a senior position in public entity F.
107.In other words, the complainant is performing and has performed public duties and/or in which
it has used and is using public resources, has been and is being exposed in the media, has acted and is acting in
a public context as a public person and, more specifically, as a senior public servant, or
agent of a public service.
Decision on the merits 37/2020 - 29/49
108 In conclusion, on the basis of the elements just set out,57 the Appeals Chamber considers that the
complainant has played and is playing a role in public life.
6.2. On the label "party Y"
109 In his complaint and submissions, the complainant alleges that Google is referencing sensitive data.
about her. In her words:
"In this case, Google's indexes show [the complainant] as a person labeled...
[Y party]. The complainant's] political opinions are sensitive data within the meaning of [the complainant's] right to privacy.
section 9 of the GDPR. These data benefit from a legal regime of enhanced protection.
For example, Google's processing of such data is prohibited, as it cannot be based on
none of the applicable exceptions (i.e. Article 9 §2 of the RGPD and Article 8 §1 of the Law of the
30 July 2018 on the protection of individuals with regard to the processing of personal data relating to
personal data)".
110 The complainant further insists that portraying him as a person "labelled party Y"....
is inaccurate information justifying its dereferencing, and that in particular the deductions of
Google regarding the complainant's links to the Y party are hasty and based on evidence
erroneous (this is discussed below58).
111 In its summary findings, Google notes that in the present context, namely that of the
and its role in public life in Belgium, it "is clear to the public that the labelling of the
policy does not in any way refer to [the applicant's] real or supposed political views, but
only the political party to which he is professionally close and which supported his candidacy
to obtaining public mandates "59. In its conclusions, Google intends to demonstrate in fact
the professional ties between the applicant and the Y Party. In particular, in order to justify that the
treatment of political labelling is important to ensure a relevant public interest debate by
the manner in which the appointment of (senior) officials and the terms of reference of the (senior)
public mandates in Belgium, Google quotes Professor David Renders as saying that the recruitment of
senior officials is politicized. In the same vein, the second paragraph of the press article
less than ten years ago from www.lecho.be profiled the complainant and reported his appointment to
a senior position in Public Entity F (Exhibit B.14 in the Google file).

57 Supra, No. 99-107.
58 Infra, no. 116-122.
59 Summary conclusions, p. 22, point 29.
Decision on the merits 37/2020 - 30/49
112 "Political labelling" of a public official/high-ranking official
and section 9 of the GDR. In the specific context of this case, the Chamber
Litigator considers that the reference to a political "labelling" of an agent of a function
or a senior public servant does not by itself automatically reveal an "opinion" of the public or a
policy: in principle, it limits itself to showing that the data subject is a political person.
professionally supported60 in his public life61 and, more specifically, in the framework of his
career as a public official and senior civil servant. Nothing precludes a party
The policy professionally supports a person's candidacy for a senior position for their
personal qualities, regardless of his political views. The complainant also pointed out that he did not
not being a member of the Y party.
113 In other words, it is on a case-by-case basis, depending on the disputed listing, that it will be necessary to evaluate whether
each listing in question also implies or not, in addition to the political labelling,
the revelation of a political opinion of the complainant.
114 This is the intent of section 9(1) of the GAR, which states that "The treatment of
personal data revealing [...] political opinions, [...]" is prohibited (emphasis added).
added by the Litigation Chamber). Thus, even supposing that the initial salaries of the sources
(the cited newspapers otherwise covered by the freedom of journalism62 ) reveal an opinion
policy, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion.
political: referencing does not pursue such a purpose, it points in this case on names
of people.
Finally, in the same spirit, but more explicitly, Article 6 of Council of Europe Convention No. 108 on the Protection of the Rights of All Migrant Workers and Members of Their Families, which is
modernised Europe for the protection of individuals with regard to automatic data processing
of a personal nature63 according to which :
"Article 6 - Special categories of data
1. Treatment :
[…]
- of personal data for the information they reveal on racial origin
or ethnic origin, political opinions, trade union membership, religious or
other beliefs, health or sex life;

