Helsingin hallinto-oikeus (Finland) - H6072/2021

Helsingin hallinto-oikeus - H6072/2021
Court:	Helsingin hallinto-oikeus (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 6(1)(f) GDPR Article 17(3)(a) GDPR Article 21(1) GDPR
Decided:	02.12.2021
Published:
Parties:	Google LLC
National Case Number/Name:	H6072/2021
European Case Law Identifier:
Appeal from:	Tietosuojavaltuutetun toimisto (Finland) 918/154/2019
Appeal to:	Appealed - Overturned Korkein hallinto-oikeus (Finland) KHO:2024:34
Original Language(s):	Finnish
Original Source:	Helsingin hallinto-oikeus (in Finnish)
Initial Contributor:	fred

The Helsinki Administrative Court overturned a DPA decision ordering Google to remove outdated search result links from Google Search. The Court found that the links were of public interest.

English Summary

Facts

Google LLC (the controller) had asked the Administrative Court of Helsinki to overturn the Finnish DPA's decision, according to which the controller had been ordered to remove outdated search result links from Google Search.

The controller filed the appeal claiming that the search results were necessary for exercising the right of freedom of expression and information within the meaning of Article 17(3)(a) GDPR. The controller also stated that there were compelling legitimate grounds to keep the search result links available to the public under Article 21(1) GDPR, as the data subject acted in a public role.

The DPA argued that the date indicated in the news articles to which the search result links led did not guarantee that the reader understood the information as describing past events. Thus, a reader who ignored the date of the news article could think that the police was still seeking information about the data subject's whereabouts.

Holding

The Court found that the controller processed the personal data for the purposes of its legitimate interests in accordance with Article 6(1)(f) GDPR. Therefore, the data subject must be considered to have objected to the processing of their personal data on grounds relating to their particular situation in accordance with Article 21(1) GDPR.

In this respect, the Court considered that the data subject could be considered to have a public role in terms of balancing the interests between the right to privacy and freedom of expression due to the commission of a serious crime. The data subject could also be considered to have a public role as CEO and board member of a real estate agency.

The Court noted that the news articles to which the search result links led indicated the date on which the news had been published. Thus, the fact that the general public might mistakenly believe that the arrest warrant against the data subject was still valid could not be given decisive weight in the balancing of interests.

In light of this, the Court held that the data subject's right to privacy did not override the public interest in access to information concerning the data subject. As a result, the Court overturned the contested decision and the order contained in it to remove the search result links.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

HELSINKI ADMINISTRATIVE COURT DECISION

02.12.2021

H6072/2021

ID number 21148/03.04.04.04.01/2020

Case A complaint regarding a data protection case

Appellant Google LLC

Decision to be appealed

Deputy Data Protection Commissioner 3 June 2020 ID number 918/154/2019

has on January 31, 2019 initiated a case at the data protection commissioner's office, which concerns the removal of 12 url search result links from the Google Search search service. While investigating the matter, Google LLC has announced that it has removed url search result links 2 and 12, which is why the deputy data protection commissioner's decision under appeal is limited to url search result links 1 and 3–11.

The url search result links that are the subject of the decision under appeal lead to online content, the main subject of which is the published wanted notice about the applicant. However, there is also information available that the Helsinki Court of Appeal had sentenced the applicant to a prison sentence of nine years and four months for a serious drug crime. In the online content, the applicant's appearance has been described, and requests have been made to report any observations about the applicant to the Helsinki Police Command Center.

The applicant has justified his removal request by, among other things, that information can be found behind the url search result links requested to be removed, which is already out of date. The applicant has said that the wanted notice in question has not been valid since April 2011. The applicant has emphasized that the online content in question specifically concerns the wanted notice, not the facts behind the wanted notice.

In its appealed decision, the Deputy Data Protection Commissioner has accepted the applicant's demands and given Google LLC an order in accordance with Article 58, paragraph 2, subsection c of the General Data Protection Regulation to comply with the applicant's request to remove the url search result links in question.

The Deputy Data Protection Commissioner has presented the following as reasons for his decision, among other things:

Committing a criminal act and being convicted of it basically gives a person a public status in society and exposes them to so-called media exposure for the act in question. The starting point is that a person who has committed a criminal act cannot have the same justified assumption about the extent of the protection of their privacy after their act as a person who has not committed a crime.

However, the above does not mean that a person who has committed a crime has no privacy protection at all. Despite the criminal act and the punishment received for it, part of the personal data of the person in question remains within the scope of his private life and the protection of privacy, which is his fundamental right.

In the applicant's case, it is undisputed that he was sentenced to a prison sentence of nine years and four months for a serious drug offence. As a result, the applicant has a public or public-like status as referred to in the judgment of the Court of Justice of the European Union C-131/12. This public position basically gives the general public a legitimate interest in obtaining personal information about the applicant from the Google Search search service as outlined in judgment C-131/12.

The applicant has not denied that he was convicted of a serious narcotics offense to a prison sentence of nine years and four months and that he was the subject of a wanted notice. So it is not really a question of the fact that behind the url search result links in question there is information available about a matter concerning the applicant that is not true. However, it is significant that the subject of the online content in question is a wanted notice published about the applicant, and not the factors behind the wanted notice. The online content does not describe the applicant's crime in more detail. The applicant's act and the resulting punishment are only mentioned at the mention level. The main topic of the online content is the published wanted notice for the applicant.

