HDPA (Greece) - 11/2024

HDPA - 11/2024
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 17 GDPR Article 17(1) GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:	08.09.2021
Decided:	29.02.2024
Published:	08.04.2024
Fine:	n/a
Parties:	Google LLC
National Case Number/Name:	11/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	inder-kahlon

The DPA ordered Google to deindex some URLs relating to data subject's non-payment of employee salary and insurance. Meanwhile postpone the decision for 7 more URLs until the data subject presents the required additional evidence and court decisions.

English Summary

Facts

The data subject submitted a data erasure request to Google LLC (the controller) on 8 September 2021, requesting the removal of thirty nine search results from the controller's search engine that were produced with her full name search. The results linked to pages where the data subject's name had been linked to a criminal conviction. As a relative of a public figure, the case generated public interest, and her sensitive data on her criminal situation was extensively published. The data subject stated that it was wrong for websites to publish sensitive data as she was not a public figure. To make sure that information related to her criminal conviction would not appear as a result of a search with her full name. The data subject made several requests to the controller to remove 39 URLs from search results. The data subject stated that the company's rejections based on public interest are not valid as no public interest allows the publishing of sensitive data. The subject also points out that in the absence of a relevant public prosecutor's order under Article 2 of Law 2472/1997 allowing the publication of such data, the company must delete all relevant data from the results of its search engine.

The controller upheld that the requests for removal of URLs from 1–12 are related to business activities and refer to felonies allegedly committed by the data subject for which she was convicted. The links 13–14 concern unpaid wages and insurance issues that directly relate to her business activities and are not disputed for accuracy of information. The controller believed the reference to the public interest in the information was valid, and the data subject lacked grounds for the "right to be forgotten," thus they argued against deletion. Finally, the company stated that for the content of the links 15–39, which on the one hand do not refer to the complainant and on the other hand lead users to websites whose content is not available, the company will remove them from the list of search results that appear on the basis of her name.

The data subject argues that it is necessary to delete in total nine URLs (1-6, 11, 13, and 14) because they relate to her personal data related to criminal conviction, along with the fact that she is not a public figure. The data subject points out that the data controller must consider whether the data subject is still active in the same profession when evaluating, as she ceased her professional activities related to the case fifteen years ago. Despite this, the data controller failed to consider specific criteria outlined in the EDPB Guidelines 5/2019 on the criteria of the right to be forgotten in the search engine cases under the GDPR (part 1), emphasising the sensitive nature of the personal data requested for deletion. Additionally, the data subject pointed out that, according to the CJEU judgement, the right to privacy generally prevails over the public's interest in accessing information, unless the data subject plays a significant role in public life. Since data subjects had no such role in public life, this highlighted the controller's failure to demonstrate the necessity of retaining the information. However the controller held that a legitimate interest of the public to have access to the information is established.

Holding

The Hellenic DPA (HDPA) noted that a search engine provider that receives a deletion request based on the particular situation of the data subject must delete the personal data in accordance with Article 17(1)(c) GDPR unless it is able to demonstrate that there are "compelling and legitimate reasons" overriding the interests, rights, and freedoms of the data subject for the inclusion of the specific search result, pursuant to Article 21(1) GDPR. Additionally, the HDPA considered that the information in question was outdated, as it was older than fifteen years and concerned issues that were no longer of interest to the readers. Based on this data, the conditions for removing the mentioned links from Google search results under the complainant's full name are met, and, therefore, the examination of additional criteria for their deletion was unnecessary.

For these reasons, the HDPA partially accepted the application and ordered the controller to immediately proceed with the deletion of two links that appeared as search results with the complainant's first and last name in the Google search engine and postpone the hearing and decision regarding the other seven links until the data subject provides: 

(i) evidence showing the date of cessation of her business activity and 

(ii) the convictions and records relating to her, including any decision of the Supreme Court on an appeal.

Comment

A relevant case: HDPA 12/2024

Law 2472/1997 Article 2 - Definitions

For the purposes of this law, the following definitions shall apply:

α) "personal data" means any information relating to the data subject. Personal data shall not include aggregated data of a statistical nature from which the data subjects can no longer be identified.

(b) 'Sensitive data' means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, social welfare and sex life, data concerning criminal prosecutions or convictions, and data concerning membership of associations of persons related to the foregoing.