60 Supra, No. 106.
61 Supra, No. 101 - 108.
62 Infra, n° 123 et seq.
63 Protocol amending (CETS No. 223) to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223).
of personal data (ETS No. 108) adopted on 18 May 2018 by the Committee of Ministers of the Council of Europe at its
128th Ministerial Session.
Decision on the substance 37/2020 - 31/49
is permitted only on condition that appropriate safeguards, supplementing those of the
this Convention, be provided for by law.
2. Such safeguards shall be such as to prevent the risks that the processing of
Sensitive data may present a threat to the interests, rights and fundamental freedoms of the
person concerned, including a risk of discrimination "64 .
116 On the inaccuracy of "Party Y labelling". To establish whether a proxy for a function
supported by either political party in a context where the appointments are made by the public service.
is a complex issue that may require investigative work.
(journalistic or otherwise) and a certain appreciation, in fine, also of the expression
an opinion with regard to the person concerned. It is not irrelevant in the present case that the
references Nos 2, 3, 4 and 5 relate to articles from the Belgian press, whether or not
the disputed referencing no. 6 is linked to a public information site (msn.com) and that finally, the
litigious referencing n° 1 concerns a Belgian website specialized in the question of the cumulation of the
mandates and transparency in this area in Belgium (www.cumuleo.be).
117 It is not for the Litigation Chamber to exhaust the debate on the accuracy of such an
information which opposes the data subject to the provider of the search engine and not to the data subject.
to the authors of this information, which is at the heart of a subject of undeniable interest.
and generating public debate. In essence, the latter is about transparency in
the appointment to and the exercise of public office in Belgium, a subject at the heart of the Belgian civil service
of democracy and which is meant to be studied over time. Article 17, 3., a), of the RGPD,
does not require such a debate to be exhausted.
118 In the present case, in order to justify the existence of political labelling, Google refers to five elements
first, the complainant was a member of the political staff of a minister of the Y he party; second, the complainant was a member of the political staff of a minister of the Y he party; and third, the complainant was a member of the political staff of the Y he party.
about 20 years ago. Second, in an article that is being requested for dereferencing,
is alleged to be a violation of the cumulation rules provided for in the statutes of Party Y and is reproduced here
an excerpt from a letter in which a political agent, P, addressed a letter to the complainant a few days ago.
has about 15 years to clarify the rules of accumulation within the party. Third, the
applicant participated as a speaker, less than 5 years ago, in a convention of the Y party.
Fourth, he gave another lecture at the Y Party, according to a Twitter posting from a
Member of the Y party in the Brussels Parliament posted a few years ago. Fifthly and finally, he
appears to have worked at the study centre of Party Y according to a senior official of a department

64 Emphasis added by the Litigation Chamber.
65 Supra, No. 111.
Decision on the Merits 37/2020 - 32/49
public (in office at the time) reported in a section66 portraying the complainant. The complainant
The article also informed the complainant that he was "labelled party Y".
119 The complainant refutes Google's position by considering that portraying her as a person
labeled party Y is inaccurate information justifying its dereferral by arguing that: it did not have
ever been a member of Party Y, that to find that the proximity between the applicant and Party Y is
demonstrated in SEO No. 3 (the reference to the letter from a political representative P) is
a hasty inference based on erroneous elements, that the applicant was not guilty
of any cumulation which could infringe the rules applying to him, and that the agent's mail
policy P (otherwise constituting private correspondence disclosed in breach of Article 22 of the
the Constitution, Article 8 § 2 of the ECHR and Article 314 of the Criminal Code) does not prejudge the
whether the complainant is (which is not the case) or is not a member of Party Y (the mail,
addressed to the complainant, stating: "...if you are a member of Party Y,...".
(120) At the hearing, the complainant noted, among other things, that the position of member of a political cabinet
of a Minister from Party Y some 20 years ago is old and that in the meantime, the
relationships can also change. He notes that even though in his private life he has regular contact
with members of this (and other) political family, this does not make him a member of the political family.
of the Y party. This is a dangerous shortcut that undermines the way it is perceived by the
public and its administration.
121 On the one hand, however, Google does not rely on these elements alone, as the
references in dispute and the elements put forward by it above67. On the other hand, more fundamentally
again, the complainant does not dispute that he has been professionally supported by the Y party in his life.
and more specifically, in the course of his career as a public servant
and senior civil servant68.
In the light of these elements,69 the Litigation Chamber considers that the Complainant's criticisms of the
to the inaccuracy of the Party Y labelling attributed to it in the disputed referencing cannot
exclude the application of Article 17(3)(a) of the GDGR.

66 Article in L'Echo at www.lecho.be.
67 Infra, no. 123 et seq. and supra, nos. 105 and 118.
68 Supra, no. 106.
69 Supra, n° 116-122.
Decision on the merits 37/2020 - 33/49
6.3 Disputed referrals
123 For the disputed citations, see Exhibit 1 of the
from which the factual elements set out below are drawn, unless otherwise specified. The
The disputed referencing is also explained in more detail in the conclusions of the summary of the
Google and related parts.
124 SEO No. 1. This referencing refers to the site cumuleo.be, and refers to the mandates,
duties and professions performed by the complainant who is cited as "Tagged party Y".
125.Having regard to the role played by the complainant in public life,70 the fact that political labelling constitutes
information related to transparency in the appointment to and exercise of mandates in an
public service (a subject at the heart of the democratic debate and one that is destined to be studied in the course of the
time), the Law of 2 May 1995 on the obligation to file a list of mandates, offices and
professions and a declaration of assets (and Article 2(2) thereof in particular), therefore
that in the present context, the mention of its labelling party Y does not reveal any of its opinions
policies71, with respect to the referencing of content whose accuracy is not in dispute (in addition to the
however, the criticism of party Y labelling advanced by the plaintiff72) the Litigation Chamber
Considers that referencing No 1 is necessary for the exercise of the right to freedom of expression, and
information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly
that Google maintained it.
126 SEO No. 2. This SEO refers to an article in the newspaper Le Soir (www.lesoir.be ).
(127) As regards the referencing of an article in a Belgian press organ, the accuracy of the content of which
related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling
party Y advanced by the complainant73), in light of the complainant's role in public life74, and
the fact that political labelling constitutes information linked to transparency in designation
and the exercise of public service mandates (a subject at the heart of the democratic debate and the
which is intended to be studied over time), and provided that in the present context, the reference to
of its labelling party Y does not reveal any of its political opinions,75 the Litigation Chamber
Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and