When the url search result links requested to be removed have dealt with the applicant's crime and possibly the related punishment, the applicant's case is basically mirrored in the special international legislation that generally defines the temporal dimension of the availability of information about the commission of crimes.

However, as stated in the interpretation guidelines of the Council of Europe's Data Protection Board, the evaluation must take into account the original purposes of the processing and the original storage periods applicable to the information in question.

In the online content in question, the main subject is the wanted notice published about the applicant. The wanted notice is no longer valid. The public no longer has a reason to inform the police of their observations about the applicant. Due to the passage of time, the availability of information can no longer be considered justified.

According to section 34 subsection 1, actually subsection 2, section 4 of the law on the processing of personal data in police operations, other search warrant information processed for the purpose of reaching, monitoring, monitoring and protecting persons is deleted three years after the warrant is canceled or terminated. The validity of the wanted notice published for the applicant has expired in April 2011. If the applicant's case is reflected in this retention period provision, it can be stated that information about the wanted notice concerning the applicant is no longer socially relevant.

Claims presented in the complaint

The decision of the Deputy Data Protection Commissioner must be overturned and the administrative court must order that search results do not need to be removed from the results of searches made in the applicant's name. Secondly, the matter must be returned to the deputy data protection commissioner to be resolved again without applying different evaluation criteria, on the one hand, to the information that the applicant has escaped from his prison sentence, and on the other hand, to other information about the applicant's crime and punishment.

The following is presented in the complaint, among other things:

There is no legal basis to order the search results in question to be deleted. The search results are necessary for exercising the right to freedom of expression and freedom of communication, as referred to in Article 17, paragraph 3, letter a, of the EU Data Protection Regulation. There is also a remarkably important and well-founded reason for keeping them available, as referred to in Article 21, paragraph 2 of the Data Protection Regulation. The conditions in question are met because the balance of interests between the applicant's privacy interests and freedom of speech (and the public's right to access information) leans in favor of keeping the search results available.

The applicant has committed a serious crime that is still the subject of legitimate public attention and discussion. Considering the seriousness of the applicant's crime and his activities as a real estate agent, it must be considered that the applicant has a public position. The news stories in question are also objects of legitimate public attention as intended in legal practice. Other factors taken into account according to jurisprudence also support making search results available. There is no basis for stricter evaluation criteria to be applied to news writing about the applicant's escape from prison sentence than to news writing that indisputably still tells about the applicant's crime and punishment in a relevant way.

In the case at hand, the applicant's privacy interests must be weighed against freedom of speech and the public's right to access information. In this weighing of interests, the relevant jurisprudence of the EU Court of Justice and the European Court of Human Rights must be taken into account.

In summary, it can be stated that the European Court of Human Rights has confirmed that the following factors should be taken into account in the weighing of interests: (a) the legitimate attention value of the material and its relevance for public discussion, (b) the well-known or public position of the person in question, (c) the previous activities of the person in question, (d) the method of obtaining the information and the use of the information correctness, (e) the content, form and consequences of publishing the information, and (f) the severity of the measures that may be taken against the data controller. No single fact is necessarily decisive as such, but in general it can be stated that a strong starting point is that search results should not be ordered to be deleted if they lead to information related to persons in public positions.

The inclusion of search results in the discussion of legitimate public interest or attention is a factor that strongly advocates making search results available. In jurisprudence, not only politics, but also, for example, serious crimes, have been considered the subject of legitimate public discussion. This aspect has been considered particularly important in the assessment and in jurisprudence it has been described as an essential factor for the assessment.

Google LLC understands that it basically agrees with the Deputy Data Protection Commissioner that the applicant's aggravated drug offense is serious to such an extent that it is still the subject of legitimate public attention and discussion as intended by jurisprudence.

In the decision under appeal, however, the deputy data protection commissioner tries to create a difference between the legitimate attention still directed at the applicant's crime, punishment and person, and the news stories in question, essentially on the basis that the Linked Materials mainly concern the applicant's escape and the search warrant, and not his wider crime and punishment. Thus, the legitimate attention to the applicant's crime and punishment would not extend to the applicant's flight. The latter should be evaluated separately and the information about it should be considered "outdated" much earlier in terms of public relevance and attention value.

That approach is flawed. The applicant's crime, punishment and escape from punishment are part of the same narrative or story. A certain part of the narrative, such as the escape, should not be separated from the flow of events and thus subjected to its own independent, much more severe evaluation of the other narrative.

It would be strange that even if the public in itself had the right to receive information about the crime and the related punishment, it would not have the right to receive information about the fact that increases the reprehensibility of the crime, i.e. the fact that the applicant also did not report to serve his prison sentence or that he evaded the authorities for months.

The jurisprudence of the European Court of Human Rights also requires that the broader context of the news stories being evaluated be taken into account. It is usual for stories about the developing news situation to be written, for example, in the present tense or they are limited to a certain part of a broader overall narrative, such as a specific day or event of the wanted ad in question. Despite this, such news writings are part of a wider whole. They should be understood in this context and as part of the object of legitimate public attention.

