FiS - 7565-20

FiS - 7565-20
Court:	FiS (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(b) GDPR Article 17 GDPR
Decided:
Published:	23.11.2020
Parties:	Google LLC
National Case Number/Name:	7565-20
European Case Law Identifier:
Appeal from:	Datainspektionen (Sweden) DI-2018-9274
Appeal to:
Original Language(s):	Swedish
Original Source:	The Administrative Court of Stockholm (in Swedish)
Initial Contributor:	Kave Noori

The Administrative Court of Stockholm ( FiS ) rejected Google's request to overturn the Swedish DPA's decision on the company's Article 17 violations. However, the court reduced the fine imposed by the DPA from €7 million to €5,091,000.

English Summary

Facts

This case was initiated when the DPA followed up on an earlier supervisory decision against Google. In the earlier decision, the DPA had ordered Google to remove certain search results relating to a handful of data subjects who had exercised their right to be forgotten under Article 17. Upon follow-up, the DPA found that Google had not fully complied with the previous supervisory decision in relation to two complaints from data subjects.

Additionally, Google routinely notifies webmasters when a search result has been removed from the search results list. This allows the website owner to republish the webpage in question at a different web address, which will then show up in a Google search. This effectively overrides the right to delist. Google considers that informing webmasters is necessary for purposes related to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information under Article 17(3).

The DPA issued a sanction fee because Google failed to comply with the two complaints and because it found that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).

Dispute

1. Did Google process personal data in breach of the GDPR by not removing some search results relating to the two complaints without undue delay?
2. Was Google's practice of routinely notifying webmasters of removed search results lawful under the GDPR?
3. The sanction fee.

Holding

The two complaints

On the question of whether Google had failed to remove search results without undue delay, the court upheld the DPA's decision on one of the complaints and dismissed the other. The latter was dismissed because the court concluded that the actual date on which the DPA's supervisory decision became legally binding was three days after Google removed the search result at issue.

Informing webmasters

The court ruled that Google's routine of regularly sending information to webmasters constituted a processing of personal data incompatible with the purpose for which the data was originally collected, and that there was no legal basis for the processing.

The court clarified that where a search engine invokes a legitimate interest and considers that the removal of a search result infringes freedom of expression and information [Article 17(3)], an assessment of the legitimate interest must be carried out before the search engine agrees to remove the search result. The court held that once a search engine removes a search result, this means that the competing legitimate interests have already been weighed against each other and the result was considered to be in favor of the data subject. The court concluded that a search engine should not undertake a new balancing of legitimate interests as to whether the webmaster should be notified. The court found that carrying out a new balancing of legitimate interests would mean that the data subject's right to be forgotten was not effectively and fully protected.

Sanction fee

While the court found Google's practice unlawful, it also ruled that the fine imposed on Google for failing to delete individual search results without undue delay should be substantially reduced. The reduction was due to the fact that the findings of the DPA on one of the complaints were rejected. The Administrative Court therefore reduced the penalty fee from a total of SEK 75 million to SEK 52 million.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Google's routine violates the GDPR
Dimensions: 7565-20
Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". In a judgment today, the Administrative Court has found that this is not permitted under the Data Protection Regulation (GDPR).
The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name.

Google believes that webmaster information is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information.

On the other hand, the Court has ruled that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.

- The court has found that Google's procedures regarding requests to remove search hits are contrary to the Data Protection Ordinance, says lawyer Stefan Holgersson

However, the Court finds that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The Administrative Court therefore reduces the sanction fee from a total of SEK 75 million to SEK 52 million.