Difference between revisions of "APD/GBA - 37/2020"
(Added case comments)
|(One intermediate revision by the same user not shown)|
|Line 7:||Line 7:|
|Line 48:||Line 48:|
DPA fined Google Belgium for failing to respect a citizen's right to be forgotten, after Google refused its request to delist obsolete articles that were damaging to its reputation.
Latest revision as of 19:10, 11 November 2020
|APD/GBA - 37/2020|
|Relevant Law:||Article 17 GDPR|
|National Case Number/Name:||37/2020|
|European Case Law Identifier:||n/a|
|Original Source:||APD (in FR)|
The Belgian DPA (APD/GBA) fined Google Belgium €600000 for failing to respect a citizen's right to be forgotten, after Google refused its request to delist obsolete articles that were damaging to its reputation.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant, who plays a role in public life in Belgium, applied to Google Belgium for the deletion of search results linked to his name on the search engine (so-called "de-listed"). Part of the pages that he wanted to be de-listed suggested his political preferences, which he refutes. A second part relates to a complaint of harassment against the complainant, which was dismissed several years before. Google has decided not to de-list any of the pages in question.
Dispute[edit | edit source]
- Competence of the Belgian DPA over Google BE
- Who is the controller, the main establishment (Google Ire, or Google LLC ?) , and what is the role of Google BE ? Can The DPA impose a fine against Google BE ?
- Delisting of the two categories of results (see here under)
Holding[edit | edit source]
I. On the Competence
In that case, Google argued that the complaint cannot be founded because it is brought against Google Belgium,whereas the controller is not Google's Belgian subsidiary, but Google LLC, based in California.
The Litigation Chamber did not follow this argument. In its view, the activities of Google Belgium and Google LLC are inextricably linked and, consequently, the Belgian subsidiary may be held liable.
This is crucial to ensure full and effective protection of the GDPR, as it is difficult for a DPA in Europe to exercise effective control and impose sanctions on a company located in the United States.
On the other hand, the Litigation Chamber followed Google's argument that its principal place of business in Europe (Google Ireland) is not responsible for the delisting.
Regarding the pages concerning the political preferences of the complainant, the Litigation Chamber of the BE DPA considered that, given the complainant's role in public life, the maintenance of such listing was necessary in the public interest and thus ruled in Google's favour.
II. On the delisting
Regarding the pages concerning the complaint against the complainant, the BE DPA believes that the request for delisting is well-founded and that Google demonstrated a serious breach by refusing it. Since the facts have not been established, are old, and are likely to have serious repercussions for the complainant, the rights and interests of the person concerned must prevail. According to the Litigation Chamber, Google was particularly negligent, given that the company had evidence that the facts were irrelevant and outdated. The DPA imposed a fine of 600 000 euros on Google.
Comment[edit | edit source]
Certain in-depth case commentaries have been published on the subject:
- What does the new Google decision by the Belgian DPA mean for other organisations? (15 July 2020)
- Belgian DPA imposes EUR 600,000 fine on Google for failure to comply with RTBF (15 July 2020)
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/49 Litigation Chamber Substantive Decision 37/2020 of 14 July 2020 File No.: DOS-2019-03780 Subject: X c/ Google (dereferencing) The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, Chairman, and Messrs Yves Poullet and Christophe Boeraeve, members ; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the free movement of data). Data Protection), hereinafter DPMR ; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter LCA ; Having regard to the internal rules of procedure as approved by the House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; Having regard to the documents in the file; has taken the following decision concerning: - the complainant "X", represented by Me Carine DOUTRELEPONT; - the controller: Google Belgium SA, Chaussée d'Etterbeek 180, 1040 Brussels, represented by Me Louis-Dorsan JOLLY and Me Gerrit VANDENDRIESSCHE. Decision on the merits 37/2020 - 2/49 1. Facts and retroacts of the proceedings 1. The complainant, a Belgian resident, lodged a complaint signed on 12 August 2019, against Google Belgium SA, a company incorporated under Belgian law, concerning the deregistration of a series of contents numbered from 1 to 12 and whose twelve URLs are listed in the complaint. This complaint was declared admissible on 14 August. 2019 by the Front Line Service. 2. 