70 Supra, No. 99-108.
71 Supra, n° 112-115.
72 Supra, n° 116-122.
73 Supra, n° 116-122.
74 Supra, n° 99-108.
75 Supra, n°109-115.
Decision on the merits 37/2020 - 34/49
information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly
that Google maintained it.
128 SEO No. 3. This referencing refers to an article on the RTL Info website.
(www.rtl.be).
129 With regard to the referencing of an article in a Belgian press organ, the accuracy of its content
related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling
party Y advanced by the complainant76), in view of the complainant's role in public life77, and
the fact that political labelling constitutes information linked to transparency in designation
and the exercise of public service mandates (a subject at the heart of the democratic debate and the
which is intended to be studied over time), and provided that in the present context, the reference to
of its labelling party Y does not reveal any of its political opinions,78 the Litigation Chamber
Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and
of information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly
that Google maintained it.
130 While it is true that the No. 3 SEO refers to information that is more than 10 years old and therefore
of a certain seniority, this information nevertheless remains relevant since at that time
and to this day, the complainant has played and continues to play a professional role in public life.
131 S.C.R. No. 4. This referencing refers to an article on the website of the newspaper La Libre
Belgium (www.lalibre.be).
132 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which
related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling
party Y advanced by the complainant79), in view of the complainant's role in public life,80 and
the fact that political labelling constitutes information linked to transparency in designation
and the exercise of public service mandates (a subject at the heart of the democratic debate and the
which is intended to be studied over time), and provided that in the present context, the reference to
of its labelling party Y does not reveal any of its political opinions81 , the Litigation Chamber
Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and

76 Supra, No. 116-122.
77 Supra, n° 99-108.
78 Supra, n°109-115.
79 Supra, n° 116-122.
80 Supra, n° 99-108.
81 Supra, n°109-115.
Decision on the merits 37/2020 - 35/49
information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly
that Google maintained it.
133.SEO No. 5. This SEO refers to an article on the website of the newspaper La Libre
Belgium (www.lalibre.be).
134 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which
related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling
party Y advanced by the complainant82), in view of the role played by the complainant in public life83, and
the fact that political labelling constitutes information linked to transparency in designation
and the exercise of public service mandates (a subject at the heart of the democratic debate and the
which is intended to be studied over time), and provided that in the present context, the reference to
of its labelling party Y does not reveal any of its political opinions,84 the Litigation Chamber
Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and
information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly
that Google maintained it.
135 In the same way as for SEO No. 3, while it is true that SEO No. 5, is not a new product.
relating to information that is about ten years old, i.e. information that is more than ten years old.
of 10 years, is also old, this information is nevertheless relevant since at this time, the
Then and now, the complainant was and is playing a professional role in public life.
136 S.C.R. No. 6. This referencing refers to an article on the information website
www.msn.com.
137 Google claims that the url of SEO No. 6 leads to a page that no longer exists. But that's just
As such, the complainant considers that it is the referencing as such by Google that is at issue.
138 Google replies in its summary conclusions that url 6 is no longer referenced at all in the search engine.
in the first ten pages of search results, or any further. She confirmed at
At the hearing that url 6 was no longer referenced and the complainant did not contest it. The request for
The complainant's dereferencing is therefore no longer relevant as far as referencing No 6 is concerned.
Referral No 7. This referencing refers to a GERFA press release from the website
www.gerfa.be. GERFA is the Study and Reform Group on the Administrative Function. Google

82 Supra, No. 116-122.
83 Supra, n° 99-108.
84 Supra, n° 109-115.
Decision on the merits 37/2020 - 36/49
explains in its summary conclusions that PREFA is a group founded in response to the
of public services in Belgium and to bring about a massive politicisation of public services in Belgium and to raise awareness and a
reflection on the improvement of their management, that it became a certified trade union organization in 1990
and now has about 1500 members.
140 Google also maintains here that the url of SEO No. 7 leads to a page that no longer exists. But
the complainant rightly considers that it is the referencing as such by Google, which
is contentious.
141 Google replies in its summary conclusions that url 7 is no longer referenced at all in the search engine.
in the first ten pages of search results, or any further. She confirmed at the hearing
that url 7 was no longer referenced and the complainant did not contest it. The complainant's request did not
Therefore, no more purpose for listing No. 7.
142 Referencing n° 8. This referencing refers to an article on the website www.7sur7.be.
143 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which is not guaranteed.
related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling
party Y put forward by the complainant in relation to which reference is made above85), having regard to the role played by the
by the complainant in public life,86 and the fact that political labelling constitutes information
related to transparency in the appointment to and exercise of public service mandates
(a subject at the heart of the democratic debate and which is destined to be studied over time), and therefore
that in the present context, the mention of its labelling party Y does not reveal any of its opinions
the Litigation Chamber considers that referencing No. 2 is necessary for the exercise of its jurisdiction.
of the right to freedom of expression and information, and that therefore, in application of Article
17, 3., a) of the GDR, Google has rightly upheld it.
144 In the same way as for referencing Nos 3 and 5, if it is true that referencing No 5
relates to information that is about ten years old, namely information that is more than ten years old.
of 10 years, this information nevertheless remains relevant since at that time and today
Again, the complainant was and is playing a professional role in public life.
145 In view of the foregoing considerations, the Litigation Chamber concludes that it is correct that
Google decided not to pursue the complainant's request for deregistration in the
To the extent that this request requests the dereferencing of information related to political labelling. The

