FiS - 7565-20

FiS - 7565-20
Court:	FiS (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(b) GDPR Article 17 GDPR
Decided:
Published:	23.11.2020
Parties:	Google LLC
National Case Number/Name:	7565-20
European Case Law Identifier:
Appeal from:	Datainspektionen DI-2018-9274
Appeal to:
Original Language(s):	Swedish
Original Source:	The Administrative Court of Stockholm (in Swedish)
Initial Contributor:	n/a

The Administrative Court of Stockholm (FiS) rejected Google's motion of repealing the Swedish DPA's decision on Article 17 violations by the company. However, the Court did lower the fine imposed by the DPA from €7 million to €5,091,000.

English Summary

Facts

In the context of requests from data subjects pursuant to Article 17, Google has a routine of informing webmasters when a search result has been removed from the list of search results. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. This in practice puts the right to delisting out of effect.

Google believes that webmaster information is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information.

Dispute

Was Google's practice of informing webmasters lawful under the GDPR?

Holding

The Court held that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.

While the Court found Google's practice to be unlawful, it also ruled that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The Administrative Court therefore reduces the sanction fee from a total of SEK 75 million to SEK 52 million.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Google's routine violates the GDPR
Dimensions: 7565-20
Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". In a judgment today, the Administrative Court has found that this is not permitted under the Data Protection Regulation (GDPR).
The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name.

Google believes that webmaster information is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information.

On the other hand, the Court has ruled that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.

- The court has found that Google's procedures regarding requests to remove search hits are contrary to the Data Protection Ordinance, says lawyer Stefan Holgersson

However, the Court finds that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The Administrative Court therefore reduces the sanction fee from a total of SEK 75 million to SEK 52 million.