The news story should be evaluated as a whole. The writings in question are part of this whole. If and when the public has a legitimate interest in obtaining information about the applicant's crime and punishment, the public should also be considered to have a legitimate interest in knowing that the applicant has escaped his punishment.

The fact that the applicant finally reported to prison has not called into question the correctness of the previous writing. It is still undisputed that the writing in question is truthful and correct.

It has been the practice of the Office of the Data Protection Commissioner to refer to the retention time rules for criminal record information when assessing whether a certain news article is still relevant as a subject of public attention. Pursuant to section 10, subsection 2 of the aforementioned law, information on crimes resulting in a prison sentence of more than five years should be kept until the person concerned is dead or turns 90 years old. Compared to this retention period, the applicant's activities should clearly still be considered a relevant subject of attention.

In the decision under appeal, however, the deputy data protection commissioner has exceptionally evaluated the matter in light of the law on the processing of personal data in police operations. It must have been done this way, because the Criminal Records Act does not contain a specific rule regarding search warrants.

It is questionable to what extent the authorities' regulation regarding retention periods is generally suitable as a point of comparison when assessing whether a certain piece of news is still a legitimate object of public attention. Retention periods for official information are a completely different matter than the question of how long some news is still relevant in light of the broader freedom of speech regulation. When creating legislation regarding the retention periods of official data, the legislator considers the regulation from a much narrower perspective, and for example does not take into account the perspective of freedom of speech or the operation of search engines at all.

If jurisprudence were to create an automatic connection between the retention periods of official data and the legitimate interest/attention assessment, this would also limit the legislator's freedom of action in an inappropriate way. The legislator would no longer be able to limit the retention periods of official data without at the same time restricting freedom of speech and public debate, and the retention periods could become inappropriately long.

The Office of the Data Protection Commissioner refers to the regulation regarding the storage periods of official data mainly on the basis that the regulation generally reflects underlying social values. The regulation is therefore not referred to as the legal norms actually applied to the weighing of interests. In the weighing of interests, therefore, in any case, the focus should be on the underlying societal evaluations. Weighing the interests should not be a matter of a detailed exercise of applying the law of the retention time regulation, when it is especially taken into account that the purposes of the individual retention time rule and the depreciation assessment of the search engine result can be completely different.

Thus, for example, the mere fact that the Criminal Records Act does not have a specific provision regarding search warrants does not mean that the weighing of interests should deviate from the general line. The core question should not be the interpretation and application of the law related to individual storage time norms, but the underlying social values and an overall assessment that takes into account all relevant aspects.

The opposite interpretation could also lead to a very fragmented approach. It would be unsustainable to divide the overall abuse report into separate parts, all of which would be subject to some single retention time standard to determine whether that part of the report is still relevant for public discussion. A holistic approach should be applied in relation to the overall narrative.

It is questionable to what extent the Police Personal Data Act is suitable as a point of comparison. The same reference point should be applied to the overall report. The practice of the Office of the Data Protection Commissioner has been to refer to the Criminal Records Act as a point of comparison. However, the retention periods of the Police Personal Data Act are generally shorter than the retention periods of the Criminal Records Act, even for similar crimes. The laws therefore do not represent uniform social values regarding storage periods. One law cannot be used to fill gaps in another law. This would mean applying inconsistent background values to different parts of the whole.

The case must therefore be considered to have a legitimate public interest or attention, not only to the information about the applicant's crime and punishment, but also to the fact that the applicant illegally evaded his punishment. It is not justified to separate the latter part of the overall report as its own, subject to a much stricter assessment, mainly only on the basis that the Criminal Records Act does not contain an explicit rule regarding a certain individual type of information.

Another factor that, according to jurisprudence, strongly favors the availability of search results is that the information is related to a person with a public position. The applicant now has a public position in a relevant way in two respects. The applicant has committed a serious crime. The applicant is also a business operator. It appears from the trade register that the applicant currently works as the CEO and board member of a real estate brokerage company. The public must be able to trust the applicant in connection with their most valuable personal transactions, i.e. when buying and selling their home or other real estate. The applicant himself has stated that he practices a public profession.

The media attention in question now has been a predictable consequence of the fact that the applicant escaped his long prison sentence for months, especially considering that he was the subject of an Interpol Red Notice and an intensified search.

The main reason for the principle of the public status of business persons is the protection of the public, so that the public would have an independent opportunity to assess the reliability of their business partners. In assessing the reliability of a business person, there is no reason to distinguish between punishment and evasion of punishment.

The information found behind the search results in question is based on official information from the police, the express purpose of which was to become known to the media and the general public. It is also undisputed that the information is correct. Thus, this factor also supports leaving the search results available.

The linked news articles are truthful news writing without excessively negative or insulting comments to the applicant. Although, for example, the expression "" can be considered somewhat dramatic, the expression clearly does not cross the line of appropriate media reporting.

All Linked materials are clearly dated. It is thus clear to the reader that they tell about past events. As stated above, there is no jurisprudence according to which stricter evaluation criteria should be applied to "real-time" reporting of a developing news situation than to retrospective news writing, despite the fact that the former is often written in the present tense and thus may only tell about a certain part of the overall story.