85 Supra, No. 116-122.
86 Supra, n° 99-108.
87 Supra, n°109-115.
Decision on the merits 37/2020 - 37/49
The Litigation Chamber dismissed the complaint concerning the requests for deregistration of our
1 à 8.
6.4 On alleged harassment
146 References Nos. 9 to 12 all refer to articles from Belgian press sites.
(respectively www.lalibre.be, www.dhnet.be, www.7sur7.be, www.sudinfo.be) all dated from a
The complainant's complaint of harassment was filed against him at the
within the public service.
The existence of this complaint is not disputed.
148 However, in the application form for dereferral submitted by the complainant to
Google on May 31, 2019, it wrote, among other things, the following: "These indexes refer to information
that [the complainant] has been the subject of a harassment complaint. This complaint was
declared unfounded in 2010. The fact that this information has not been updated justifies the request.
of dereferencing, formulated on the basis of Article 17 of the GDR".
149 In Exhibit 7 of his file, the complainant attaches what appears to be the first page (out of 22) of a
"Notice in the context of a reasoned complaint, Law of 11 June 2002, as amended by the Law of 10 January 2007,
Confidential", rendered by "ARISTA, External Prevention and Protection Service", and the 20th page
elements of which are omitted, and the following textual excerpts remain:
"...] On the basis of this definition, the elements at our disposal and the points discussed...
previously, we cannot recognize this situation as falling within the scope of the
harassment. 9. CONCLUSIONS [...] We have no basis for concluding that there were any
abusive behaviour or harassment by the respondent".
150 In this context, first, the complainant points out that the document (which Google does not dispute or contest) was not a "workable document".
authenticity, nor integrity) is dated December 2, 2010, and that the complaint against the complainant was
declared unfounded. It does not appear from the documents in the file that the complaint in question was the subject of
other possible proceedings, or even that other complaints of the same nature have been lodged
later against the complainant. In other words, the referenced information is no longer up to date, and
is no longer relevant. 
Decision on the merits 37/2020 - 38/49
151 Second, it should be noted that the articles referred to are about ten years old.
of years and evoke facts that are more or less ten years old. Thus, in addition to the fact that the
of these facts has not been established, they are old.
152 Thirdly, in this context, the reference to the fact that a complaint was made for
harassment against the complainant is likely to have a detrimental impact, both in terms of the
in his professional life than in his private life.
153 While the disputed referrals may at one time have been able to participate in a public debate about an
matter of general interest, the Litigation Chamber considers that, as of today, for the
For the above-mentioned reasons, these listings are no longer up to date and obsolete, and therefore cannot be used as a reference.
considered necessary for the exercise of the right to freedom of information in accordance with Article
17, 3., a) of the RGPD.
154 In the present case, Google cannot maintain such a listing on the basis of Article 6(1)(f) of the
DMPR, with the rights and interests of the complainant prevailing for the just cause cited. It is incumbent upon
Consequently, Google will proceed with their dereferencing.
155 In view of these considerations, the Litigation Chamber finds a breach of Articles 17, 1,
(a) and 6(1)(f) of the RGPD and orders Google Belgium SA to bring the processing into conformity and to
To this end, to ensure that all effective technical measures are implemented in order to cease the
referencing nos. 9 to 12.
156 Consequently, it is not necessary to assess the additional elements put forward by the complainant.
concerning the other disputed contents in reference No 10, relating to a budget
annual amount that would have been allocated by a public service administration.
7. Violations of the DMPP
157 Upon submission of his deregistration request form to Google on May 31, 2010
2019, under "Reason for deletion", the complainant, through his lawyer, reported that
that the harassment complaint had been declared unfounded in 2010 and that the information referenced
was therefore no longer up to date88. This fact, regardless of its demonstration on the basis of parts (such as the

88 Supra, No. 148.
Decision on the merits 37/2020 - 39/49
that the opinion referred to above89), at this stage of the process, has therefore been brought to Google's attention
as soon as the dereferral form has been submitted, and this, moreover, by a lawyer.
158 Also at that time, Google must have become aware of the fact that the referenced content
was about ten years old and concerned facts that were more than ten years old.
The Chamber therefore considers that, upon receipt of the application form for a
dereferencing introduced by the complainant, Google had actual knowledge of the
of the harassment complaint, the fact that this information was not updated, and finally,
in the case of a harassment complaint, that it was likely to cause harm to the complainant.
In other words, Google had effective knowledge from that moment on of serious grounds for
the grounds for requiring a dereferral on the basis of Article 17, 1., a) of the GDR, which in fact led the
Litigation Chamber to consider that citations Nos. 9 to 12 should be dereferred90.
However, on June 18, 2019, the "Google team" limited itself to answering the following to the plaintiff:
"...] After considering the balance of interests and rights associated with the content in
question, including factors such as your role in public life, Google has decided to
don't block it.
For the time being, we have decided not to intervene with respect to these URLs.
We encourage you to send your removal request directly to the webmaster.
that controls the site in question. This person has the ability to remove the content
on the Web or prevent it from appearing in search engines. To find out more
how to contact the webmaster [...] .
If the obsolete content of a site continues to appear in Google results, you can
ask us to update or delete the page in question. To do this, use the
[…].
If you do not agree with our decision, you are entitled to submit your
problem to the data protection authority in your country [...]".
Failure to comply with Articles 17(1)(a) and 6(1)(f) of the DPMR. In deciding to refuse to
dereferencing referencing numbers 9 to 12 on June 19, 2019, when Google LLC should have