2. In essence, the complainant complains that "Google" has refused to grant his requests to dereferencing sent via online forms requesting deletion of information personal. Whereas, according to him, a search based on his first and last name results in the referencing of content that is detrimental to its honour and reputation in the written press Belgian. 3. More specifically, two categories of content in Google's indexes are criticized. This is on the one hand, content that portrays the complainant "as a person labeled party Y" (a political party Belgium), whereas this would involve processing special categories of personal data in the Belgian meaning of Article 9 of the GDR not covered by the exceptions provided for in the GDR and, moreover, inaccurate. 4. And, secondly, content referring to information suggesting that the complainant was the subject of a harassment complaint, which would have been found not to be substantiated. founded in 2010 by the body in charge of examining this complaint, ARISTA1 and that as a result, the information concerned is no longer up to date. 5. As to the first category of content, content 1 to 8, Google replied: that it cannot access content #22 (Google therefore requests that a screenshot of the content be sent to you). of the page in question so that the application can be examined in more detail); that the content No. 7 has been deleted or that the page is not displayed; and that it decides not to block the contents Nos. 1, 3, 4, 5 and 83, as well as content No. 64. 1 SPMT-ARISTA is an external service for prevention and protection at work, which since 1 January 2020 has become cohezio (see https://www.cohezio.be/fr, last accessed 20 February 2020). 2 Google therefore requests a screenshot of the full content of the page in question in order to examine the application in more detail. 3 For this reason: "after consideration of the balance of interests and rights associated with the content in question, including any factors such as its relevance to your professional life, Google has decided not to block them. ». 4 For this reason: "after consideration of the balance between the interests and rights associated with the content in question, including any factors such as the apparent relevance of the latter, Google has decided not to block it". Decision on the merits 37/2020 - 3/49 6. As for the second category of content, content nos. 9 to 12, Google is also said to have decided not to block them5. 7. On 30 August 2019, the Litigation Chamber decided under article 95, paragraph 1, 1° and section 98 of the CAA that the complaint could be dealt with on the merits. The parties were invited to conclude. Google's submissions were received on 30 September 2019. On 15 October 2019, the the Registry of the Litigation Chamber, in the absence of any clarification in the LCA, the possibility of intervening in the case of Google Ireland Ltd and Google LLC. It was replied on 21 October 2019 that, without prejudice to the decision that will be taken on this matter by At the Litigation Chamber, the plaintiff was invited to introduce his request in his conclusions, which was which will also allow the opposing party to position itself against him. On the same day, the complainant submitted its findings in response, without requesting the intervention of other parties. On 12 November 2019, Google released its summary findings. 8. On several occasions and most recently in a letter dated 21 November 2019, Google has asked to be I hear you. The parties were invited by the Litigation Chamber to be heard. In accordance with under article 93 of the LCA, the Litigation Chamber may hear the parties concerned. On this basis and in view of the submissions exchanged by the parties, it also offered Google LLC the opportunity to Participate in the proposed hearing in order to make any submissions. One hearing was organised on 6 May 2020 in the presence of Google Belgium SA and the complainant represented by a lawyer. replacing Me Carine DOUTRELEPONT. Google LLC did not respond to the invitation that was sent to it. sent and at the hearing. Google Belgium SA, when questioned on this point, explained that this invitation had indeed reached Google LLC but that nothing was manually signed in California. due to the outbreak caused by the Covid-19 Coronavirus. However, the Litigation Chamber wrote by paper mail to Google LLC, and Google LLC responds in the same manner as the one by which she's in demand. The e-mail address of the Litigation Chamber was, however, known to Google, which could have used it to answer him. Because of the above-mentioned epidemic, the hearing was held in distance, by videoconference. 9. Minutes of the hearing were provided to the parties on May 11, 2020. On May 13, the complainant informed the Litigation Chamber that he has no observations. On 22 May 2020, Google Belgium SA communicated its remarks on the minutes of the hearing of 6 May in the form of a track changes'. 