The applicant has not even really claimed that people would have often reported the applicant to the police, thinking that he was still running away from his punishment. The personal harms presented by the applicant in support of his application are in fact related to his business and are the same that he would suffer in any event as a result of the crime and punishment being known.

The potential harm caused to the applicant by the attention value of his crime is not of such a nature that it overrides the public's legitimate interest in receiving information about the case or the attention value of the applicant's public status. Therefore, it is also not justified to apply stricter evaluation criteria to writing about the applicant's escape journey than to other writing about the applicant's crime, taking into account that the alleged harms related to these are essentially the same. The fact that the media attention related to the applicant's crime happened to be focused on the wanted notice concerning the applicant and the Interpol operation aimed at apprehending him, should not change the assessment of the whole and the applicant's position.

According to legal practice, the factors taken into account in the weighing of interests are in favor of making the search results available. The applicant has a public status and the writing concerns a matter of legitimate public interest in legal practice. Other factors to be taken into account also do not support the deletion of search results.

Case handling and investigation

The Deputy Data Protection Commissioner has issued a statement that states, among other things, the following:

The subject of the news articles in question is not the applicant's escape from a prison sentence. The news articles in question are short in content and they are based on the official bulletin on the wanted notice published by the police. The police had published the wanted information to catch the applicant. The news articles are mainly from July 2010, and the news content states that the applicant was sentenced to nine years and four months in prison for a serious drug offense in February. The news content also tells about the applicant's movements and describes his hallmarks. Some of the news articles have also reported that the police participated in Interpol's Infra-Red operation. On the other hand, the content of the crime or the facts that led to the verdict are not explained at all in the news content.

The date stated in a news article is not always a guarantee that the reader understands that the information describes past events. Especially in the era of social media, it has been generally noticeable that people share even old news content without realizing or noticing that it is about old publications. For the news articles in question, the headlines are important, among other things. For example, behind the url search result link 6, you can find Yle's news article with the title . Behind the URL search result link 4, on the other hand, you can find Alibi's news article with the title . Such a title is apt to mislead the reader. At least a reader who doesn't pay attention to the date of the news article might imagine that the police are still asking for clues about the applicant's whereabouts. The headline of Alibi's news article and the promise of a reward, on the other hand, are apt to lead to endless clues. The police have done their best in the matter and the search warrant has been canceled in April 2011. The decision under appeal has not given decisive importance to the tense used in the news articles.

There is no special legislation that outlines the permissibility of keeping certain information available explicitly in internet search engines. However, an introduction to the matter can be sought from legislation in general and how the availability of such information has been aligned in Finnish society. If the issue is looked at from the perspective of the media, the Journalist's Guidelines prepared by the Finnish Journalists' Association and the solutions of the Public Word Council come into consideration. If news has been published about the investigation request, indictment or verdict, the matter must be followed up to the end as far as possible according to the Journalist's instructions. In the news articles in question, the events have not been followed up to the end - for example, the articles have not announced that the applicant is no longer being sought. Following the events to the end would have been of paramount importance to ensure that no unnecessary reports were made to the police about the applicant's whereabouts or supposed whereabouts.

It would justifiably be possible to evaluate the news about the applicant's flight differently. The applicant's crime is so serious that it must continue to be considered the subject of legitimate public attention and discussion. This can also be said to be the case with regard to the applicant's prison sentence and his escape. The applicant's escape has indeed been the subject of news. Some of the online content in question can also be found by Google Searches performed by me as the applicant's former name.

In the judgment C-136/17 of the Court of the European Union, it has been stated that "the operator of the search engine must accept the request to remove the search results from the list of links to websites that contain such information, if the information in question relates to an earlier stage of the court proceedings in question and is not responsible for the course of the proceedings in question only the current situation, in so far as the examination of the important public interest reasons referred to in Article 8(4) of the said Directive states that, taking into account all the circumstances of the case under consideration, the fundamental rights of the data subject guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights supersede potentially interested internet users fundamental rights protected by Article 11 of the Charter of Fundamental Rights." The aforementioned legal guidance can be applied analogously to the case at hand. The online content in question is based on an official bulletin that was published to catch the applicant. The online content has not actually reported on the applicant's escape, but instead asked to inform the police of findings concerning him. The applicant's escape appears indirectly from the news coverage, but it is not actually the subject of the news coverage. The information about the applicant's wanted notice is out of date.

In principle, the general public cannot be considered to have an interest in receiving the out-of-date information in question, which is based on the official police bulletin and has since lost its meaning. It is also important that, as mentioned above, the information is mainly available from the Google Search search engine, also with searches made using other than the applicant's former name. Now, in addition to the url search result links in question, a url search result link is also available in connection with a Google search using the applicant's former name, behind which information can be found not only about the applicant's wanted ad, but also about the factors behind it. Despite the removal of the url search result links in question now, this url search result link would still be available with a Google Search performed under the applicant's former name. The general public would therefore still receive information about the applicant's escape. Thus, it can be stated that removing the url search result links in question from the connection of searches made under the applicant's former name has little effect on the general public's relevant access to information rights.

