KamR Göteborg - 2232-21

KGG - 2232-21
Court:	KGG (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 17 GDPR
Decided:	30.11.2021
Published:	30.11.2021
Parties:	Swedish Authority for Privacy Protection (IMY) Google LLC
National Case Number/Name:	2232-21
European Case Law Identifier:
Appeal from:	FiS (Sweden)
Appeal to:	Unknown
Original Language(s):	Swedish
Original Source:	Pressrelease of the The Gothenburg Court of Appeal (in Swedish)
Initial Contributor:	Kave Noori

A second-instance court ruled that Google must pay a fine of € 4.8 million (SEK 50 million). This was because Google informed webmasters about removed search results and ignored Article 29 Working Group guidelines over a longer period.

English Summary

Facts

In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google € 7.2 million (SEK 75 million) for violating Article 17 GDPR (the right to be forgotten). The DPA considered that Google had violated the GDPR in connection with two complaints from data subjects (complaint No. 2 and No. 8 in the supervisory case) and also because of its general practice of informing webmasters that a search result had been removed. Read more here

Google appealed to the Stockholm Administrative Court (FiS), which in December 2020 upheld the DPA's decision that Google was at fault with respect to complaint No. 2 and its practice of notifying webmasters. The FiS rejected Google's culpability with respect to Complaint No. 8 and justified a reduction in the fine. The FiS reduced the fine to €5 million (SEK 52 million), €193 228 ( SEK 2 million) for complaint No. 2 and € 4.8 million (SEK 50 million) for notifying webmasters. Read more here

In its appeal of the FiS decision to the Gothenburg Court of Appeal, the DPA argued that Google was guilty of both Complaint No. 2 and Complaint No. 8, as well as the practice of notifying webmasters of removed search results. The DPA wanted the fine to be set at €6.3 million (SEK 66 million). Of that, €96 639 (SEK 1 million) was for Complaint No. 2, €1 448 547 (SEK 15 million) was for Complaint No. 8, and € 4.8 million (SEK 50 million) was for the practice of informing webmasters.

Holding

Complaint No. 2

The Gothenburg Court of Appeals found that Google was not at fault with respect to either Individual Complaint No. 2 or Complaint No. 8. The Gothenburg Court of Appeals agreed with FiS that Google was not at fault in the case of Complaint No. 8 because the search result was removed 3 days before the DPAs order to Google to remove the search result took effect.

Complaint No. 8

The Gothenburg Court of Appeals disagreed with the FIS regarding Google's fault with respect to Complaint No. Complaint No. 2 was about the fact that the data subject's name was mentioned in a discussion post on the online forum Flashback. The data subject had only provided the main web address (URL) of the discussion thread. The Gothenburg Court of Appeal found that Google's instructions to data subjects who want to exercise their right to be forgotten clearly asks the data subject to provide each and every URL that is part of their request, as even small changes to the URL can lead to a different website. The Gothenburg Court of Appeal noted that Google has set up a help page explaining why it is important that the request is detailed and what needs to be done in order for the data subject to exercise their right to be forgotten.

The Gothenburg Court of Appeals concluded that Google deleted the requested search results without undue delay under Article 17 GDPR. This was because the original request to be forgotten did not include the URL to the specific part of the thread where the data subject's name was mentioned. The data subject later provided the specific URL, and Google deleted that search result.

Googles practice of informing webmasters

The Gothenburg Court of Appeal upheld the FiS decision that Google's decision to tell webmasters of the removal of search results was in breach had no legal basis in any event and was in breach of Article 5(1)(a) GDPR, Article 5(1)(b) GDPR and Article 6 GDPR. The Gothenburg Court of Appeals found that Google had systematically ignored the Article 29 Working Party's guidelines in this case over an extended period of time. Although the guidelines are guidance, the Gothenburg Court of Appeal pointed out that the Article 29 Working Party's mandate is to ensure that the European Union's data protection rules are applied consistently in all Member States. Therefore, the Gothenburg Court of Appeal also upheld the fine of € 4.8 million (SEK 50 million) imposed by FiS.

Comment

The entire decision is unfortunately not published on the the website of the The Gothenburg Court of Appeal. To get the decision one has to go to the press release: https://www.domstol.se/nyheter/2021/11/googles-rutin-strider-mot-gdpr/ and then use a webform (Swedish) to request a copy of the judgement.

Another way might be to email the court: forvaltningsrattenigoteborg@dom.se and supply this case number: 2232-21.

(Comment by initial contributor)

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

& # 13;
& # 13;
Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". The Court of Appeal considers that this is not permitted under the Data Protection Regulation (GDPR). & # 13;
                The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name.
The Court of Appeal considers that Google's routine of regularly informing webmasters that search results have been deleted constitutes a processing of personal data that is not in accordance with the Data Protection Regulation.
- The Court of Appeal has made the same assessment as the Administrative Court, that Google's routines regarding requests to remove search results are contrary to the Data Protection Ordinance, says the Court of Appeal's lawyer Petter Classon.
However, the Court of Appeal finds that Google has removed individual search results without undue delay. The Court of Appeal therefore reduces the sanction fee by an additional SEK 2 million, in relation to the Administrative Court's ruling, to a total of SEK 50 million. & # 13;
                & # 13;