10. On 4 June 2020, the Litigation Chamber sent an e-mail to Google Belgium SA, informing it that it had received the following information the amount of the fine envisaged against it and the reasons for the infringements 5 For the following reason: "after consideration of the balance of interests and rights associated with the content in question, including factors such as your role in public life, Google has decided not to block it". Decision on the merits 37/2020 - 4/49 recorded in the DMPP justify the said amount. Google Belgium SA was invited, by the same e-mail, to put forward its defences to the proposed amount of the fine. The Litigation Chamber received such means by e-mail on June 24. 11. On 9 June 2020, the Litigation Chamber introduced an informal notification of mutual assistance voluntary under Article 61 of the RGPD in the system of cooperation between supervisory authorities, asking for a reaction within two weeks. The Spanish, Portuguese, Hungarian authorities.., Slovak, German (Hamburg, as well as Baden-Württemberg), French, Italian and Irish have submitted comments within this time limit. 2. Structure of the decision 12. By the present decision, the Litigation Chamber addresses the issue of dereferral of the case from the by an Internet search engine, of content following searches relating to an natural person. This question is the subject of case law of the Court of Justice of the European Union. The European Court of Justice (hereinafter CJEU) is well known, in particular in the Google Spain6 judgments, Google/CNIL7 and GC et al./CNIL8. The Belgian Court of Cassation also ruled on the dereferencing and the right to oblivion.9 13. For the Litigation Chamber, this is an opportunity to adopt a decision of principle and to decide a few fundamental aspects related to dereferral, based on the case law of the CJEU on the matter, or on other points relating to the determination of its competence to act (in particular the ECJ ruling Wirtschaftsakademie10 ). 14. Firstly, the Litigation Chamber analyses the competence of the Authority for the Protection of Human Rights and Fundamental Freedoms (the Data (ODA) in the case submitted under Article 55(1) and Recital 122 of the GDR. To this end, the Litigation Chamber demonstrates that the case in question does not need to be submitted under Article 55(1) and Recital 122 of the GDR. The "single window" mechanism of the DP Regs (Section 3 infra). 6 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González 7 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL). 8 CJEU, 24 September 2019, C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL). 9 See, in particular, Cass. 29 April 2016. 10 CJEU, 5 June 2018, C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie. Schleswig-Holstein GmbH. Decision on the merits 37/2020 - 5/49 15. Second, having concluded that such jurisdiction exists, the Chamber turns to the concept of "jurisdiction". as controller within the meaning of Article 4(7) of the DPMR, with the purpose of deciding whether Google Belgium SA - the defendant in this case - can be held responsible for the processing and/or having its activities inextricably linked with those of the controller (Google LLC), and whether the ODA can exercise its jurisdiction over Google Belgium (Section 4 infra). 16. Thirdly, it determines the territorial application of the de-referral, with a view to the judgment of the Court of First Instance in the Google/CNIL. (Section 5 infra). 17. Fourthly, the Litigation Chamber is considering applications for de-listing from the List of Counsel. submitted by the complainant, which relate to the political labelling and harassment complaint (Section 6, infra). 18. Fifthly, the Litigation Chamber considers that certain facts that have been brought before it by the knowledge in the present case constitute a breach of the GDGR (Section 7 infra), and details the related corrective actions. 3. Jurisdiction of ODA and the inapplicability of the "single window" mechanism 19. The competence of ODA is defined and framed in Chapter VI of the DPR. 20. In accordance with Article 55(1) of the DPR, a supervisory authority is competent to exercise its powers of control. tasks and powers in the territory of the Member State to which it belongs. Recital 122 provides that this should cover - inter alia - the processing of data in the context of activities carried out by an establishment of the controller in that territory, as well as a processing operation affecting persons concerned in that territory. 21. Territorial jurisdiction is a major principle of the RGPD, which should be read in conjunction with Article 3, 1, on the territorial application of the GDGR. The territorial competence of the authority is a rule of the the principle in public international law that a State has the power to determine its own jurisdiction. to impose the law on its own territory. This principle of the RGPD should be read in conjunction with the objective (ratio legis) of the Regulations to ensure effective and comprehensive protection of fundamental human rights Decision on the merits 37/2020 - 6/49 concerned. Territorial jurisdiction may include the activities of a local subsidiary of an enterprise established in a third State11. 