HDPA (Greece) - 15/2024
From GDPRhub
| HDPA - 15/2024 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 21.05.2018 |
| Decided: | 16.04.2024 |
| Published: | 30.05.2024 |
| Fine: | n/a |
| Parties: | Google Inc. |
| National Case Number/Name: | 15/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Inder-kahlon |
The DPA decided that the right to erasure must be satisfied and instructs Google to immediately remove specific search results linked to the complainant's name, also to check and delete if any similar links do appear in the Google search engine.
English Summary
Facts
The data subject submitted a data erasure request to Google Inc. (the controller) requesting the removal of 55 search results from the controller's search engine that were produced with his full name search. The results linked to pages where the data subject's name had been linked to sensitive data. More specifically the data subject compliant about the inaccurate information linked to a criminal case. The data subject believed this information was no longer necessary and it impacted heavily on his private and professional life.
The controller responded to the request citing a legitimate public interest in having access to the information that concerned criminal offences, and arguing that deletion of the relevant links were therefore not permissible. The data subject complained to the HDPA on 21st May 2018 that the controller’s stand on one hand is in violation of CJEU - C‑131/12 - Google Spain and on the other hand failure to properly assess his request and supporting documents.
The Hellenic DPA invited Google LLC (formerly Google Inc.), to provide their views on the complainants. The controller responded that they had removed 11 urls while the conditions for removal weren’t fulfilled for the remaining 44 urls the complainant wanted deleted, removal was not justified. The controller concluded that the information was still relevant, and connected to the complainant's role in public life, meaning the public's right to access this information outweighed the complainant's right to have it removed.
Holding
The Hellenic DPA (HDPA) noted that a search engine provider that receives a deletion request based on the particular situation of the data subject must delete the personal data without unnecessary delays in accordance with Article 17(1)(c) GDPR unless it is able to demonstrate that there are "compelling and legitimate reasons" overriding the interests, rights and freedoms of the data subject for the inclusion of the specific search result, pursuant to Article 21(1) GDPR. Additionally, the Hellenic DPA noted the CJEU - C-460/20 - TU, RE v Google point 52,62 individuals have the right to have personal information delinked from search results based on their full name.
The Hellenic DPA noted that the complainant in this case was not a public figure, and the information in question was outdated and no longer of public interest. Based on these factors, the conditions for removing the specified links from Google search results under the complainant's full name were met. Consequently, the HDPA ordered the controller to immediately delete the links appearing as search results for the complainant's name in the Google search engine and to confirm that other links with the same content mentioned in the complaint do not appear as results for the complainant's full name. If they do, they must also be deleted from the Google search engine.
Comment
Relevant cases: HDPA (Greece) - 11/2024, HDPA (Greece) - 12/2024
The Hellenic DPA clarified the definition of public figure: Although a data subject may not be a public figure, they can still be considered to have a role in public life due to their professional activities. This criterion is broader than that of a "public person" and often includes executives of organizations that play a significant role in the country's business sector, where public interest in their activities is justified. Typically, politicians, senior civil servants, business leaders, and professionals in regulated fields are seen as having a role in public life. However, in this case, the complainant is not the individual mentioned in the publications, holding a position of executive authority or delegating management to other executives. Therefore, there is no particular public interest in this individual's activities.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Leof. Kifisias 1-3, 11523 Athens
Tel: 210 6475 600 • E: contact@dpa.gr • www.dpa.gr
Athens, 16-04-2024
Reference No: 1163
DECISION 15/2024
The Hellenic Data Protection Authority (hereinafter "Authority") convened at the invitation of its President for a session at its headquarters on Tuesday, 29-06-2023, at 10:00, in order to examine the case referred to in the background of this document. Present were the President of the Authority, Konstantinos Menoudakos, the regular members Spyridon Vlachopoulos, Konstantinos Lamprinoudakis, Charalampos Anthopoulos, Christos Kalloniatis, Aikaterini Iliadou, and Grigorios Tsolias, acting as rapporteur. Present, without voting rights, were Stefania Plota, specialist - lawyer, as assistant rapporteur, and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary.
The Authority took into account the following:
With complaint no. G/EIS/3859/21-05-2018, A (hereinafter "complainant") appealed to the Authority against the company Google Inc. (hereinafter "Google" or "company"), for failure to comply with the right to erasure (right to be forgotten) of results appearing in Google’s search engine based on the complainant’s name. Specifically, the complainant submitted his application dated ..., to the data controller Google Inc. with reference number ... for the deletion from the search results of Google’s Search engine of the following links (total of 55), in accordance with Article 13 par. 1 of Law 2472/1997, and the activation of procedures in order to render future access to this data impossible.