In particular, publication of information relating to criminal prosecutions or convictions may be authorised only by the public prosecutor's office for the offences referred to in subparagraph (b) of paragraph 1. 2 of Article 3 by order of the competent public prosecutor of the first instance or the public prosecutor of the Court of Appeal, if the case is pending before the Court of Appeal. The order must be specific and fully reasoned, specify how it is to be made public and the period of time it is to last. Such publication is intended to protect the public at large, minors, vulnerable or powerless population groups and to facilitate the realisation of the State's claim for the punishment of the above-mentioned offences. An appeal against the prosecutor's order may be lodged within 2 days of notification to the accused or convicted person before the Head of the Prosecutor's Office of the First Instance or the Head of the Prosecutor's Office of the Court of Appeal, if the case is pending before the Court of Appeal, who shall rule within 2 days. Until the competent Public Prosecutor has given his decision, the execution of the order and the publication of data is prohibited.

By way of exception, in the case of felonies under Articles 187, 187 A and Chapter 19 of the Penal Code "crimes against sexual freedom and crimes of economic exploitation of sexual life", the prosecutor's order is executed immediately and is confirmed by the head of the Prosecutor's Office of the Court of Appeal within twenty-four hours, provided that it has been issued by the Prosecutor of the First Instance. Otherwise, the order shall cease to have effect automatically on expiry of the twenty-four-hour period.

The provisions of the two preceding subparagraphs shall apply mutatis mutandis in cases of crimes where the perpetrator is deemed by the competent public prosecutor to be particularly dangerous to public order and security and is evading arrest or is of unknown residence.

• There are more paragraphs in article 2 but only the first 2 paragraphs relevant to this case are provided above. Note that the Law No. 2472/1997 was repealed by Article 84 of Law No. 4624/2019