22. Territorial jurisdiction shall also apply where the processing is carried out by a third State. controller not established on the territory of the European Union, as provided for, and in accordance with the conditions of Article 3(2) of the GDMP. This is confirmed by the European Committee for Data Protection (EDPB)12. 23. On the other hand, an exception to this founding principle of the DPMR is provided for in Article 56(1), read in conjunction with Article 56(2), read in conjunction with Article 56(3), read in conjunction with Article 56(4), read in conjunction with Article 56(5), read in conjunction with Article 56(6), read in conjunction with Article 56(7), read in conjunction with Article 56(8). in conjunction with Article 60, on the cooperation of the lead authority and the authorities of (the "Single Window"). In a cross-border processing situation in the European Union, the lead authority guides the cooperation. The scope of this The exception is limited to situations of "cross-border processing", as defined in Article 4(23) of the DPMR, i.e. a processing operation that is carried out in several establishments in the European Union of a controller, or a processing operation that significantly affects data subjects in several Member States (or is likely to affect them). In the present case, the complaint is brought against Google Belgium SA, a subsidiary of Google LLC (USA). That Belgian establishment, a corporate law subsidiary, of Google is the defendant. However, Google Belgium SA defends the position that only Google LLC (USA) is the data controller. 24. The Litigation Chamber points out that even if Google LLC and not Google Belgium is the data controller, the SA would be the data controller (hypothesis not followed by the Litigation Chamber13 ), ODA would be competent to deal with the complaint of a Belgian national. The processing of data at personal nature in the context of an establishment of an external data controller of the European Economic Area is not covered by Articles 56.1 and 60 of the GDR. The company "Google" based in the United States does have a main office in the European Union: in Ireland, more precisely via the company Google Ireland Ltd. In the event that the processing in The work involved in the present case would be carried out as part of the activities of that principal place of business, this processing would fall within the scope of Article 56(1) of the RGPD and the system of One-stop shop" cooperation, with the Irish authority as lead authority. 25. 25. At the hearing, the division of responsibilities within the Google group of companies made it clear that the part of the debate, as provided for in the letter of invitation sent by the House Litigious. In that letter, the House had clearly expressed its desire to be informed of the 11 THE EU GENERAL DATA PROTECTION REGULATION (GDPR), A Commentary, Edited by Kuner, Bygrave and Docksey, OUP 2020, pp. 903, 906-908. See also the Google Spain judgment, paragraphs 34 and 53. 12 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) - for public consultation, adopted on 12 November. 2019 available at www.edpb.europa.eu. 13 Infra, No. 32-53 Decision on the merits 37/2020 - 7/49 roles and responsibilities of the Google group of companies, including the existence of an possible principal place of business (within the meaning of Article 4 (16) of the GDPR)14. 26. Google Belgium SA acknowledged that Google Ireland Ltd was Google's principal place of business within the meaning of Article 4(16) of the GDR.14 26. Article 4(16) of the RPMR, i.e. the location of the central administration of Google LLC in the Union European. Although the role of Google Ireland is referred to in these proceedings, the Chamber Litigation considers that the data processing in the case at hand is not carried out in the the activities of Google Ireland Ltd. 27. First, at the hearing, Google Belgium SA argued that the reference to Google Ireland Ltd. was out of contention. According to Google Belgium SA, this reference was not included in the conclusions of the complainant and the debate is between Google Belgium SA and Google LLC: it is therefore not There's no way Google Ireland Ltd. is going to get involved. In the present proceedings, the parties have not exchanged on "Google Ireland or Google BE", the debate takes place between Google Belgium SA and Google LLC. Therefore, for procedural reasons, the Litigation Chamber was not required to rule on this matter. on the role of Google Ireland Ltd. However, the Litigation Chamber reiterates in this respect that it has expressly invited the parties to comment on the existence of a possible principal place of business of the company. Google on the territory of the European Economic Area15 , and that it did appear at the hearing that Google Ireland Ltd. was that establishment. 