Tietosuojavaltuutetun toimisto (Finland) - 918/154/2019

Tietosuojavaltuutetun toimisto - 918/154/2019
Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 17(1) GDPR Article 58(2)(c) GDPR § 34(2)(4) Act on the Processing of Personal Data by the Police
Type:	Complaint
Outcome:	Upheld
Started:	31.01.2019
Decided:	03.06.2020
Published:
Fine:	n/a
Parties:	Google LLC
National Case Number/Name:	918/154/2019
European Case Law Identifier:	n/a
Appeal:	Appealed - Overturned Helsingin hallinto-oikeus H6072/2021
Original Language(s):	Finnish
Original Source:	Tietosuojavaltuutetun toimisto (in FI)
Initial Contributor:	fred

The DPA ordered Google to remove several search result links from Google Search, as they had led to outdated information about the data subject.

English Summary

Facts

Pursuant to Article 17(1) GDPR, the data subject had requested Google LLC (the controller) to remove several search result links from Google Search because they led to outdated information about the data subject. The controller had only removed some of the links, rather than implementing the request in its entirety.

The controller stated that the search result links led to online content, the main subject of which was the arrest warrant issued against the data subject. The controller argued that it had a substantial legitimate interest in keeping the information available to ensure the safety of those dealing with the data subject.

The data subject claimed that they had already served their prison sentence in full and that the arrest warrant had ceased to be valid since April 2011. Consequently, the information was no longer necessary for the purposes for which it was originally processed. The data subject emphasised that the information about the warrant caused them harm, as it was both inaccurate and outdated.

Holding

The DPA considered that since the arrest warrant was no longer valid, the public no longer had a reason to inform the police of their sightings of the data subject. Therefore, due to the passage of time, the availability of the information could no longer be considered justified.

The DPA also emphasised the importance of the statutory retention period for the arrest warrant. According to Section 34(2)(4) of the Finnish Act on the Processing of Personal Data by the Police, other data concerning an arrest warrant processed for the purpose of finding, monitoring, surveillance or protection of individuals are erased three years after the cancellation or expiry of the warrant or prohibition.

On the basis of the information gathered, the DPA concluded that the information on the arrest warrant against the data subject was no longer of importance to society.

As a result, and in accordance with Article 58(2)(c) GDPR, the DPA ordered the controller to comply with the data subject's request to remove the search result links in question.

Comment

The Finnish DPA has issued five other decisions regarding the removal of search result links from Google Search, one in favour of Google in case 4543/154/2018 and four against it in cases 5756/154/2018, 6722/154/2018, 8004/154/2018 and 903/154/2019.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

DECISION OF THE DEPUTY DATA PROTECTION OFFICER IN THE MATTER OF DELETING DATA

Subject: Removing search result links from the search results of the Google Search search service

Applicant x

The controller is Google LLC

The applicant's requirements with justification

On January 31, 2019, the applicant has initiated a case at the data protection commissioner's office regarding the removal of url search result links from the Google Search search service. The issue has been about url search result links:

1) x;
2) x;
3) x;
4) x;
5) x;
6) x;
7) x;
8) x;
9) x;
10) x;
11) x; and
12) x.

In clarifying the matter, Google LLC has announced that it has accepted the applicant's request regarding url search result links 2) and 12). When preparing this decision, these url search result links were not available in connection with a Google search performed under the applicant's name, which is why this decision is limited to url search result links 1) and 3)–11).

The url search result links that are the subject of the decision lead to online content, the main subject of which is the published wanted advertisement for the applicant. However, information is also available that in February 2010 the Helsinki Court of Appeal had sentenced the applicant to a prison sentence of nine years and four months for a serious drug crime. The online content describes the applicant's appearance. The observations concerning the applicant are requested to be reported to the command center of the Helsinki Police.

The applicant has justified his removal request by, among other things, that information can be found behind the url search result links requested to be removed, which is already out of date. The applicant has said that the wanted notice in question has not been valid since April 2011. The applicant has emphasized that the online content in question specifically concerns the wanted notice, not the facts behind the wanted notice.

Statement received from the registrar

The applicant has submitted a request to the registrar himself to delete the search result links and received a negative response to his request. The data protection authorized office has also requested an explanation from the controller. The registrar has issued his report on 9 April 2020.