89 Supra, No. 149.
90 Supra, n° 150-153.
Decision on the merits 37/2020 - 40/49
promptly proceed with their dereferral because it had effective knowledge of the reasons for their dereferral.
serious enough to justify that it could not be maintained pursuant to Article 17(3) ,
(a) of the RGPD91, it being understood that Google LLC could also have deregistered the
temporarily in order to verify in fact and in more detail with the complainant and his or her counsel.
the serious grounds alleged, Google LLC has failed to comply with its obligations under Article 17(1)(a),
of the RGPD.
162 The same facts also constitute a breach of section 6(1)(f) of the GDPR when
in the circumstances of this case and for the reasons already given,92 the interests of the complainant who
require protection of personal data prevail over Google's legitimate interest
to reference content available via the Internet.
163 The Litigation Chamber considers that these failures are of a serious nature on the part of
from Google. Although the provisions that were violated are open to interpretation and the
right to data protection is not an absolute right, dereferencing is an obligation
clear from a search engine following the Google Spain shutdown. As referred to by the Court of Justice,
the potential seriousness of the interference is serious and the rights of the person concerned prevail, by
principle, on the interest of this public in finding this information when searching for the name
of that person.93
164 In this case, Google was fully aware of all the facts as a result of the
the complainant's request, did not act diligently in refusing to derefer to the content
in question, when the complainant had provided him with evidence of their outdated nature. The House
Litigation considers in this context that these elements are comparable to the elements underlined
in the case of Google Spain, in particular those relating to inadequacy and elapsed time. From
Therefore, responding to the complainant's request does not require a complicated legal assessment.
The Litigation Chamber adds that in these circumstances, there is no disproportionate prejudice.
to freedom of expression and information, contrary to what Google Belgium SA supports.
(165) Failure to comply with Article 12(1) and (4) of the GDR. Finally, as regards the analysis of the balance of rights and obligations, the
interests to be realised pursuant to Article 17(3)(a) of the GDR and the case law of the Court of Justice of the European Communities.
the Court of Justice,94 and merely replied to the complainant that "[f]ollowing consideration of the
the balance of interests and rights associated with the content in question, including such factors as

91 Supra, No. 157-159.
92 Supra, n° 150-153.
93 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González, points 81 and 97.
94 Supra, Nos. 92-96.
Decision on the merits 37/2020 - 41/49
that your role in public life, Google decided not to block it", Google failed the
obligations enshrined in Article 12(1) and (4) of the GDR. Indeed, the complainant was confronted with
to a reason for the refusal of his incomplete application which does not enable him to know or understand the reasons for the refusal.
completely Google's motivation. In fact, Google has closed the door of discussion to the complainant,
by inviting him, in conclusion, if he did not agree with Google's decision, to submit
directly his problem to the data protection authority in his country. At
conclusion, Google's response as to the reason for the refusal to deregister lacked transparency
and was not sufficiently comprehensible, in violation of Articles 12, 1. and 4. of the GDR.
8. Corrective and deterrent measures.
First, the Litigation Chamber orders Google Belgium, pursuant to Article 100(1) of the GDR, to take the following corrective and deterrent measures.
1, 8° and 9° of the LCA, to bring the treatment into conformity and, to this end, to have the following implemented
all effective technical measures to stop referencing numbers 9 to 12 on the one hand, and to
all the other websites of the search engine in all their language versions
but only for users consulting them from the European Economic Area, and this at
no later than seven days after the notification of this decision and to inform the Chamber by e-mail
Litigator at litigationchamber@apd-gba.be that the above-mentioned order has been executed, in
the same timeframe.
167 In addition to the injunction to dereferencing references Nos. 9 to 12, the Litigation Chamber
Considers that the two failures referred to above require in addition, for purposes of
deterrence, the imposition of administrative fines.
168 The Litigation Chamber emphasises that the purpose of imposing an administrative fine is not to
only to put an end to an offence committed but, above all, to ensure effective enforcement
of the rules of the GSPD. As can be seen from recital 148, the PGRD wants to see sanctions, y
including administrative fines, be imposed in cases of serious infringements, in addition to
or instead of the appropriate measures that are imposed. The Litigation Chamber acts as follows
application of section 58.2(i) of the DP Regs. The instrument of an administrative fine does not therefore have the purpose of
main objective to end violations. This goal can be achieved through several measures
including the injunctions referred to in Article 100, § 1, 8° and 9° of the LCA, which are provided for in the
by the RGPD. With respect to a sanction in the form of an administrative fine, the nature
and the gravity of the violation are taken into account by the Litigation Chamber in order to examine
the imposition and extent of this sanction.
Decision on the merits 37/2020 - 42/49
169 It should be noted that this decision is not the first time that a fine has been imposed.
administratively vis-à-vis Google for a breach in the context of deregistration.
The Swedish supervisory authority, for example, imposed on Google on 11 March 2020 a fine of 75
million Swedish kronor (approximately EUR 7 million) for several breaches by it
to its delisting obligations.95
A form for the imposition of an administrative fine was sent to Google Belgium SA, a company that is not a member of the European Union.
on 4 June 2020 to make these arguments regarding the imposition of administrative fines.96
In response to this form Google Belgium SA puts forward several arguments. First and foremost Google
Belgium argues that no sanctions should be imposed on it, since this would be "totally
inappropriate, dangerously counterproductive and even illegal "97. In the alternative, Google Belgium
SA states that "the envisaged sanctions would violate the principle of proportionality of the standards....
repressive. In addition, the publication by name of a sanction against Google Belgium SA
would be counterproductive "98. In the further alternative, Google Belgium SA considers that the
the determination of the amount is not properly justified because "the Litigation Chamber has
... and did not take into account the mitigating circumstances "99.
The amount of the fine is also considered problematic by Google Belgium SA because
it is not able to control the scale, formula and method of calculation used for its
determination.
172. In response to these arguments, the Litigation Chamber specifies that it is relying on Article 83 of the
to conclude that an administrative penalty is warranted and to calculate the
amount. The Litigation Chamber gives reasons for its decision on the basis of the findings set out below.
As indicated in the fine form, in respect of the determination of the amount of the fine, the
of the turnover of Google Belgium SA, which is a criterion for the calculation of the fine,
the Litigation Chamber is based on the opinion of the European Data Protection Committee which
is the following:
"In order to impose effective, proportionate and dissuasive fines, the enforcement authorities
will rely on the definition of business provided by the ECJ for the purposes of
the application of Articles 101 and 102 TFEU, namely that the concept of undertaking must
be understood as an economic unit that can be formed by the parent company and all of its subsidiaries.