In particular, in his application to the company, the complainant claimed that following a search in the Google Web Search engine based on his name, namely a) B, b) C, c) D, and d) E, the following list of results appears, which contains links to third-party published websites, which contain information related to my person, which refer to sensitive personal data, and specifically: to highly inaccurate information, concerning the investigation against me, my arrest, and my subsequent temporary detention, by F, for the offense of ..., which took place from ... until ... when I was released. The aforementioned sensitive personal data have for a very long time (more than ... years) become absolutely inaccurate, and in any case, there is no longer any justifiable reason for the continuation of the processing of these data, which is damaging to my private, professional, and social life, especially since this severely violates my personality and infringes my right to informational self-determination, particularly with absolutely inaccurate and not corresponding to the Principle of Proportionality sensitive personal data. Specifically, from ... to ... I worked as ... at ..., specifically in the office of X. On ... S, cousin of Z..., knew that S was related to the aforementioned ..., nor, much less, that the real ... was him, and that the money was the product of .... In the spring of ..., the Z scandal broke out in O, with arrests and extensive coverage by the Greek and International M.S.E.. X restrained the aforementioned ..., and informed the .... At the same time, an internal investigation was conducted and concluded that neither ... nor I violated the rules, and therefore that I committed no offense. Due to the multiple judicial aids of ... to Y, for ..., F started its own investigation for any responsibilities .... During the investigation, they interrogated S, who falsely testified that X and I knew that Z was behind him. The visits of ... to Athens, from ... onwards, leaked to the Greek press and the first articles mentioning me, as allegedly involved ..., appeared on .... On ... F started an investigation against me, on suspicion of .... On ..., it was decided that I should be temporarily detained, on the grounds of risk. On ... many articles were published referring to my temporary detention. On ... I was released. From ... until today: 1) I have not been convicted, nor have any charges been brought against me, neither in Y, nor in O, nor in any other country in the world, as evident, the case is heading towards archival, 2) I have again started working, and indeed in a regulated position at ... To obtain the license, the ... committee ... conducted a thorough examination and concluded that I am fit and proper to work in a regulated position." Furthermore, the complainant lists the following links, for which he requests deletion from the results of Google Search and the activation of procedures to make future access to this data impossible:
1. ...
2. ...
3. ...
4. ...
5. ...
6. ...
7. ...
8. ...
9. ...
10. ...
11. ...
12. ...
13. ...
14. ...
15. ...
16. ...
17. ...
18. ...
19. ...
20. ...
21. ...
22. ...
23. ...
24. ...
25. ...
26. ...
27. ...
28. ...
29. ...
30. ...
31. ...
32. ...
33. ...
34. ...
35. ...
36. ...
37. ...
38. ...
39. ...
40. ...
41. ...
42. ...
43. ...
44. ...
45. ...
46. ...
47. ...
48. ...
49. ...
50. ...
51. ...
52. ...
53. ...
54. ...
55. ...
The company sent an automated email message the same day confirming that it received the request and that it would process it as quickly as possible given the volume of messages received and on ... replied to the complainant that "after weighing the rights and interests related to the content in question, taking into account factors such as the person’s role in public life, Google LLC decided not to remove this content. At that specific moment, Google decided not to take any action on the said links (URLs)." Following the company’s response, the complainant submitted to the Authority the complaint under consideration, in which, beyond what was mentioned above in his application to the company, he claimed that regarding the company’s response, Google thus "on the one hand violated the CJEU decision of 13.05.2014 in Google Spain SL & Google Inc vs Agencia Española De Protección De Datos & Mario Costeja Gonzalez C-131/12, and on the other hand did not properly assess my request, along with the supporting documents presented, and thus did not sufficiently justify its response. Specifically, it did not take into account that the relevant websites refer to sensitive personal data," reiterating the facts that he had presented in his application to the company, adding that "the relevant response is in complete contradiction with the fact that for the URLs a) ... and b) ..., which also concerned the same information, which is processed with the other URLs, the responsible website ... decided to delete them from its databases and remove them from the search results of Google."