The matter at hand has been evaluated in deviation from the line of the Office of the Data Protection Commissioner regarding criminal information. The special features of the matter at hand have been taken into account in the consideration. In the news articles in question, it is not a question of actual crime reporting, but of referencing an official bulletin published to catch the applicant. The news coverage has been limited, and nothing has been reported about the applicant's crime other than the name of the crime and the length of the prison sentence he received. The news content did not actually describe the applicant's escape, but mainly asked the public to inform the police of their findings regarding the applicant. The applicant has since been caught, and the police no longer ask for information about him to be reported. Due to the aforementioned factors, the starting point for the assessment of the matter at hand is the law on the processing of personal data in the police department, especially as stipulated in § 34, instead of the Criminal Records Act. The matter at hand has been evaluated in relation to the original retention periods of the data in question. Taking into account the mentioned original storage period and the fact that the applicant had since been caught, as well as the fact that when performing a Google Search with the applicant's former name, information is still available specifically about the applicant's escape, the deputy data protection commissioner has assessed the matter as a whole and considered that the information about the expired wanted notice concerning the applicant is no longer socially relevant.

Now the information in question is not related to the applicant's current job. In evaluating the justified interest of the public, importance could be given to the type of crime. For example, in the case of a person guilty of fraud and other dishonesty or payment instrument crime, it would possibly be justified to assess the matter differently. In the case at hand, there is still a question of outdated information and keeping it available. The applicant uses his current name in his real estate brokerage activities. Few who are considering the applicant's services hardly know how to do a Google search specifically with the applicant's former name, which is where the information in question is available.
has given an explanation, which states, among other things, the following:
has not tried to avoid the approximately nine-year prison sentence he received for serious drug crimes. The links subject to the removal request concern the time when the judgment was not legally binding. the verdict has not been processed in any way, but the links and articles that are the subject of the removal request concern a search warrant that has not been valid for about 10 years. The information in the articles is incorrect and out of date. The articles cause concern and fear and allow any citizen to exercise their right to citizen detention. In addition, there are unnecessary misunderstandings and potentially unnecessary work for the authority.

Google LLC has issued a counter-explanation, which states, among other things, the following:

An oral hearing must be organized in the matter, if the administrative court bases its decision on a factual conclusion that would be contrary to what Google presented.

The Deputy Data Protection Commissioner relies on a too narrow interpretation of what the subject of the writings actually is. For example, the title of Iltalehti's article (url search result link 2) is "", which in itself tells about the escape of the applicant who is the subject of the article. The writings also reveal the applicant's crime, his punishment, his place of residence during his escape, and similar facts directly related to his escape.

The Deputy Data Protection Commissioner also seems to apply an unreasonably narrow understanding of when a certain writing can be considered relevant to a certain topic of public interest. In legal practice, there is no requirement according to which the information should be, narrowly interpreted, immediately relevant in terms of public interest and the topic of discussion. The European Court of Human Rights has considered it sufficient that the material is at least to some extent related to such a topic.

For persons in a public position, only "genuinely private" information should be ordered to be deleted, while other information about them should be available. The wanted notice related to the applicant's serious crime and the fact that the police actively informed about the matter, under the circumstances at hand, cannot reasonably be considered genuine private information concerning the applicant.

In a democratic society, it is not the task of the authorities to define in advance what information the public needs or what information can be considered relevant in this context. For persons in such a position, the question is whether the information is truly private or not. In this regard, the WP29 guidelines do not seem to differentiate between different situations depending on whether a person's public role is based, for example, on his position in politics or on his having committed a serious crime. If the administrative court accepts the arguments of the deputy data protection commissioner in this regard, it will also issue a preliminary decision regarding persons in political roles. Alternatively, administrative law should create a new principle in jurisprudence that persons in different public roles should be distinguished from each other in the evaluation.

The information in question is in any case relevant to the applicant's public role. The information related to the applicant's wanted notice must be reasonably considered relevant to the public role arising from the applicant's crime, punishment and escape. The information must also be considered relevant in terms of the public role, which is based on the applicant's public profession as a real estate agent.

The media's self-regulatory guidelines' requirement that the news story be followed from beginning to end is irrelevant to the matter at hand. It is generally considered that the journalist's instructions of the Public Speech Council cannot be applied in court, because the self-regulatory instructions in question are stricter than the freedom of speech regulation of the constitution in terms of the operating conditions of the media. Otherwise, the guidelines do not require that old news articles be updated retroactively, but they only require that crime-related reporting be continued with new news articles if necessary.

The deputy data protection commissioner's claim that there is no guarantee that readers will notice the date of the writings is also irrelevant. The case at hand is about interfering with the right to receive and disseminate information. Such interference cannot be justified on purely speculative grounds. There is no guarantee that the public will necessarily understand any media writing correctly. No evidence has been presented in the case that misunderstandings have genuinely occurred.

The only disadvantage claimed by the applicant concerns his public business activities. Any other possible disadvantages raised in the matter are speculative. Although the applicant in itself may have faced problems in his business activities, he has not concretely identified the consequences of this in his life. Such problems would in any case be a foreseeable penalty for committing a serious crime and being "". The applicant's business activities also clearly continue despite the fact that the material in question is now available.