The registrar has announced that he has reconsidered the matter. However, with the exception of url search result links 2) and 12), the controller has stuck to his original decision. In the report given, it has been established that the online content in question deals with the fact that the applicant had been the subject of a police search. It has been said that the applicant avoided the prison sentence he received.

The controller has also invoked the guidelines of the data protection working group in accordance with Article 29, according to which, in connection with crimes, data protection authorities are more likely to consider deleting search results related to relatively minor and long-ago crimes and less likely to delete results related to serious and recent crimes.

It has also been stated in the report that this case is about information regarding the applicant's prison sentence for a drug offence. The controller has considered that there is a strong legitimate interest in keeping the information available to ensure the safety of those dealing with the applicant.

The applicant's equivalent

The applicant is given the opportunity to give his answer in the case. The applicant has given his answer on 20 April 2020.

In the response given, it has been stated that the applicant had not avoided the nine years and four months prison sentence he received for serious drug crimes. The online content is from a time before the judgment in question came into force. The applicant has said that he served his prison sentence after the sentence became final.

Contrary to what was stated in the report, the online content specifically concerns the wanted notice published for the applicant - not the underlying crime. The wanted notice has not been valid since April 2011. The information on the wanted notice is therefore both incorrect and out of date. The applicant has said that he has completed his prison sentence in full. Since the search warrant is no longer valid, the applicant has considered that the information is no longer needed for the purposes for which it was originally processed. Having information available is a disadvantage for the applicant.

A legal question

The Deputy Data Protection Commissioner assesses and decides the applicant's case based on the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act (1050/2018). When deciding the matter, the Deputy Data Protection Commissioner also takes into account the European Data Protection Board's interpretation guidelines issued on 2 December 2019 Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (later the European Data Protection Board's interpretation guidelines), of the European Court of Justice judgments C-131/12 and C-136/17 and, where applicable, also the guidelines on the implementation of the Court of Justice of the European Union judgment of the aforementioned judgment C-131/12 on 26 November 2014 issued by the data protection working group in accordance with Article 29 on "Google Spain and Inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González” C-131/12 (later Interpretative Guideline of the Article 29 Data Protection Working Party).

The Deputy Data Protection Commissioner must decide whether the data controller should be given an order according to Article 58, paragraph 2, subsection c of the General Data Protection Regulation to comply with the data subject's request to delete the url search result link in question.

In this decision, the Deputy Data Protection Commissioner assesses the applicant's case in terms of the processing of personal data by the controller and the online service it offers. The decision does not take a position on whether the other operator involved in the matter, i.e. the original publisher of the data, has the right to keep the data available on its own website.

Decision and reasons of the Deputy Data Protection Commissioner

I accept the applicant's requirements on the grounds stated below and give Google LLC an order according to Article 58, paragraph 2, subparagraph c of the General Data Protection Regulation to comply with the applicant's request to remove the url search result links in question.

According to Article 17 of the General Data Protection Regulation, if the conditions listed in the article are met, the data subject has the right to have the data controller delete personal data concerning the data subject without undue delay. The registered person can request the deletion of data on more than one basis mentioned in the article. The European Data Protection Board has, with the above-mentioned interpretation guideline (Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR), taken a position on the application of the requirements laid down in Article 17, Section 1 of the General Data Protection Regulation in matters concerning internet search engines.

On the judgments of the European Court of Justice C-131/12 and C-136/17

In the judgments of the EU Court C-131/12 and C-136/17, it has been stated that the processing of personal data carried out in connection with internet search engines, when the search is made under the name of the data subject, can significantly affect the data subject's privacy rights.

In the aforementioned judgments, it has also been stated that two independent, separate actors are always associated with the information published on a certain individual website and its availability in the search results of internet search engines: 1) the website administrator, i.e. the so-called original publisher and 2) the internet search service administrator. In judgment C-131/12, it has been established that the internet search engine is an independent data controller with regard to the processing of personal data that the search engine performs in order to provide url search results (see paragraphs 35−41, 82−83 and 88 of the judgment). The two separate operators mentioned above do not, in principle, process personal data on the same basis. In the decision of the European Court of Human Rights, M.L. and W.W. vs Germany (issued on June 28, 2018), it has been stated that in the weighing of interests, different outcomes can be reached depending on the matter at hand: (i) the activity of the original publisher can be seen as being at the core of the rights to freedom of speech and expression, while ii) the primary purpose of the operator of the internet search service, on the other hand, is not has not been to publish the information in question per se, but to collect any information about the registered person in one place and thus enable the creation of a personal image of the registered person.