95 EDPB "The Swedish Data Protection Authority imposes administrative fine on Google", 11 March 2020, available at
www.edpb.europa.eu.
96 Supra, No. 10.
97 Response of Google Belgium SA to the fine form, 24 June 2020, p. 2.
98 Ibidem
99 Ibidem
Decision on the merits 37/2020 - 43/49
the subsidiaries concerned. In accordance with Union law and case-law, it is necessary to
to define an enterprise as the economic unit engaged in commercial activities, or
economic, irrespective of the legal person involved (recital 150). »100
174 The Litigation Chamber therefore bases itself on the turnover of the Alphabet conglomerate,
the presumed parent company of Google Belgium SA, the amount of which for the last three years was
can be found below :
.
- Alphabet turnover 2019: $161,857 billions.
- Alphabet turnover 2018: $136,819B billions.
- Alphabet turnover 2017: $110.855 billion.101
175 Concerning the failure to comply with articles 17, 1, a) and 6, 1, f) of the RGPD, the Litigation Chamber,
having regard to Article 83(2) of the GDR, decides to impose an administrative fine in the amount of
EUR 500,000, taking into account :
(i) at least from 19 June 2019 to 6 May 2020, being the date of the hearing held in the
the present case, i.e. for a period of 10 months, despite the fact that, in the
the communication in the course of the proceedings by the complainant in the context of the exchange of
findings of a dismissal notice issued by ARISTA regarding the harassment complaint102,
Google has maintained referencing numbers 9 to 12, even though it had some serious elements at its disposal
of such a nature as to justify deregistration since 19 June 2019. The maintenance of
references 9 to 12 has caused (and could still cause) significant damage to the
reputation of the complainant, since the complainant saw particularly negative information at the time.
its subject maintained in the search engine referencing for more than ten months,
when he had requested its removal and provided evidence of inaccurate information.
The Litigation Chamber considers that the decision directly concerns the Complainant.
and indirectly, all Internet users who may have searched for information about it.
on the search engine. During this period, the disputed referrals have been
maintained by Google without any legal basis under Article 6(1) of the GDR, which
constitutes a serious breach of the GDPR. The violation of Article 17, 1., a) constitutes
also a violation of an essential principle of the GDPR and constitutes at least a violation of a fundamental principle of the GDPR.
gross negligence (Article 83(2)(a) of the GDR) ;