28. Second, in the context of the pleadings, Google Belgium SA insisted that the activity of Google Ireland Ltd was that establishment. Google Ireland Ltd as data controller concerns a different hypothesis from the one that concerns the indexing activities of the search engine. It concerns the processing of data users", i.e., for example, when a person uses the search engine, their search history can be processed by Google for the adaptation of search results. It This is a processing operation for which Google Ireland Ltd is the data controller. For the Google search engine and the treatments corresponding to the three steps necessary for the operation of the search engine (exploration, indexing, selection of search results) searches) at issue in the proceedings, Google Ireland Ltd is not the data controller. This division of roles is explained by the fact that Google Ireland Ltd acts as an interface with users residing in the EU but not involved in the development and management of the searches, exclusive competence of Google LLC. 14 The invitation letter contained the following passage: "Without prejudice to any arguments they may wish to develop before the Litigation Chamber, all parties are invited, in the context of the present case, to express their views on the activities, roles and responsibilities of Google LLC, Google Belgium SA, and the existence of a possible principal place of business (within the meaning of Article 4(16) of the GDR) of Google in the territory of the European Economic Area". 15 Supra, note 14. Decision on the merits 37/2020 - 8/49 29. Thus, the evidence raised by Google Belgium SA at the hearing, according to which Google Ireland Ltd would be responsible for the processing of users' data when, for example, their search histories are processed to adapt the results communicated to them by the search engine are potentially contradictory with the position defended by Google. Belgium SA that Google LLC is the sole data controller in the context of the operation of the search engine and its three phases, i.e. the exploration phase, the search phase and the search phase. indexing and result selection. 30. 30. Therefore, the data processing (i.e. dereferencing) in the present case is only not carried out as part of the activities of Google Ireland Ltd. In conclusion in the present case, the Irish supervisory authority may not be the lead supervisory authority within the meaning of Articles 56 and 60 of the DP Regs, implying that the "single window" mechanism does not apply and that the competence of the Litigation Chamber can be assessed in the light of the principle of territoriality. enshrined in section 55(1) of the GDR. 31. This conclusion is corroborated by the position taken by Google LLC in a letter to the authority of the Irish control dated 23 June 2020, in which Google LLC explains that it will no longer oppose that a local supervisory authority has local jurisdiction over the treatment of personal data that comes within the sphere of responsibility of Google LLC.16 This statement of position does not mean that the system of cooperation cannot be applied17. 4. As to the controller 32. The purpose of this section is to establish whether Google Belgium SA - the defendant in this case - can be considered as the data controller for the processing of complainant, i.e. the entity that determines the purposes and means, and/or whose activities are inseparably linked with those of the data controller, in this case Google LLC. 33. At this stage, the Litigation Chamber makes a preliminary observation on the territorial application of the RGPD. Section 3 of the EDR covers two distinct scenarios with respect to its applicability territorial : a. the first scenario involves the application of the DPMR to the processing of data at personal nature carried out as part of the activities of a 16 This letter is added to the file by the Litigation Chamber. 17 Infra, No. 89. Decision on the merits 37/2020 - 9/49 data controller within the Union, whether or not the processing operation takes place in the Union (Article 3.1);18 b. the second scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.1);18 b. the second scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.2);19 b. the third scenario concerns the application of the PGRD to processing of personal data in the Union (Article 3.3) (b) the staff of the Commission shall be entitled to receive information on the controller not established in the Union (Article 3(2)). 34. The Chambre Contentieux notes that these two paragraphs must be aligned. Failing that, on the basis of on a purely textual reading, a certain legal vacuum might exist in the circumstances or a processing operation is carried out by a data controller which has an establishment in the Union, and that the processing is not carried out in the framework of the activities of that institution but by a controller established in a third country. 