The Authority, in the context of examining the above complaint, summoned the companies Google LLC (formerly Google Inc), as the operator of Google’s search engine, and Google Hellas with reference no. G/EKS/5232/26-07-2019 to provide their views on the allegations, fully justifying their negative response for each link separately. The company Google LLC responded to the Authority with reference no. G/EIS/5976/03-09-2019 stating that after a relevant check, it found that eleven (11) links included in the complainant’s deletion request direct users to websites that do not display content or display content that does not mention the complainant’s name and that it has taken actions to remove these links from the search results of Google Web Search service. Regarding the other links, the company stated that the right to be forgotten has been defined under the decision "Google Spain and Inc. vs Agencia Española De Protección De Datos (AEPD) and Mario Costeja Gonzalez" C-131/12 ("Costeja decision") and the Guidelines of the Article 29 Working Party, as the right of a person to cease the information related to him to be linked to his name through the results list that arises after a search conducted based on his name when at that moment the information "is inaccurate, unsuitable, or has ceased to be relevant to the respective issue or is excessive in relation to the above purposes or in view of the time that has elapsed", and this decision admits that the interest of the public prevails when the data subject plays a role in public life, and the relevant information relates to that role. The company refers to the criteria set out as questions in the Guidelines, namely "what role does the subject play in public life", "Do the data concern the subject’s professional life?", "Is the data related to the person’s professional life excessive? Does the data subject still engage in the same profession?", "Are the data accurate?", "Are the data related to criminal offenses?" and for the case under consideration ruled that "the contested publications concern the prosecutorial investigation conducted by ... against the complainant, as well as his temporary detention, for the offense of .... Considering that this information was published ... years ago and/or even more recently and that they concern the professional life of the data subject as ... and the criminal investigation that was conducted against him and his temporary detention for the particularly serious offense of ..., facts that he himself recognizes, we consider that the relevant links (URLs) are directly related to the role that the data subject plays in public life, justifying the legitimate interest of the public to gain access to the information contained in these articles. It is therefore undeniable that the data subject plays a role in public life and that the relevant articles contain information and news related to that role.
Furthermore, the complainant, despite claiming that the relevant information is inaccurate, has so far not provided any information, evidence, or document proving the inaccuracy of the relevant information, which is necessary in this case since the complainant not only does not dispute but additionally admits the fact of his temporary detention and the related criminal investigation," concluding that for forty-four (44) links included in the complainant’s deletion request, deletion is not permissible, as "after weighing the rights and interests associated with the content in question, the relevant information is recent, related, and pertains to the profession of the data subject. The "young age" of the information is itself sufficient to demonstrate that the complainant cannot lawfully invoke the right to be forgotten regarding these articles. The relevance to the profession of the complainant, the failure to demonstrate the inaccuracy of the information, and the role that the complainant plays in public life, are simply additional elements supporting the position that the deletion of the relevant links from the search results is not permissible."
Subsequently, the complainant submitted to the Authority reference no. G/EIS/1112/27-1-2022 a supplementary email in which he lists the following thirty (30) links for which he requested deletion from the search results, as well as reference nos. G/EIS/7891/10-6-2022 and G/EIS/8394/29-6-2022 supplementary emails, with attached copies of emails, with which the company responds to his earlier requests:
1. ...
2. ...
3. ...
4. ...
5. ...
6. ...
7. ...
8. ...
9. ...
10. ...
11. ...
12. ...
13. ...
14. ...
15. ...
16. ...
17. ...
18. ...
19. ...
20. ...
21. ...
22. ...
23. ...
24. ...
25. ...
26. ...
27. ...
28. ...
29. ...
30. ...
Following these documents, the Authority, with reference no. G/EKS/340/09-02-2023, summoned the company to reconsider the complainant’s requests and provide clarifications. The company responded with reference no. G/EIS/1676/07-03-2023 stating, among other things, that, following its responses to the complainant’s requests mentioned in the above supplementary documents: "The Complainant limited the email message dated ... to thirty (30) links" however, "did not explain the reasons for requesting the deletion of the [...] links, nor clarified that he refers to the deletion of the links from the list of results that appears after searching for his name in the Google search engine." Subsequently, the company grouped the remaining links into two categories (A, B): "The links in category A (1-18) refer to websites that do not display content, or display content that does not include the complainant’s name, thus, the Company will proceed to delete them from the results list of the search engine, which appears when searching for the name of the Complainant":
1. ...
2. ...