The Deputy Data Protection Commissioner has deviated from his established administrative practice of using the Criminal Records Act as a reference point and exceptionally applied the Police Personal Data Act in this matter. In light of the administration's legal principles, the Deputy Data Protection Commissioner is bound to his own established practice. The Deputy Data Protection Commissioner can deviate from this practice only if there is a valid and consistent reason for doing so. The reason for deviation cannot be the fact that the Criminal Records Act does not contain a rule that explicitly mentions search warrants. The point of comparison has been considered to be the values expressed by a certain regulation, and not the regulation itself. The Criminal Records Act and the Police Personal Data Act express different values and value choices. The Deputy Data Protection Commissioner should be able to justify his decision under appeal with the fact that, for some reason, different values and value choices should be applied to the applicant's case than in other cases concerning the deletion of search results related to crime-related information. The Deputy Data Protection Commissioner has not been able to do this.

Administrative law solution

The Administrative Court rejects the request to organize an oral hearing.

The administrative court annuls the decision under appeal.

Reasoning

Oral processing

According to § 57 subsection 1 of the Act on Litigation in Administrative Matters, the administrative court must organize an oral hearing if the court considers it necessary or if a private party requests it. According to subsection 2, clause 2, the court may, despite the party's request, not hold an oral hearing, if a sufficient explanation of the relevant facts has already been obtained, on the basis of which the case can be resolved without the court having reasonable doubt about the facts.

Taking into account the explanation presented in writing at the various stages of the case's handling, the administrative court considers that in the oral hearing, there is no such explanation of the facts relevant to the resolution of the case, which would be necessary for the investigation and resolution of the case in addition to what appears in the documents. The administrative court therefore fails to organize an oral hearing on the basis of Section 57, Subsection 2, Clause 2 of the Act on Trial in Administrative Matters.

Issue

Union legislation

According to Article 17 paragraph 1 subparagraph c of Regulation (EU) 2016/679 of the European Parliament and the Council on the protection of natural persons in the processing of personal data and on the free movement of this data and the repeal of Directive 95/46/EC (hereinafter the Data Protection Regulation), the data subject has the right to have the data controller delete the data subject concerning personal data without undue delay, and the controller is obliged to delete personal data without undue delay, provided that the data subject objects to the processing pursuant to Article 21, Paragraph 1 and there is no justified reason for the processing.

According to Article 21, paragraph 1 of the Data Protection Regulation, the data subject has the right, on grounds related to his personal special situation, at any time to object to the processing of his personal data, which is based on Article 6, paragraph 1, subparagraph e or f, such as profiling based on these provisions. The controller may no longer process personal data, unless the controller can demonstrate that there is a significantly important and justified reason for the processing that overrides the interests, rights and freedoms of the data subject, or if it is necessary to prepare, present or defend a legal claim.

According to Article 58, paragraph 2, subsection c of the Data Protection Regulation, the supervisory authority has the authority to order the data controller or personal data processor to comply with the data subject's requests regarding the exercise of the data subject's rights based on this regulation.

In point 4 of the rationale section of the Data Protection Regulation, it is stated that the processing of personal data should be planned so that it serves people. The right to personal data protection is not absolute; it must be viewed in relation to its function in society and, in accordance with the principle of proportionality, it must be proportionate to other fundamental rights. This regulation respects all fundamental rights and takes into account the freedoms and principles recognized in the Charter of Fundamental Rights as they are confirmed in the fundamental treaties, in particular the right of everyone to have their private and family life, home and messages respected, the right to the protection of personal data, freedom of thought, conscience and religion, freedom of speech and freedom of communication, freedom of business, the right to effective legal remedies and a fair trial, and the right to cultural, religious and linguistic diversity.

In point 65 of the justification section of the Data Protection Regulation, it is stated that a natural person should have the right to have incorrect personal data concerning him corrected and the right to "be forgotten" if the retention of data violates this regulation or the Union law or national legislation applicable to the data controller. In particular, the data subject should have the right to have his personal data deleted and not processed after the personal data are no longer needed for the purposes for which they were collected or for which they were otherwise processed, or when the data subject has withdrawn his consent to data processing or when he has objected processing of his personal data or when the processing of his personal data is otherwise not in accordance with the provisions of this regulation. This right comes into question especially when the data subject has given his consent as a child, and has not been fully aware of the risks associated with data processing, and later wants to delete such data, especially from the internet. The registered person should be able to exercise this right despite the fact that he is no longer a child. The continued storage of personal data should, however, be lawful if it is necessary to exercise the right to freedom of expression and freedom of communication, to comply with a statutory obligation to perform a task in the public interest or to exercise public authority belonging to the controller, for reasons of public interest related to public health, archival purposes in the public interest or scientific or historical for research purposes or for statistical purposes or for preparing, presenting or defending a legal claim.

Union jurisprudence

In the case C-131/12 concerning freedom of speech and privacy, the Court of Justice of the European Union (hereafter EUT) ruled on the removal of url search results that are considered personal data from the internet search engine and considered that the operator of the search engine is the data controller referred to in the data protection directive. The facts stated in judgment C-131/12 have also been partially confirmed in EUJ judgment C-136/17. The facts found in the judgments can still be used as an interpretation aid when evaluating the criteria for removing data from the list of search results, even though the data protection regulation has entered into force after the judgments were issued.