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Athens, 29-02-2024 Prot. No.: 681 DECISION 11/2024 The Personal Data Protection Authority (hereinafter "Authority") convened at the invitation of its President in a meeting on Tuesday 13-06-2023 at 10.00, in order to examine the case referred to in the present history. The President of the Authority, Konstantinos Menudakos, the regular members Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, Aikaterini Iliadou and Grigorios Tsolias were present, as rapporteur. Present, without the right to vote, were Stefania Plota, specialist scientist - lawyer, as assistant rapporteur and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into account the following: With complaint No. G/EIS/5639/08-09-2021, A (hereinafter "complainant") appealed to the Authority against the company Google LLC (hereinafter "Google") or "company") for failure to satisfy the right to deletion (right to be forgotten) of results appearing in the Google search engine based on the first and last name of the complainant. In particular, the complainant states that she has been finally sentenced to the penalty ... for committing a crime that has attracted the public, but not, as she claims, being a public figure, but a relative ... and her sensitive data regarding her criminal status were published extensively solely because of a family relationship, but without her relative being related to the specific charges attributed to her. Also, the complainant states that, as appears from the under no. ... Order of Ms. Prosecutor Plemmeleiodiki..., which her relative attaches to the complaint, is in no way related to the acts attributed to her and therefore, it is wrong for the websites to publish the sensitive data as she is not a public figure. The complainant, as a data subject, submitted to the company on … an online request to delete results from the Google search engine based on her name, so that the information regarding her criminal conviction would not appear as a result, and on … she submitted another six (6 ) online applications for the following total links: 1. … 2. … 3. … 4. … 5. … 6. … 7. … 8. … 9. … 10. … 11. … 12. … 13. … 14. … 15. … 16. … 17. … 18. … 19. … 20. … 21. … 22. … 23. … 24. … 25. … 26. … 27. … 28. … 29. … 30. … 31 .. .. 32. .. 33. .. 34. .. 35. . public interest" for the professional activities of the complainant and claims that these answers are incorrect, since no public interest allows the disclosure of sensitive data of criminal convictions, even in the absence of a relevant prosecutor's order according to article 2 of Law 2472/1997 which allows the disclosure of such information for criminal prosecutions or convictions and therefore the company must delete all relevant data from its search engine results. The Authority, in the context of examining the above complaint, called the companies Google LLC, as the operator of the Google search engine, and Google Hellas with the no. prot. C/EXE/2809/07-12-2021 document, to provide their opinions on the accused. The company Google LLC responded with the no. prot. C/EIS/8380/24-12-2021 document that on … the complainant submitted her request with reference number … to Google and on … she submitted the requests with reference number …, …, …, …, … and … with which she requested the removal from the search results based on her name of the links (URLs) mentioned in the above requests invoking the right to be forgotten. On ... and ... respectively, the company responded to the complainant regarding the above requests, among others, the following: "[...] having weighed the relevant rights and interests related to the content in question and taking into account factors such as relevance of your professional life, Google has decided not to remove this content. At this stage, Google has decided not to take any action regarding these links…”. The company in its above document to the Authority states that in the present case, the content of the above links (URLs) under points 1-12 refers exclusively to information related to the professional activity of the complainant, who is a publisher and entrepreneur (among others publisher X) and is alleged to have committed serious crimes for which she has been sentenced ... in the first degree according to the content of the publications in question, and in the second degree the same sentence was maintained according to the attorney of the complainant [ "has been condemned to ... (not irrevocably, but definitively) an event that has preoccupied the public [...]"]. Furthermore, in the company's document it is stated that the complainant does not invoke or prove in any way the inaccuracy of the content in question, on the contrary, she accepts the accuracy of the information as stated above. The accuracy of the information is also confirmed by the aforementioned Prosecutor's Order no. ..., in which it is stated that criminal proceedings have been brought against the complainant for a series of criminal acts. The content of the disputed links is recent and current, as the trial of the complainant in the second degree took place very recently, i.e. on … of … and the disputed publications refer to crimes allegedly committed by the complainant and of great criminal infamy. Furthermore, the above links under points 13-14, as stated by the company, refer to the non-payment of accrued employees and to ... in relation to this issue and to staff insurance issues, as well as to the fact that the complainant did not attend the meeting in question . The content of said links is directly related to the professional life of the complainant who was publisher X, who does not invoke or prove the inaccuracy of the specific information. In view of the above, there is a legitimate interest of the public to have access to the information in question and, therefore, as the company claims, the deletion of the relevant links is not permissible based on the criteria set by the "Guidelines of the Working Group of Article 29" and the claims included in the complaint are not able to establish and do not establish the right to be forgotten and, by extension, do not justify the deletion of the disputed links (URLs). Finally, the company stated that for the content of the above links under points 15-39, which on the one hand do not refer to the complainant, on the other hand lead users to websites whose content is not available, the company will delete them from the list of results search results that appear based on her name. After examining the details of the file, the Authority with no. prot. C/EX/2999/23-11-2022 and C/EX/3004/23-11-2022 documents invited the aforementioned companies and the complainant respectively, as legally represented, to attend, via video conference, the meeting of Plenary Session