3. ...
4. ...
5. ...
6. ...
7. ...
8. ...
9. ...
10. ...
11. ...
12. ...
13. ...
14. ...
15. ...
16. ...
17. ...
18. ...
Regarding the links in category B (1-12), the company, after relevant assessment, concludes that deletion is not permissible in this case because "the content of all links numbered B 1-12, which continue to appear in the search engine results based on the complaint’s name, relates to offenses in which the Complainant is involved in his professional capacity as ..., is recent and accurate. There is, therefore, a legitimate public interest to continue to be informed about this content" and that "the complainant’s right to be forgotten cannot be substantiated," for the following links:
1. ...
2. ...
3. ...
4. ...
5. ...
6. ...
7. ...
8. ...
9. ...
10. ...
11. ...
12. ...
In light of the above, the Authority with reference nos. G/EKS/1231/15-05-2023 and G/EKS/1230/15-05-2023 summoned the aforementioned companies and the complainant respectively, as lawfully represented, to attend, via teleconference, the plenary session of the Authority on Tuesday, 23-05-2023, to discuss the subject complaint. At the above session, the complainant’s attorney Ioannis Apatsidis (AMDSA ...) and on behalf of the company Google LLC, Charikleia Daouti (AMDSA ...) and Evangelia Tsirigoti (AMDSA ...) attended. At this session, the participants presented their views and were given a deadline to submit briefs, which the complainant and the company Google LLC submitted with reference nos. G/EIS/4322/09-06-2023 and G/EIS/4341/09-06-2023, respectively. The complainant in the post-hearing brief he submitted to the Authority noted that various postings referring to him remain published, as evidenced by Google’s latest response, which failed to convincingly explain why they remain published, on the one hand without any criminal file being formed in Greece against him, on the other hand, when, in any case, his presumption of innocence is violated, without any definitive conviction against him, for any offense, and when the sensitive information in question does not even concern a public figure (of absolute or even relative timeliness), but a simple ..., lower in the hierarchy.
The company in its post-hearing brief submitted to the Authority states that the complainant, with the email message dated G/EIS/1112/27-01-2022 that he sent to the Authority, limited his initial request by asking for the deletion of thirty (30) links (the link ... listed by the complainant twice) and after the discussion on the complaint before the Authority, it emerged that from these links, the following nine (9) links continue to appear as results of the Google search engine based on the complainant’s name, to which the company limits its brief:
a. ...
b. ...
c. ...
d. ...
e. ...
f. ...
g. ...
h. ...
i. ...
The company states for the above links that each post is directly related to the role that the complainant plays in public life, as a professional involved in particularly serious criminal offenses, justifying the public’s legitimate interest in gaining access to the information contained in that article. The information is also recent, relevant to public interest and accurate, and the complainant admits the aforementioned factual circumstances mentioned in the above link regarding his professional life and his detention, and the complainant’s attorney admitted before the Authority during the discussion of the complaint, following a question from the company, the fact that the criminal proceedings before ... have not yet been concluded. Therefore, there is a case in which the right to inform the public regarding accurate information concerning a criminal case prevails over the right to erase of the data subject (see Guidelines 5/2019 p. 14 Chap. 2.1). Finally, the company points out that the links f’, g’, h’, and i’ from the above, did not display content at the time of the submission of the G/EIS/1676/07-03-2023 document from Google, and, therefore, in that document, the company had informed that it would proceed to delete them from the results list of the search engine, because these links were inactive, however, subsequently, following that document, the publishers of the websites of those links reposted their content, which includes the complainant’s name, and their deletion did not take place.
The Authority, after examining all the evidence in the file and what emerged from the hearings before it, the briefs and the statements of the parties, having heard the rapporteur and the clarifications from the assistant rapporteur, who attended without voting rights, after thorough discussion,
THOUGHT ACCORDING TO THE LAW
1. As per the provisions of Articles 51 and 55 of the General Data Protection Regulation 2016/679 (GDPR) and Article 9 of Law 4624/2019 (Government Gazette A’ 137), it is established that the Authority has the competence to oversee the implementation of the provisions of the GDPR, this law, and other regulations concerning the protection of individuals from the processing of personal data.