Judgment C-131/12 states that the processing of personal data carried out by the operator of the search engine is capable of significantly affecting the fundamental rights to respect for private life and the protection of personal data, when the search using the engine in question is carried out under the name of a natural person, because as a result of the said processing, all internet users can get a list of search results a structured review of the information found on the internet about the person in question, which is potentially related to several different aspects of his private life and which without the said search engine could not have been connected or could only have been very difficult to connect with each other, and thus draw up a somewhat detailed profile of the person in question. In addition, interference with the mentioned rights of the registered person is even greater on the internet and search engines - as a result of which such information included in the lists of search results becomes such that it can be viewed everywhere due to its significant position in modern society (paragraph 80 of the judgment).

According to the judgment of the EUJ, there is a need to weigh the interests in situations where the removal of url search results could have consequences for the legitimate interest of other internet users in obtaining information. In this case, efforts must be made to find a fair balance between the interest in obtaining the information in question and the fundamental rights of the registered person under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Although the rights of the data subject protected by the articles in question generally supersede the aforementioned interest of internet users, the balance may nevertheless depend in special cases on the nature of the data in question and their sensitivity in terms of the data subject's private life, as well as the interest of the public in having access to the data in question, and the latter interest may be different depending, among other things, on the public status of the person in question (paragraphs 74 and 81 of the judgment).

According to the sentence of the EUJ judgment, when the data subject can, in relation to his fundamental rights based on Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, demand that the information referred to in the judgment is no longer made available to the general public by including it in the list of search results, the rights in question supersede not only the economic interest of the operator of the search engine, but also that of the general public interest in having the said information available when searching under the name of the registered person. However, this would not be the case if it turns out that interference with the basic rights of the data subject for special reasons such as the position of the data subject in the public domain can be justified by the primary interest that the general public has in obtaining that information due to the inclusion in question.

The background of the matter and the search result links that have been ordered to be deleted

has on 27 November 2018 asked Google LLC to remove 11 search result links from searches made under his name and his former name. Google LLC has not agreed to the request. has on 31 January 2019 initiated the matter in the office of the data protection commissioner.

has pleaded in his request for removal that the available information harms his business. He has a public profession. the news about a wanted notice that has not been valid since April 2011.

Behind the URL search result link 1, you can find Iltalehti's news with the title "". The news contains information that the Helsinki Court of Appeal has sentenced him to nine years and four months in prison for a serious drug crime and that he has been hiding from the police for eight months. The news contains a picture of the face.

Behind the URL search result link 3, you can find Keskisuomainen's news with the title "". The news contains information about the crime and sentence, as well as tips received by the police regarding his whereabouts. In addition, the news mentions the year of birth and height, as well as eye and hair color. The news mentions that the police ask to report the information and findings to the command center of the Helsinki Police Department. In addition, the news mentions that he is one of the wanted persons who were searched for in the extensive search operation of the international criminal police organization Interpol.

Behind the URL search result link 4, you can find Alibi's news with the title "". The news contains information about the crime and the sentence, as well as the suspect's whereabouts and his movements. The information is requested to be reported to the command center of the Helsinki police. Alibi announces in the news that it will pay a substantial reward for decisive information, if the tip is reported to Alibi's tip number. The news contains two pictures of faces.

Behind the URL search result link 5, you can find Iltasanomit's news with the title "". The news contains the information that the police are participating in Interpol's Infra-Red operation, which actively searches for internationally wanted persons for two weeks, and that one is . The news contains information about the crime and punishment, as well as his age and height. The news contains a picture of the face.

Behind the URL search result link 6, you can find Yle's news with the title "". The news contains information that the police are looking for , and that the police need tips from the public. The news contains a mention of the crime and the suspects' whereabouts and movements. In addition, it says that he has probably changed his appearance, and that the police do not consider him dangerous to the public. The information is requested to be reported to the command center of the Helsinki police. The news contains two pictures of faces.

Behind the Url search result link 7, you can find Yle's news with the title "". The news contains information about the crime and punishment, as well as the suspects' whereabouts and movements. In addition, it mentions age and height. The news reports that he has probably changed his appearance, and that the police do not consider him dangerous to the public. The news mentions that they have been targeted as part of the extensive search operation of the international criminal police organization Interpol. The information is requested to be reported to the command center of the Helsinki police. The news contains two pictures of faces.

Behind the URL search result link 8, you can find the Suomi24 discussion forum discussion with the title "". The opening of the discussion is done. According to the author, he reported to prison the day before. The writing describes the future time in prison in an understated tone.

Behind the URL search result link 9, you can find the MTV Uutisten news with the title "". The news contains the information that it has not been possible to find Interpol in the search operation. The news contains information about the crime and punishment and the suspect's whereabouts. The news contains two pictures of faces.

Behind URL search result links 10 and 11, you can find the MTV Uutisten news with the title "". The news contains information that the police have received tips about professional criminals wanted in Finland as a result of Interpol's Infra-Red operation. The news contains information about the crime and punishment, as well as the suspects' whereabouts and movements. Age and height are mentioned in the news. The news contains two pictures of faces.

The Deputy Data Protection Commissioner has ordered, based on Article 58, Paragraph 2, Subsection c of the Data Protection Regulation, that the data controller Google LLC must comply with the applicant's request to remove url search result links.