of the Authority on Tuesday, 29-11-2022, in order to discuss the complaint in question. At the above meeting, the request for postponement submitted by the attorney of the complainant was discussed, which was accepted by the Plenary and 10-01-2023 was set as the new date of the Plenary meeting to discuss the complaint in question. At this meeting, the attorney of the complainant Vassilios Sotiropoulos (AMDS ...) attended and developed their opinions and on behalf of the company Google LLC Ioannis-Dionysios Filiotis (AMDS ...), Chariklia Daouti (AMDS ...) and Evangelia Tsirigotis (AMDS ...) . Before the end of the meeting, the attorney of the complainant left and then the complainant and the company submitted the no. prot. C/EIS/658/27-01-2023 and C/EIS/715/31-01-2023 memoranda, respectively, within the relevant deadline set by the President during the meeting. The complainant in the memorandum submitted after the discussion of the case argues that the deletion of the nine (9) links listed above under points 1-6, 11, 13 and 14, for which the request to delete them from the results displayed on the machine , because they concern her personal data related to her criminal conviction in combination with the fact that she is not a public figure. According to the criteria to be taken into account the controller must consider whether the data subject is "still active in the same profession" while the complainant has been convicted for her acts dating back to the period in which she was publisher X, a period dating back to fifteen years ago, a period since which he has ceased to be active in the field of publishing...Also, the complainant, referring to the guidelines of the ESPD 5/2019, emphasizes that among the criteria mentioned by the Council are: "[…] - the subject of the data subject does not play a role in public life; - the information in question is not related to his professional life but affects his private life;" and claims that the data controller did not take into account the specific criteria, which are also the ones under consideration critical case, while particular emphasis must be placed on the particularly burdensome nature of the personal data in question, as the personal data that the complainant requests to be deleted relate to her sentence to life imprisonment, which is the most serious penalty that can be imposed by the current penal system.  In the decision of 08-12-2022 in case C-460/2020, the Court of Justice of the European Union (CJEU-Grand Chamber) reiterated that from the jurisprudence of the European Court of Human Rights (ECtHR) it follows that, with regard to the publication data, for the balancing between the right to respect for private life and the right to freedom of expression and information, certain basic criteria must be taken into account, such as, among others, the contribution to a debate of public interest, the reputation of the affected person, the subject of the disclosure , the previous life of the person concerned, the content, form and consequences of the publication, the manner and circumstances in which the information was obtained as well as its truth (cf. ECtHR decision of 27 June 2017, Satakunnan M a r k k i n a p ö r s s i O y k a i S a t a m e d i a O y k a t a F i n l a n d i a s § 165). Also, in the same recent decision, the D.E.E. ruled that the data subject's rights protected by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (CFR) generally prevail over the legitimate interest of potentially interested internet users to access the information in question (paragraph no. 62) . This is reversed when the data subject plays an important role in public life (paragraph no. 65). The complainant maintains that she herself has no such status and plays absolutely no role in public life. Finally, regarding the public's right to information, invoked by the data controller, the complainant refers to the judgment of the Court of Justice of the European Union in the decision of 09-24-2019 (Grand Chamber) in case C-136/17, which has become known as the Google 2 decision, where specifically on the issue of data relating to criminal convictions (Article 10 of the G.K.P.D.), the Court ruled in that case that the search engine operator must ascertain "if the display of this link in the list of results resulting from a search based on the name of the data subject is absolutely necessary to protect the freedom of information protected by Article 11 of the Charter of Internet users who may be interested in gaining access to the this information through such a search.” (paragraph no. 68 of the decision). This means that if the display is "simply" necessary for the information of the users, then the provisions of articles 7 and 8 of the Charter in combination with articles 9 par. 2 g' and 10 of the GDPR have not been complied with. The complainant argues that in the present case, the controller has not even invoked that the retention is "absolutely necessary" to inform the public but has limited himself to stating that the information concerns the complainant's professional life, without taking into account the present situation of the complainant and the fact that she has not been a publisher for many years... The mere fact that the complainant’s … is still … does not allow the complainant’s criminal conviction to be made public, even more so when, based on the invoked prosecutorial order, the complainant’s … had absolutely no involvement in the acts for which the complainant was convicted complainant. The company Google LLC with the memorandum it submitted to the Authority after the discussion of the case repeats what it has already mentioned, adding that in Guidelines 5/2019 ESPD regarding "the criteria governing the right to be forgotten according to the GDPR in the cases of machines search', it is reported that 'the CJEU recognized in the Costeja decision and recently reiterated in the Google 2 decision that the processing carried out by a search engine provider can significantly affect fundamental rights to privacy and data protection law when the search is carried out using the name of the data subject. When weighing the rights and freedoms of data subjects and the interests of Internet users in accessing information through the search engine provider. However, he identified a number of factors that might affect said preeminence. These include: the nature of the information or its degree of sensitivity, and in particular the interest of Internet users in accessing information, which may vary according to the role played by the interested party in public life.'' The company concludes that the complainant regarding the information related to her professional activity as a shareholder, director and publisher of X, capacities in which she