2. Since Google LLC, based in the United States of America, with its letter no. G/EIS/10060/14-12-2018 informed the Authority that, although Google Ireland would be the data controller for user data collected and processed when users interact with Google’s services - including data collected via the Google search engine, where users choose to store activity or search history data in their accounts - Google LLC would continue to be the data controller of the indexed content of the Google search engine and manage the removal process within the framework of the right to be forgotten. Therefore, in the case under consideration, the purpose and means of processing to satisfy the deletion request (to be forgotten), pursuant to Article 17 of the GDPR, are fully determined by Google LLC, as it states, whose establishment is located outside the European Union. Thus, although this specific activity concerns data subjects located in the territory of the Union, since Google LLC does not have a main establishment in the Union for the activity under consideration, the "one-stop shop" mechanism established by the GDPR does not apply according to Articles 56 and 60 of the GDPR, and therefore, according to Articles 55 par. 1, 2 par. 1, and 3 par. 2 GDPR and 13 par. 1(c) of Law 4624/2019, the Authority has the competence to deal with the complaint of A regarding the violation of the right to deletion.
3. The activity of Google Hellas/Athens (GOOGLE HELLAS Internet Applications Single Member Limited Liability Company) is the provision of marketing services to Google Ireland; the complaint regarding the rejection of the request for deletion of links in the context of satisfying the right to be forgotten is examined only with respect to Google LLC as the data controller of the indexed content of the Google search engine.
4. According to Article 17 par. 1 of the GDPR, "the data subject has the right to request the data controller to delete personal data concerning him without undue delay, and the data controller is obliged to delete personal data without undue delay if one of the following reasons applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or processed in any other way, [...], c) the data subject objects to the processing pursuant to Article 21 paragraph 1 and there are no compelling legitimate grounds for the processing or the data subject objects to the processing pursuant to Article 21 paragraph 2, [...]." In paragraph 3 of the same article, it is specified that "paragraphs 1 and 2 do not apply to the extent that processing is necessary: a) for exercising the right of freedom of expression and the right to information [...]"
5. According to the above Article 17 of the GDPR, as interpreted in content by Guidelines 5/2019 of the EDPB, the data subject has the right to request the data controller to delete personal data concerning him without undue delay, and the data controller is obliged to delete personal data without undue delay if one of the reasons mentioned in Article 17 of the GDPR applies. The EDPB points out that, in the event that the deletion request is based on the first reason, namely the data subject requests the deletion of content from search results, when the personal data of the subject are no longer necessary in relation to the purposes, the search engine must ensure a balance between the protection of privacy and the rights of Internet users when accessing information. In particular, it should assess whether, over time, the personal data have become outdated or have not been updated. Also, the EDPB states that in the event that the deletion request is based on the third reason, that the subject opposes the processing, then the GDPR provides stronger guarantees to data subjects than Directive 95/46, since the opposition right of the GDPR does not limit the reasons on which data subjects can request deletion under Article 17 par. 1 of the GDPR. The data subject may oppose processing "for reasons relating to his particular situation," without needing to demonstrate "compelling legitimate grounds," as required by Directive 95/46. The GDPR shifts the burden of proof and provides a rebuttable presumption in favor of the data subject, obliging the data controller (in this case, Google) to prove the compelling legitimate grounds that render the processing absolutely necessary (Article 21 par. 1 GDPR). Therefore, when a search engine provider receives a deletion request based on the particular circumstances of the data subject, it is now obliged to delete the personal data, according to Article 17 par. 1 (c) of the GDPR, unless it can prove that "compelling legitimate grounds" exist for including the specific search result, which, combined with Article 21 paragraph 1, constitute "compelling legitimate grounds (...) which override the interests, rights, and freedoms of the data subject."
6. According to the case law of the Court of Justice of the European Union, the data subject has the right to cease the information related to him to be connected to his name through the results list that arises after a search conducted based on the name of a natural person and furthermore, such a search can lead users to obtain a systematic overview of the information available on the internet that concerns that person, allowing users to form a more or less detailed profile of the data subject, concerning the private life of the data subject.
7. Furthermore, according to the case law of the Court of Justice of the European Union, it is the responsibility of the person requesting the deletion of links, in case of invoking the inaccuracy of the indexed content, to prove the obvious inaccuracy of the information contained in that content by providing evidence that it can reasonably be expected to be able to obtain, in light of the circumstances of the specific case, in order to demonstrate this obvious inaccuracy.