In judgment C-131/12, it was further stated that a person's public or public-like status is a factor that may lead to the so-called general public having the right to obtain personal information about him from an internet search engine. Among other things, the judgment states the following: [w]hen the data subject can, in relation to his fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, demand that the information in question is no longer made available to the general public by including it in such a list of search results, it must be considered - as, for example, in the judgment It appears from section 81 - that the rights in question supersede not only the economic interest of the operator of the search engine, but also the interest of the general public in finding the mentioned information when searching under the name of the registered person. However, this would not be an issue if it turns out that interference with the data subject's fundamental rights for special reasons such as the data subject's position in the public domain can be justified by the primary interest that the general public has in obtaining that information as a result of the inclusion in question (see paragraph 97 of the judgment).

In the judgment of the EU Court C-136/17, it has been stated that […] the right to the protection of personal data is not an absolute right, but it must […] be considered in relation to its function in society and, in accordance with the principle of proportionality, it must be proportionate to other fundamental rights. Furthermore, it has been stated that especially in Article 17(3)(a) of the Data Protection Regulation, the requirement for weighing the fundamental rights to respect for private life and the protection of personal data established in Articles 7 and 8 of the Charter of Fundamental Rights, and the fundamental right to freedom of communication guaranteed in Article 11 of the Charter of Fundamental Rights, on the other hand, has been explicitly established.

In the judgments mentioned above, it has been established that the rights of the data subject in principle supersede not only the economic interest of the search engine operator, but also the interest of the general public in obtaining the information in question by searching under the name of the data subject. However, the EU court has identified several factors that must be taken into account in the assessment. These include, for example, the nature of the information in question or its sensitivity, and in particular the interests of internet users in accessing information, which, in turn, must be taken into account when evaluating, for example, the registered person's possible public or public-like status.

The concept of public position has been defined in the interpretation guidelines of the data protection working group in accordance with Article 29 mentioned above. According to this interpretation guide, a public position or a public person means that the person is at least to some extent in so-called media exposure due to his activities or commitments. If a person has a public position, then there is a reason that the general public should be able to search the internet search engine for information that is relevant to the person's public or similar role (see pages 13−14 of the interpretation instructions of the data protection working group according to 29).

Evaluation of the applicant's case

Committing a criminal act and being convicted of it basically gives a person a public status in society and exposes them to so-called media exposure for the act in question. The starting point is that a person who has committed a criminal act cannot have the same justified assumption about the extent of the protection of their privacy after their act as a person who has not committed a crime.

The aforementioned principle emerges, for example, from the judgment of the European Court of Human Rights, Sidabras and Džiautas v. Lithuania (2004, paragraph 49), where it is considered that Article 8 of the European Convention on Human Rights, which protects, among other things, respect for private life, does not protect against the loss of reputation that is a foreseeable consequence of a person's own actions , such as committing a crime. The decision of the European Court of Human Rights Axel Springer Ag v. Germany (2012, paragraph 83) also confirms the same line.

However, the above does not mean that a person who has committed a crime has no privacy protection at all. Despite the criminal act and the punishment received for it, part of the personal data of the person in question remains within the scope of his private life and the protection of privacy, which is his fundamental right.

In the applicant's case, it is undisputed that in 2010 he was sentenced to a prison sentence of nine to nine years and four months for a serious drug crime. I consider that, as a result, the applicant has a public or public-like status as referred to in judgment C-131/12. I will use the term "public station" below for this position. This public position basically gives the general public a legitimate interest in obtaining personal information about the applicant from the Google Search search service in the manner outlined in judgment part C-131/12 (see paragraph 97 of the judgment). It should also be noted that according to the Journalists' instructions, the name, picture or other identifying information of a person convicted of a crime may be published, unless it is clearly unreasonable in relation to the position or act of the person convicted.

To the extent that the provision of the applicant's personal data in the internet search engine is possible due to the position stated above, the issue of the temporal dimension of the permitted processing of personal data is also integrally related to the matter. In other words, how long will the public status exist so that the processing of personal data related to a criminal act is not restricted in connection with name searches on internet search engines.