committed violations and criminal acts against her employees, as well as as a member of other companies, does not rely , nor does it prove any inaccuracy with regard to her criminal conviction and confirms that the same sentence was imposed on her in the second degree, taking into account the Prosecutor's Order. Therefore, according to the company, there is a legitimate public interest in having access to the information. The Authority, after examining all the elements of the file and what emerged from the hearing before it and the parties' memoranda, after hearing the rapporteur and the clarifications from the assistant rapporteur, who was present without the right to vote, after a thorough discussion, CONSIDERED IN ACCORDANCE WITH THE LAW 1. Since, from the provisions of articles 51 and 55 of the General Data Protection Regulation 2016/679 (GDPR) and article 9 of law 4624/2019 (Government Gazette A' 137) it follows that the Authority has the authority to supervises the implementation of the provisions of the GDPR, this law and other regulations concerning the protection of the individual from the processing of personal data. 2. Because Google LLC, based in the United States of America, with its document No. C/EIS/10060/14-12-2018 informed the Authority that, although Google Ireland will be the data controller for user data collected and processed when users interact with Google services - including data collected through the Google search engine where users choose to store activity or search history data in their accounts - Google LLC will continue to be the data controller of the classified content (index) of the Google search engine and manage the erasure process under the right to be forgotten. Therefore, in the case under consideration, the purpose and means of processing to satisfy the right to erasure (to oblivion), according to Article 17 of the GDPR, are fully determined by the company Google LLC, as it states, whose facility is outside The European Union. Therefore, although the specific activity concerns data subjects located in the territory of the Union, since the company Google LLC does not have a main establishment in the Union for the activity in question, the "one-stop mechanism" according to Articles 56 and 60 of the GDPR does not apply established by the GDPR and, therefore, in accordance with the provisions of articles 55 para. 1, 2 para. 1 and 3 para. 2 GDPR and 13 para. 1 item g' Law 4624/2019, the Authority has the authority to deal with the complaint of A, for violation of the right to erasure. 3. Since the activity of Google Hellas/Athens (GOOGL HELLAS Internet Applications Sole Proprietorship Limited Liability Company) is the provision of marketing services to Google Ireland, the complaint for the rejection of the request to delete links in the context of satisfying the right to be forgotten, is considered only as to the company Google LLC as data controller of the classified content (index) of the Google search engine. 4. Because according to Article 17 para. 1 of the GDPR, "the data subject has the right to request from the controller the deletion of personal data concerning him without undue delay and the controller is obliged to delete personal data without unjustified delay, if one of the following reasons applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, […], c) the data subject objects to the processing in accordance with Article 21 paragraph 1 and there are no compelling and legitimate reasons for the processing or the data subject objects to the processing in accordance with Article 21 paragraph 2, d) the personal data were processed unlawfully, [...]' . In paragraph 3 of the same article it is defined that "paragraphs 1 and 2 do not apply to the extent that the processing is necessary: a) for the exercise of the right to freedom of expression and the right to information [...]". 5. Because according to the above article 17 of the GDPR, as it has been interpreted according to the content of the Guidelines 5/2019 of the GDPR1, the data subject has the right to request from the controller the deletion of personal data concerning him without undue delay and the data controller is obliged to delete personal data without undue delay if one of the reasons listed in Article 17 of the GDPR applies. requests the deletion of content from search results when the subject's personal data is no longer necessary in relation to the purposes, the search engine must ensure a balance between the protection of privacy and the rights of Internet users when access to information.  In particular, it should be assessed whether, over time, the personal data has become obsolete or has not been updated. Also, the GDPR3 states that in case the deletion request is made for the third reason, i.e. the subject objects to the processing, then the GDPR provides stronger guarantees to data subjects than Directive 95/46, because the right to object to the GDPR does not limit the grounds on which data subjects may request erasure pursuant to Article 17 para. 1 of the GDPR. The data subject can object to the processing "for reasons related to his particular situation", without having to demonstrate "compelling and legitimate reasons", as foreseen by Directive 95/46. The GDPR shifts the burden of proof and provides a presumption in favor of the data subject, obliging instead (the subject) the controller (in this case Google) to prove the compelling and legitimate reasons that make the processing absolutely necessary (Article 21 para. 1 GDPR). Consequently, when a search engine provider today receives a deletion request based on the particular situation of the data subject, it must now delete the personal data, in accordance with Article 17 para. 1 item. c) of the GDPR, unless it is able to demonstrate that there are "compelling and legitimate reasons" for the inclusion of the specific search result, which in combination with Article 21 paragraph 1 constitute "compelling and legitimate reasons (...) which take precedence over the interests, rights and freedoms of the data subject"4. 6. Because, according to the jurisprudence of the Court of Justice of the European Union, the data subject has the right to stop the information related to his person from being linked to his name through the list of results, which results from a search carried out based on the name of a natural person5 and in addition said search may result in users being able to obtain through the list of results, a systematic overview of the information available on the internet concerning said person and which enables users to form a , more or less, detailed profile of the data subject6, which concerns the privacy of the data subject7. 