35. In the present case, it is not disputable that the data subject (the complainant) is on the territory of the European Union (in this case, Belgium). Google LLC having various establishments in the Union, Article 3.2 shall not apply. Therefore, the territorial application is triggered by section 3.1 of the EIHWR. Indeed, if none of these provisions are considered to be applicable, the effective and comprehensive protection of the data subjects as required by the Court of Justice of the European Union19 would not be guaranteed. 36. Furthermore, the Litigation Chamber points out that, since the GDR and the case law of the Court of Justice provide for effective and comprehensive protection of persons, the application of Article 3.1 is to be regarded as the main rule, for the sole reason that effective control becomes complex if the processing of personal data is carried out by an establishment in outside the European Union. It is, for example, not obvious for a supervisory authority to to exercise powers of investigation or to take corrective action in respect of such establishment referred to in Article 58 of the GDR in respect of an establishment outside the Union. 4.1 Position of the controller and Google Spain's judgment 37. In essence, Google Belgium SA considers the complaint against it to be unfounded since the only responsible for the processing of personal data related to the search engine service 18 The scope of the DPR is extended to the 3 States of the European Economic Area (EEA), namely Iceland, the Czech Republic, Hungary, Poland, Slovakia and Slovenia. Norway and Liechtenstein by a Decision of the EEA Joint Committee of 6 July 2018, which entered into force on 20 July 2018. This Decision is of no consequence in the present case. However, this Decision refers to the EEA to several opportunities. 19 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Item 58. Decision on the merits 37/2020 - 10/49 Web offered by Google is not Google Belgium SA but the American company Google LLC. It relies in support of its arguments on the judgment in Google Spain 20. 38. In that case, the Court of Justice found that an establishment such as Google Spain satisfied the requirements of the to the criterion laid down in Article 4(1)(a) of Directive 95/46/EC21, Whereas in substance that the activities of the search engine operator (Google Inc. then, now Google LLC) and those of its establishment located in the Member State concerned were therefore inseparably linked that advertising space activities were the means to make the engine of economically profitable research and that this engine was, at the same time, the means of enabling these activities to be carried out22. 39. The Court also held in the same case, as Google Belgium SA argued, that the The "operator of a search engine" is responsible for the processing of personal data. personnel carried out as part of its activity, which is distinct from and in addition to that carried out by the website editors23. 40. The objective of this case law is to "ensure, by a broad definition of the notion of 'responsible "effective and comprehensive protection of the persons concerned "24. According to Google Belgium SA, this The decision would imply that Google LLC would be the sole data controller. This position does not convince not. The Court of Justice did not clearly distinguish between the responsibilities of the American company and its European establishment, but - on the contrary - stressed that the activities of both entities were inseparable. Even assuming that such a theoretical distinction of the responsibilities of the and the subsidiary company would be valid, the challenge against Google Belgium SA would remain valid. the need for effective and efficient protection of the rights of the child, precisely because of these inseparable links and the need for effective and efficient protection of the rights of the child. of the people involved. 41. In addition, Google Belgium SA argued at the hearing that the processing is covered by Article 3(1) , of the DPMR, which provides that 'This Regulation shall apply to the processing of personal data relating to the personnel carried out in the framework of the activities of a controller's establishment, or of a processor on the territory of the Union, whether or not the processing takes place within the Union", such that the processing is carried out on the territory of the Union. Court of Justice's case-law can be transposed into it, to which the Court of Justice has held that the 20 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. 21 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data. on the processing of personal data and on the free movement of such data, OJ L281/31 . 22 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, point 56. 23 Ibid, points 32 to 38. 