100 "Guidelines on the application and setting of administrative fines for the purposes of Regulation (EU) 2016/679", WP
253, adopted 3 October 2017, p. 6, available at www.edpb.europa.eu.
101 Available at: https://www.macrotrends.net/stocks/charts/GOOG/alphabet/revenue.
102 Supra, No. 149.
Decision on the merits 37/2020 - 44/49
(ii) the above elements constitute a serious breach of the PMPRB and a serious breach of the PMPRB.
negligence on the part of Google Belgium SA (Article 83(2)(b) of the GDR). Google Belgium
cannot in this respect claim that it has put a dedicated online form at
the persons concerned, formed teams and set up a committee for the purpose.
legislative, or that it responds favourably to a large number of requests for
dereferencing. This is part of Google's responsibilities in relation to the RGPD, which
are proportionate to the importance and risks of the processing operation (Article 24(1) of the
RGPD). Google Belgium SA also cannot rely on the absence of mediation.
organized by the ODA Front-Line Service to mitigate its shortcomings. Indeed,
pursuant to Article 62.§ 2 of the ACL, only applications may be the subject of mediation
of the Front Line Service. Complaints considered admissible must be
directly transmitted to the Litigation Chamber (62.§ 1 of the LCA). In the case that we
concerned, the complainant had lodged a complaint and not a request103. Furthermore, the
Chambre Contentieuse recalls that the administrative fine is not a corrective measure,
but a deterrent104 , the effect of which cannot be replicated by mediation ;
(iii) to date, the defendant has not taken any steps, even temporary, to mitigate the
damage suffered by the plaintiff, even though she has known since the fine form was sent
on June 4, 2020 that the Litigation Chamber was questioning a violation of the GDR and that
the Litigation Chamber considered the imposition of a sanction (Article 83. 2, c). On this point,
the Litigation Chamber clarifies that it is under no obligation to suggest or impose on the party
defendant to take measures which would enable it to reduce the amount of the fine
or no fine at all.
(iv) as has been pointed out on several occasions105 , Google LLC is the subject of litigation
important with regard to the implementation of the right to oblivion and the provisions contained therein
in France, Spain and Sweden. It must be noted that
despite these precedents, the group's modus operandi still does not allow it to
fully and adequately fulfil its obligations arising from the right to oblivion. Even if it
requires a case-by-case analysis, the right to oblivion constitutes an obligation
clear 106. The Litigation Chamber notes, however, that there is not strictly speaking any
recidivism where the legal entities concerned are different (Article 83(2)(e));

103 Text from the original complaint of the complainant: "[The complainant] instructed me to lodge a complaint with
of your Authority following GOOGLE's refusal to grant its requests for deregistration, sent via the forms of
request for deletion of personal information".
104 Supra, No. 168.
105 Supra, notes 6-9.
106 Supra, no. 163. 
Decision on the merits 37/2020 - 45/49
(v) the data concerned are data of a sensitive nature, as they are facts of
criminal in nature, even if in this case the harassment complaint against the complainant
and included in the disputed references has not been brought before a criminal court.
(Article 83.2, g).
(vi) With regard to Rule 83.2 (i), the Chamber refers to (iv) above,
(vii)these elements are finally aggravated by the fact that, on the one hand, Google's search engine
is widely used by Internet users, and that Google is a company with
(its annual worldwide turnover in 2019 was $161.857 billion).
Its deregistration obligations are proportional to its size and to the
group turnover. In view of the significant litigation it has had to manage before the Court
of Justice of the European Union107 , the Litigation Chamber considers that Google should have
Since then, the company has developed a great deal of expertise in the field, which should help to avoid shortcomings.
such as those found by the House. This also justifies that greater diligence
is expected from it (Article 83(2)(k) of the GDR).
176. The Litigation Chamber further recalls that, under Article 83(5)(b) of the GDR, it provides as follows
the power to impose fines of up to EUR 20 000 000 or up to 4% of the turnover of
the company. The amount of the fine provided for in this decision is well below
These ceilings and represent a reasonable amount in relation to sales ($161.857 billion in
2019) of the Google Group. It cannot therefore be considered disproportionate.
As regards the failure to comply with Article 12(1) and (4) of the RGPD, the Litigation Chamber, having regard to
Article 83(2) of the RGPD decides to impose an administrative fine of EUR 100 000,
taking into account the following elements :
(i) having regard to the key role played by Google's search engine in the dissemination of
information via the Internet, and its widespread use by Internet users, the lack of motivation
of an understandable and transparent refusal to deregister content of a nature to
prejudice to a person concerned, constitutes a serious breach of the DMPR,
which is furthermore likely to prejudice the person concerned, who is irritated by the
receive a seemingly standard and untidy response, to feel the injustice of not being able to be
as it could be from an entity such as Google (see the following indent on this
point), and to be forced in this context, in the event of dissatisfaction, to turn to an
other entity (the publisher of the referenced content or the data protection authority of its
countries) (Article 83(2)(a) and (b) of the GDGR) ;