7. Because, moreover, according to the jurisprudence of the Court of Justice of the European Union, it is up to the person, who requests the deletion of links, in case of alleged inaccuracy of the classified content to prove the manifest inaccuracy of the information included in said content by presenting the evidence evidence, which can reasonably be expected to be able to seek, in the light of the circumstances of the specific case, in order to prove this manifest inaccuracy8 . 8. Because further, according to the jurisprudence of the Court of Justice of the European Union, “[…] although the rights of the data subject protected by Articles 7 and 8 of the Charter outweigh, as a rule, the legitimate interest of potentially interested Internet users to access to the information in question, however this balancing may depend on the critical circumstances of each case, in particular the nature of the information in question and its sensitivity to the privacy of the data subject as well as the public interest in having the this information, an interest which may vary depending, among other things, on the role played by the subject in question in public life [judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317 , paragraph 81, as well as of 24 September 2019, GC etc. (Delete links to sensitive data), C-136/17, EU:C:2019:773, paragraph 66]. 63. In particular, when the data subject plays a role in public life, he must show a greater degree of tolerance, given that he is unavoidably and knowingly exposed to public scrutiny (cf. ECtHR judgment of 6 October 2022, Khural and Zeynalov v. Azerbaijan , CE:ECHR:2022:1006JUD005506911, § 41 and case law cited there)" 9 . 9. Because according to the Authority's jurisprudence, the reasons for submitting a link deletion request to the search engine service provider, such as Google, must be documented10. 10. Because the status of the complainant, even in the past, as publisher X, implies the increased interest of the public in its information, taking into account article 14 par. 9 of the Constitution on transparency of those concerning the ownership status of the media . 11. Because in the case under consideration, the above points 7-10, 12 and 15-39 links refer to websites that do not display content or display content, which does not include the name of the complainant. 12. Because the above under no. 13 and 14 links, namely: … … contain on the one hand the announcement from the Coordinating Committee for X from … and on the other hand the second from … article on the website X, regarding the non-payment of employees’ accrued contributions, their insurance, etc. . i.e. information that, on the one hand, is not connected to the imposition of a penalty ... on the complainant, on the other hand, is considered outdated, as it is older than fifteen (15) years and concerns issues that are no longer of interest to the reading public. With these data, the conditions for the deletion of the above links from the results of the Google search engine based on the name of the complainant are met and, therefore, there is no need to consider additional criteria for their deletion. 13. Since the seven (7) links under points 1-6 and 11 above refer to journalistic articles, for the content of which the complainant does not invoke or prove its inaccuracy, on the contrary, she confirms the fact that she is at the expense of criminal prosecution of prosecution and final condemnation of her with the penalty .... 14. Because the complainant, while admitting that she has been finally sentenced to the penalty of ..., nevertheless in her complaint she does not list the crimes for which she was convicted and does not provide the relevant convictions and the minutes of the trial in order to be examined, if they are connected with its status as a publisher and if therefore they are of interest to public opinion, in accordance with the criteria established by ECtHR jurisprudence11. 15. Because the complainant admits that she was convicted of criminal acts, which she does not name and which go back to the period in which she was publisher X, and that this period goes back to fifteen years ago, a time from which the complainant has ceased to be active business in the field of publishing ..., but without proving this claim. 16. Because in order to examine the above claims and positions of the complainant in combination with the reasons for the company's refusal to delete the above links, but also in general the legality of the company's refusal to delete the links in question becomes necessary, based on the above reasons under no. 9 and 13-15 the complainant's presentation i. data from which the time of cessation of its business activity is derived and ii. of the convictions and proceedings concerning the complainant, including any decision of the Supreme Court on appeal12. 17. Since the Authority finds that, with regard to the two links (see paragraph 12) that contain posts from the years 2006 and 2008, there is no need for further investigation, as the fact that a long period of time has passed since the publication of the information combined is sufficient to the fact that the latter concerned the employer and insurance contributions of employees X, so that the complainant's request to the company Google LLC, as controller, to delete them from the list of results in the Google search engine that appear with search criterion the name of the complainant. 18. Because based on the above, the Authority unanimously decides on the one hand that the complained company, as controller, should be given the order referred to in the executive order to comply with the complainant's request to delete the links under points 13 and 14 above (see considerations 12 and 17) from the results of the Google search engine based on the name of the complainant and on the one hand the postponement of the discussion and the issuing of the decision on the other seven (7) links until the complainant presents the data and documents referred to in above paragraph 17. FOR THESE REASONS The Authority: 1. Partially accepts the complaint and orders, pursuant to the provision of article 58 par. 2 c of the General Data Protection Regulation (EU) 2016/679, the company Google LLC, as controller, to immediately proceed with the abolition- deletion of the links mentioned above in paragraph 12, as a result of a search criterion of the first and last name of the complainant, in the Google search engine. 2. Postpone the discussion and issuance of a decision regarding the part of the complainant's deletion request concerning the seven (7) links mentioned in paragraph 13, until the complainant provides i. elements from which the time of cessation of its business activity X and ii is derived. the convictions and minutes concerning the complainant, including any decision of the Supreme Court on appeal.