24 Ibid, point 34. Decision on the merits 37/2020 - 11/49 In its Google/CNIL ruling on the scope of dereferrals, the Court of Justice also ruled on the scope of dereferrals. that may be imposed on Google25. 42. The Litigation Chamber points out that this position implies that Google Belgium SA appears to be Admit that the processing operation is carried out in the context of the activities of an establishment of the controller. processing in the European Union, i.e. Google Belgium SA. A further reading of this position would - as ruled in the Google/CNIL judgment - "result in the processing of personal data [...] or exempted from the obligations and guarantees provided for in [the] Act [...]. Directive 95/46 and] by the GDMP". In other words, such a reading would jeopardize the useful effect of the application of the DP Regs. 43. The Litigation Chamber certainly acknowledges that this jurisprudence concerning the application of the principle of the "indissociable link" was drawn up in the context of the application of Directive 95/46/EC whose territoriality provisions are distinct from those of the DPGR. Nevertheless, in Google v. CNIL the Court confirms its willingness to extend its case-law in this area to the GDR. The Chamber Litigator cites the following paragraphs: « 50. Indeed, in such circumstances, the activities of the operator of the research and those of its establishment located in the Union are inseparably linked. related [...]. 51. In these circumstances, the circumstance that this search engine is carried on by an enterprise of a third State may not result in the processing of personal data carried out for the purposes of the operation of the said search engine in the context of advertising activity, and of an establishment of the controller in the territory of a Member State. Member State is exempted from the obligations and guarantees provided for in Directive 95/46 and by Regulation 2016/679 [...]". Furthermore, it is clearly established and recognised that the intention of the authors of the RGPD has been to increase The aim is to make the protection of the persons concerned even more effective and to make it more effective. 4.2 Role of Google's establishments. 44. 44. In its reply, the complainant argues, inter alia, that Google Belgium SA is a 'subsidiary' of Google. a subsidiary of Google LLC. primarily active in digital marketing, headquartered at 25 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), points 48 à 52. Decision on the merits 37/2020 - 12/49 Brussels and its activities are aimed at the inhabitants of Belgium, and that the activities of Google Belgium SA and of Google LLC are inseparable within the meaning of the Google Spain judgment referred to above. 45. Google Belgium SA does not dispute that. It is also not disputed that Google Belgium SA exercises actually and effectively activities in Belgium. 46. During the hearing, Google Belgium SA was questioned about the different roles of the establishments of Google it. The Commission confirmed that it has no role with respect to the data processed in the context of the three phases of the operation of the Google search engine, i.e. its exploration phase, its indexing and its phase of selecting results according to the request made by the user. Google LLC would be solely responsible for the processing in this context. In substance at the hearing, Google Belgium SA explained that it was a subsidiary of Google established in Belgium which was likely to lead to the application of European and Belgian law. Google Belgium SA considers that Google LLC is therefore submitted to the GDMP pursuant to Article 3(1) of the GDMP, and therefore should not designate an representing in accordance with Articles 3, 2 and 27 of the GDR. 47. 47. Google Belgium SA explained that it only offers consultancy services related to the marketing the services of other Google entities on the Belgian market. Requests from referrals are directly and exclusively processed by Google LLC from the online forms introduced by the data subjects without any involvement of Google Belgium SA. The latter explains that when it is approached by data subjects requesting dereferral, it systematically refers them to the online forms that are sent (and addressed) to Google LLC. On the basis of the country and language chosen by the individual the form, Google LLC's front-line service agents are selected to provide the service. to answer the case in question. In cases where the content in question requires an evaluation In more detail, a process of "escalation" is followed and, in this case, it is an a Belgian person established in the United States (who is not an employee of Google Belgium SA) and working for for Google LLC that was accessed. The analyses carried out by this Google employee are on the basis of information from public sources and his good knowledge of the specificities of the company to the country concerned of which he or she is a national. 