FiS - 7565-20
| FiS - 7565-20 | |
|---|---|
 | |
| Court: | FiS (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(b) GDPR Article 17 GDPR |
| Decided: | |
| Published: | 23.11.2020 |
| Parties: | Google LLC |
| National Case Number/Name: | 7565-20 |
| European Case Law Identifier: | |
| Appeal from: | Datainspektionen DI-2018-9274 |
| Appeal to: | |
| Original Language(s): | Swedish |
| Original Source: | The Administrative Court of Stockholm (in Swedish) |
| Initial Contributor: | Kave Noori |
The Administrative Court of Stockholm (FiS) rejected Google's motion of repealing the Swedish DPA's decision on Article 17 violations by the company. However, the Court did lower the fine imposed by the DPA from €7 million to €5,091,000.
English Summary
Facts
This case was initiated when the DPA followed up a previous supervisory decision against Google. In the previous decision the DPA had ordered Google to remove certain search results concerning a handful of data subjects who exercised their right to be forgotten pursuant Article 17. During the follow up the DPA found that Google had failed to fully comply with the previous supervisory decision in relation to two complaints from data subjects.
Additionally, Google routinely informs webmasters when a search result has been removed from the list of search results. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. This in practice puts the right to delisting out of effect. Google believes that informing webmasters is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information pursuant Article 17(3).
The DPA issued a sanction fee because of Googles failure to comply with the two complaints and because it determined that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).
Dispute
- Did Google process personal data in violation of the GDPR by failing to remove some search results relating to the two complaints without undue delay?
- Was Google’s practice of routinely informing webmasters about removed search results lawful under the GDPR?
- The sanction fee.
Holding
The two complaints
Regarding if Google had failed to remove search results without undue delay, the Court upheld the DPA’s decision concerning one of the complaints and dismissed the other one. The latter was dismissed when the Court concluded that the actual date at which the DPA’s supervisory decision become legally binding, was three days after Google had removed the search result in question.
Informing webmasters
The Court held that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing.
The Court made it clear that if a search engine relies on legitimate interest and believes that removing a search result goes against the freedom of expression and information [Article 17(3)], a legitimate interest assessment must be carried out before the search engine agrees to remove the search result. The Court found that once a search engine removes a search result, it means that conflicting legitimate interests have already been weighed against each other and the outcome was deemed to be in favor of the data subject. The Court concluded that a search engine is not supposed to conduct a new legitimate interest assessment regarding if the webmaster should be notified. The Court held that conducting a new legitimate interest assessment would mean the data subject’s right to be forgotten is not afforded effective and complete protection.
Sanction fee
While the Court found Google's practice to be unlawful, it also ruled that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The reduction was due to the dismissal of the DPA’s findings regarding one of the complaints. The Administrative Court therefore reduced the sanction fee from a total of SEK 75 million to SEK 52 million.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Google's routine violates the GDPR Dimensions: 7565-20 Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". In a judgment today, the Administrative Court has found that this is not permitted under the Data Protection Regulation (GDPR). The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name. Google believes that webmaster information is necessary for purposes relating to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information. On the other hand, the Court has ruled that Google's routine of regularly sending information to webmasters constitutes a processing of personal data which is incompatible with the purpose for which the data was originally collected, and that there is no legal basis for the processing. - The court has found that Google's procedures regarding requests to remove search hits are contrary to the Data Protection Ordinance, says lawyer Stefan Holgersson However, the Court finds that the penalty charge imposed for Google's failure to delete individual search results without undue delay should be significantly reduced. The Administrative Court therefore reduces the sanction fee from a total of SEK 75 million to SEK 52 million.