8. Furthermore, according to the case law of the Court of Justice of the European Union, "although the rights protected by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union of the data subject usually prevail over the legitimate interest of potential internet users to access the contested information, this balance may depend on the critical circumstances of each case, in particular the nature of the contested information and its sensitive character concerning the data subject’s private life, as well as the interest of the public in having access to this information, which may vary depending on, among other things, the role that the data subject plays in public life."
9. Since the reasoning for submitting a request for deletion of a link to the search engine service provider, such as Google, must be substantiated.
10. From the initial fifty-five (55) links contained in the complaint dated ..., for their deletion as results from the Google search engine based on his name, with the supplementary (reference no. G/EIS/1112/27-01-2022) email message submitted by the complainant to the Authority, his request covered thirty (30) links, as mentioned above. In its response document (reference no. G/EIS/1676/07-03-2023), the company stated that it would proceed to delete eighteen (18) of these thirty (30) links (as above category A), as they refer to websites that do not display content or display content that does not include the complainant’s name, whereas regarding the other twelve (12) (as above category B), it concluded that in this case the complainant’s right to deletion is not established. However, in the brief submitted by the company to the Authority after the hearing (reference no. G/EIS/4341/09-06-2023), it stated that from these links it emerged that the aforementioned nine (9) links still appear as results.
11. Because upon reviewing the elements of the file, it was established that the links under points g, h, i, and j above, although in the letter under reference G/EIS/1676/07-03-2023 they were included in category A (as above four links 1-18), i.e., that they do not display content or display content, in which the complainant’s name is not included, and the company would proceed to delete them from the results list, subsequently, it adds these to the last nine (9) links, as their publishers reinstituted their content, the deletion of which as results from the search engine the company denies.
12. Because from the search conducted by the Authority on 04-05-2023 and 26-06-2023 in the Google search engine with the criteria of the names "A," "B," "C," and "D," based on all the links in the complaint under examination, the content of which refers to the involvement of the complainant, as ..., in ... offenses, the following ten (10) links emerged:
1. ...
2. ...
3. ...
4. ...
5. ...
6. ...
7. ...
8. ...
9. ...
10. ...
13. A data subject, although not a public figure, may be considered, due to their professional activity, to hold some role in public life, as this criterion is broader than that of a "public figure," and this category typically includes also executives of organizations that play a significant role in the business life of the country, in the sense that there is public interest in seeking information about their activities. Indicatively, politicians, high-ranking public officials, businessmen, and those exercising legally protected (regulated) professions are generally regarded as holding a role in public life. However, in this case under consideration, the complainant is not "...," as referenced in the publications being examined, i.e., ..., holding ..., who either exercises executive duties or delegates the management to other executives, according to the definition of the term, but .... Consequently, there is no indication of public interest specifically for his person.
14. In addition to the finding that the complainant is not a public figure, the relevant links contain publications from the years ... and ..., with the exception of the link under point 10 above (see paragraph 12) which concerns a publication from the year .... These publications refer to the alleged involvement of the complainant in ..., however, from the elements of the file, this is not confirmed, while a time period of at least ... years has passed which renders the relevant information outdated and no longer current.
15. The information contained in the links under examination cannot be characterized as information that is of current public interest, according to the above. After weighing between the right of public awareness and the protection of personal data, it follows that in this particular case, the right to protect personal data outweighs the right to public awareness in light of the Authority’s aforementioned findings.
16. Based on the above, the Authority considers that the request of the complainant to the company Google LLC, as data controller, for the deletion of the links from the results list in the Google search engine that appear based on the search criterion of the complainant’s name and have the content referred to above in paragraphs 12-15 must be accepted, and therefore unanimously decides that the respondent, as the data controller, should be ordered as stated in the operative part to delete the links numbered 1 to 10, which are referred to in paragraph 12, and to confirm that they do not appear as results in the Google search engine with the search criterion of the complainant’s name and that the other links with the same content referred to in the complaint under examination are similarly deleted from the search results.
FOR THESE REASONS
The Authority:
Orders, in application of the provision of Article 58 par. 2 (c) of Regulation (EU) 2016/679, the company Google LLC, as the data controller, a. to immediately proceed with the removal-deletion of the links referred to above in paragraph 12 as results with the search criterion of the complainant’s name in the Google search engine and b. to confirm that no other links with the same content referred to in the complaint under examination result from the Google search engine with the search criterion of the complainant’s name, and in the contrary case to delete these as well from the search results.
The President
Konstantinos Menoudakos
The Secretary
Irini Papageorgopoulou