The decision under appeal is justified in particular by the fact that the main subject of the online content in question is a wanted notice published for the applicant, which is no longer valid, and the public no longer has a reason to report their observations about the applicant to the police. According to the decision, the availability of information can no longer be considered justified due to the passage of time. The decision refers to section 34 subsection 2 paragraph 4 of the Act on the Processing of Personal Data in Police Actions, and states that if the applicant's case is reflected in the retention period provision in question, the information about the search warrant concerning the applicant is no longer socially relevant.

Question formulation

Search engine operators process personal data to fulfill their legitimate interests, i.e. on the basis referred to in Article 6(1)(f) of the Data Protection Regulation. The applicant must be considered to have objected to the processing of personal data concerning him on the basis of his personal special situation referred to in Article 21, paragraph 1 of the Data Protection Regulation, in which case the data controller may no longer process personal data, unless the data controller can demonstrate that there is a significantly important and justified reason for the processing that overrides the interests of the data subject , rights and freedoms.

In the case, the administrative court has to decide whether the deputy data protection commissioner has been able to give the controller Google LLC an order according to Article 58, paragraph 2, subparagraph c of the General Data Protection Regulation to comply with the applicant's request to remove the url search result links in question.

In the case, it must be assessed in particular whether the data controller Google LLC has demonstrated in the manner referred to in Article 21, Paragraph 1 of the Data Protection Regulation, that there is a significantly important and justified reason for the processing of the data concerning the applicant in question, which overrides the interests, rights and freedoms of the applicant.

Url search result link 8

Behind the URL search result link 8, there is no information about the wanted notice for the applicant, but it is a discussion on the Suomi24 discussion forum, where the subject is the applicant's registration in prison. The deputy data protection commissioner has therefore not been able to give the data controller Google LLC a deletion order regarding the search result link in question on the basis mentioned in the decision under appeal that the subject of the writing is a wanted notice concerning the applicant. The decision under appeal must be annulled in this respect.

Url search result links 1, 3–7 and 9–11

In the ECJ judgment C-131/12 related to the right to be forgotten, it has been considered that the rights of the data subject referred to in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union supersede the general public's interest in obtaining the personal data of the data subject based on a search made in his name. However, an effort must be made to find a fair balance between these rights and interests, which may depend on the nature of the data in question and their sensitivity in terms of the registered person's private life, as well as the public's interest in accessing the data in question. The latter interest may be different based on, among other things, the position of the person in question in the public eye.

The subject of the websites in question now is news about the applicant's international wanted notice. In addition to the applicant's name and age, the news contains public information about the applicant's crime and the sentence given for it. Some of the news contains pictures of the applicant's face and some of the news mentions the height of the applicant. One news item mentions the color of his eyes. In four news items, you are asked to report your findings to the Helsinki police command center.

Due to the fact that he committed a serious crime, the applicant must be considered to have the position in the public eye referred to in the judgment of the European Court of Justice C-131/12 in terms of weighing the interests between the protection of private life and freedom of expression. The applicant can be considered to have a public position also as a professional, managing director and board member of a real estate brokerage company. 10 years had passed since the verdict when the appealed decision was issued. The general public's interest in information regarding the applicant's crime cannot be considered completely lost due to the passage of time, given the seriousness of the crime. In the case, however, it has to be decided what significance should be given to the fact that the news concerns the applicant's wanted notice, which has since ended. The information regarding the wanted notice is not, in itself, information to be kept secret, or information falling under the protection of the applicant's private life. However, finding such information when searching under the applicant's name can be embarrassing for the applicant and affect his business.

The Administrative Court considers that the matter cannot be resolved by paying attention exclusively to the retention period provision of Section 34, Subsection 2, Clause 4 of the Act on the Processing of Personal Data in Police Operations, but the applicant's case must be evaluated as a whole. The general public's interest in information regarding the serious crime committed by the applicant must also be considered to extend to the fact that the applicant has avoided the execution of his sentence for months, and has therefore been the subject of an international wanted notice.

In the weighing of interests, it must be taken into account that the search warrant issued for the applicant has no longer been valid, and that the news has asked to inform the police of findings made about the applicant. The applicant has made a deletion request in 2019, i.e. several years after the news about his wanted notice and crimes. The Administrative Court states that the search results in question now show the time when the news was written. Only four news items ask to inform the police about the observations made about the applicant. In light of the above, the fact that the general public may be mistaken in thinking that the applicant's wanted notice is still valid cannot be given decisive importance in the weighing of interests.

The administrative court considers, weighing the above-mentioned facts as a whole, that the applicant's right to privacy and personal data protection does not in this case override the general public's interest in obtaining the data subject's personal data based on a search made under his or her name and former name. The Deputy Data Protection Commissioner has not been able, based on the reasons presented, to issue an order to Google LLC pursuant to Article 58, Paragraph 2, Subsection c of the Data Protection Regulation to comply with the applicant's request to remove the url search result links in question. The decision under appeal must therefore be annulled.

Applied legal guidelines

Mentioned in the justifications and

Article 11 of the Charter of Fundamental Rights of the European Union

Articles 8 and 10 of the European Convention on Human Rights