107 See, in particular, notes 6, 7 and 8 above. 
Decision on the merits 37/2020 - 46/49
(ii) Items 177, (iv), (vi), (vii), and 178 above.
Concerning the application and reply forms for de-listing
178 Previously, in paragraphs 71 to 79 of this decision, the Litigation Chamber has noted that
that as part of Google's delisting request management process
LLC, some ambiguity was maintained as to the identification of the controller who
is not clearly and unambiguously identified. The facts pinned at that point in this
decision constitute a breach of Articles 12(1) and (2) and 14(1)(a) of the GDR. Google LLC is
is unable to clearly identify the precise legal entity responsible for the
data processing carried out in the context of referencing (and de-referencing) activities
Google's search engine, which makes it difficult for the individual to exercise his or her rights.
concerned, not knowing precisely in fine, who his interlocutor is.
The Litigation Chamber decides to order Google Belgium SA to have the forms adapted.
and communicates to the users who use its electronic services of
internet search engine from the Belgian territory, for the purpose of dereferencing, in
clearly and precisely identifying which legal entity(ies) is/are responsible for the
treatment and what treatment.
9. Administrative transparency
180.Given the importance of transparency in the decision-making process and in the
decisions of the Litigation Chamber, also taking into account the scope of the present decision
which concerns a very large number of people concerned, namely all Belgian residents - and by
analogous to all residents of the EEA - who are likely to be referenced via the search engine
from Google on the basis of a search including their first and last names as keywords, this
The decision will be published on the website of the Data Protection Authority.
In the present case, the Litigation Chamber decides not to delete the data.
of Google's identification. However, it decided to delete the complainant's personal data.
and the other people mentioned. The Chamber considers that such a deletion is necessary in order to
of the objective pursued by the complainant, namely dereferencing by Google. 
Decision on the merits 37/2020 - 47/49
182 In the reaction to the fine form, Google Belgium SA states, inter alia, that a
publication would be counterproductive and would stigmatize Google. This argument is not convincing.
First of all, Google Belgium SA considers that such a publication would be counterproductive.
since it would encourage people seeking dereferencing to turn to Google unnecessarily
Belgium SA rather than Google LLC. This argument cannot be accepted. Indeed, the request for
dereferencing is not done by postal mail, but by an online form put at
disposition by Google LLC. It is not possible to turn to the wrong entity during a
request for dereferencing since it is Google LLC that makes the web page available and that runs
the process for dealing with his complaint. Apart from extremely marginal cases, the Litigation Chamber
can't see how a person could direct his or her request for dereferral to Google
Belgium SA.
Second, with regard to the stigmatisation argument, the Litigation Chamber points out that the
publication with identification of the defendant pursues two objectives. First of all, it aims to
an objective of general interest, because it explains the responsibilities (of the subsidiaries in the Union) of
Google under RGPD. Indeed, in view of the importance of the search engine "Google" for very
and the fact that a large proportion of people living in Belgium are now using the Internet.
find referenced in one way or another on the search engine "Google", the Chamber
Litigator considers it appropriate to give this decision publicity that can raise awareness among the
Internet users to their rights under the GDR. As such, even if the decision does not concern
directly as the complainant, it is of interest to a large segment of the general public. The
publication of the decision is highly relevant in this respect.
The publication of the decision is also intended to act as a deterrent. The Litigation Chamber challenges the
that the decision is discriminatory, as argued by the defendant. Article 100(1),
16 of the Act of 3 December 2017 establishing the Data Protection Authority gives the
power of the Administrative Jurisdiction Division to decide on the publication of the decision "on a case-by-case basis".
The Chamber has in the past already decided to publish decisions with identification of the party.
defendant, when it considered that such publication would contribute to the rapid compliance of
the litigious situation and to reduce the risk of repetition108 and that, furthermore, any
pseudonymization of the defendant's name would be illusory.

108 See, inter alia, Litigation Chamber, 9 July 2019, Decision on the merits 05/2019; Litigation Chamber, 23 June
2020, Substantive Decision 34/2020.
Decision on the merits 37/2020 - 48/49
10. Device
ON THESE GROUNDS,
the Litigation Chamber of the Data Protection Authority shall decide, after deliberation :
(1) pursuant to Article 100, paragraph 1, 2°, of the DPA, dismiss the complaint
concerning the requests for dereferral of referrals Nos. 1 to 8.
(2) pursuant to Article 100(1), 8° and 9° of the LCA, orders Google Belgium
SA to bring the processing into conformity and, to this end, to have all the necessary
effective technical measures to stop referencing numbers 9 to 12 on the one hand,
for all the other websites of the search engine in all their versions
language, but only for users consulting them from the Economic Area.
European Union, no later than seven days after the notification of this Decision, and
to inform by e-mail the Data Protection Authority (Litigation Chamber) that
the above-mentioned order has been executed, within the same period of time (via the e-mail address
litigationchamber@apd-gba.be);
(3) pursuant to sections 100, 13° and 101 of the LCA and 83 of the GDR, requires Google to
Belgium SA a fine of EUR 500 000 for failure to comply with Articles 17(1)(a) and 6,
1., (f), of the GDR.
(4) pursuant to sections 100, 13° and 101 of the LCA and 83 of the GDR, requires Google to
Belgium SA a fine of EUR 100 000 for failure to comply with Article 12(1) and (4) of the
RGPD;
(5) pursuant to Article 100(1), 9° of the LCA, orders Google Belgium SA to
to adapt the electronic forms it makes available and communicates to the
users who use its internet search engine services from the territory
for dereferencing purposes, clearly and precisely identifying which Belgian
legal entity(ies) is (are) responsible for the processing and for which processing operations, at the
no later than two months after notification of this Decision and to inform by e-mail
the Data Protection Authority (Litigation Chamber) that the aforementioned order has
has been executed, within the same time frame (via the e-mail address litigationchamber@apd-gba.be).
Decision on the merits 37/2020 - 49/49
According to Article 108 § 1 of the ACL, this decision may be appealed against within a time limit of
of thirty days from the notification to the Market Court, with the
given as a defendant.
(sé.) Hielke Hijmans
President of the Litigation Chamber