The interpretation guidelines of the European Data Protection Board state that the data subject can ask the operator of the internet search engine to remove from the search results those url search result links whose availability, for example due to the passage of time, cannot be considered justified at the time of review. Consequently, it must be assessed whether the information in question should be considered outdated or not updated at the time of review. For example, the question may be about information that, due to the passage of time, is considered imprecise, incorrect or outdated. The evaluation must take into account the original purposes of the processing. The evaluation should also take into account the original storage periods applicable to the information in question (see page 6 of the European Data Protection Board's interpretation instructions).

In the judgments of the EU Court C-131/12, the removal of personal data (url search results) from the name-own internet search engine has been outlined. When assessing the need to delete personal data related to a public position, a weighing of interests must be carried out, which also takes into account the rights of other persons to receive information about the registrant via url search results from the Google Search search service. In the weighing of interests, an effort must be made to find a fair balance between the general public's interest in obtaining information and the registered person's fundamental rights pursuant to Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Although the rights of the data subject protected by the articles in question generally supersede the mentioned interest of internet users, according to the judgment, the balance may still depend in special cases on the nature of the data in question and their sensitivity in terms of the data subject's private life, and on the public's interest in having access to the data in question, and the latter interest may be different, among other things, on the basis of the public status of the person in question (cf. EU Court judgment C-131/12 paragraphs 73−74, 81, 97, 99 and Section 6 and Section 8 subsection 1 section 8 of the Personal Data Act).

Furthermore, in the interpretation instructions of the data protection working group in accordance with Article 29, the personal data processed in connection with search engine operation is divided into both factual information (facts) and opinions/views that individuals have about something or a person. When assessing the inaccuracy/accuracy of personal data, it must be taken into account whether the issue is a fact whose correctness cannot be disputed or whether the issue is a subjective opinion or view. In the mentioned interpretation instruction, it is outlined that the data protection authorities are more likely to consider deletion of search result information that is accompanied by an objectively perceptible factual error and which therefore gives an incorrect, incomplete or misleading picture of the person (see pages 15 and 17 of the interpretation instruction of the data protection working group in accordance with Article 29 ).

In the interpretation guide, it has also been stated that member states may have special national legislation that defines the temporal dimension of access to information about the commission of a crime. Data protection authorities may, when considering a criminal matter, take into account the relevant national principles and approaches that are generally related to the processing of such data (see page 20 of the interpretation instructions of the data protection working group in accordance with Article 29).

The applicant has not denied that he was sentenced for a serious drug crime to a prison sentence of nine years and four months. The applicant has not denied that he was the subject of a wanted notice. So it is not really a question of the fact that behind the url search result links in question, there is information available about a matter concerning the applicant that is not true. However, it is significant that the target of the online content in question is the published wanted notice about the applicant - not the factors influencing the background of the wanted notice per se. The online content does not describe the applicant's crime in more detail. The applicant's act and the resulting punishment are only mentioned at the mention level. The main topic of the online content is the published wanted notice about the applicant.

When the url search result links requested to be deleted have dealt with the applicant's crime and possibly the related punishment, the applicant's case is basically mirrored in the national special legislation that generally defines the temporal dimension of the availability of information about the commission of crimes (cf. page 20 of the interpretation instructions of the data protection working group according to 29).

As stated in the interpretation guidelines of the European Data Protection Board, the evaluation must, however, take into account the original purposes of the processing and the original storage periods applicable to the information in question (see page 6 of the interpretation guidelines of the European Data Protection Board).

In the online content in question, the main subject is the wanted notice published about the applicant. It should be noted that the search warrant is no longer valid. The public no longer has a reason to inform the police of their findings concerning the applicant. It can be stated that the availability of data can no longer be considered justified due to the passage of time.

As stated above, the original storage periods applicable to the information in question are also important. Section 34 of the Act on the Processing of Personal Data in Police Operations (616/2019) provides for the deletion of personal data other than those referred to in Section 33 of the Act. According to Section 34, Subsection 1, Clause 4 of the Act, other information regarding the search warrant processed for the purpose of reaching, monitoring, monitoring and protecting persons is deleted three years after the cancellation or termination of the warrant. The validity of the wanted notice published for the applicant has expired in April 2011. If the applicant's case is reflected in this retention period provision, it can be stated that the information from the wanted notice concerning the applicant is no longer socially relevant.

Based on the above, I give Google LLC an order in accordance with Article 58, paragraph 2, subparagraph c of the General Data Protection Regulation to comply with the applicant's request to remove the url search result link in question.

Applicable legal provisions

Those mentioned in the justifications.