48. The Litigation Chamber concludes that, on the basis of the foregoing, that in applying the In the present case, the Google Spain judgment, the DPMR is indeed applicable to Google LLC pursuant to Article 3(1)(a) of the EC Treaty, of the RGPD and that the subsidiary Google Belgium SA does indeed constitute an establishment capable of causing the application of the EDR under Article 3(1) of the EDR. The Litigation Chamber invokes in this Decision on the merits 37/2020 - 13/49 context of the Google/CNIL26 judgment in which the Court stressed that it is irrelevant whether the processing has been place or not in the Union. 49. Although it is true that Google Belgium SA does not determine the purposes or means of the processing in the strict sense - these are determined by Google LLC -, Google Belgium SA is a subsidiary of Google LLC and it follows from the position of Google Belgium SA that the activities of this subsidiary trigger the application of section 3.1 of the DP Regs. In other words, the processing in question is carried out in the framework of the activities of Google's establishment in Belgium. Another interpretation would imply the application of Article 3.2 of the RGDP, as well as Google's obligation to appoint a representative in the European Union under Article 27 of the GDR. This is not provided for by Google and is not not necessary either in view of the role of Google Belgium SA. 50. The Litigation Chamber emphasises that this interpretation is corroborated by the Google Spain judgment, although the situation is not identical. In that judgment, the Court held - under the Directive 95/46 - "that processing of personal data is carried out in the framework of the activities of an establishment of the controller in the territory of a Member State, on the territory of a Member State, at meaning of that provision, where the operator of a search engine creates in a Member State a branch or subsidiary for the promotion and sale of advertising space proposed by that engine and whose activity is aimed at the inhabitants of that Member State. »27 51. Moreover, its activities are inextricably linked to those of Google LLC, its subsidiary in Belgium, in light of the role it plays and describes, may be treated in the same manner as a data processing carried out within the framework of the operation of the Google search engine and the management of delisting requests in Belgium. 52. In short, the Litigation Chamber considers that Google Belgium SA should be treated in the same way as Google Belgium SA. so that a controller on the basis of the elements of the case file and the case law Google Spain from the Court of Justice of the European Union. 53. 53. In any event, even if Google Belgium SA could not be considered to be a 'competitor', it would still be a 'competitor'. responsible for the processing, the Litigation Chamber would remain competent with respect to Google. Belgium SA due to the presence of this entity on Belgian territory, such as the following elements demonstrate this. 26 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), point 48. 27 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, point 60. Decision on the merits 37/2020 - 14/49 4.3 ODA's jurisdiction over Google Belgium 54. Account should now be taken of the judgment of the Court of Justice in the Wirtschaftsakademie case, delivered on 5 July 2001. June 201828 concerning Directive 95/46, which gives a supervisory authority the power to to exercise its powers with respect to an establishment of the controller even if that institution is not a joint controller. Further developments will demonstrate that it is appropriate to extend the application of this case law to the case at hand29. 55. In the Wirtschaftsakademie case, the Court held that the German supervisory authority was a "supervisory authority". for the purpose of ensuring compliance on German territory with the rules on the protection of the environment and the of personal data, to implement, with regard to Facebook Germany, all the the powers it enjoys under the national provisions transposing Article 28(2) of the Treaty, and 3 of Directive 95/46 (recitals 50 et seq.). However, in the same case, the Court also had clearly held that "Facebook Inc. and, in the case of the Union, Facebook Ireland should be looked at as the main determinant of the purposes and means of the processing of personal data, and staff of Facebook users as well as people who have visited the hosted Fan Pages on Facebook, and thus fall within the notion of 'controller' within the meaning of Article 2(2)(a) of the Regulation. (d) of Directive 95/46 '30 (italics added by the Chambre Contentieuse). In other words, Facebook Germany was not responsible (or jointly responsible) for the disputed data processing. 56. The Court of Justice recognised that competence to the German supervisory authority following the verification of satisfaction of the two conditions laid down in Article 4(1)(a) of Directive 95/46 : "for the purpose of determining whether a supervisory authority is well founded, in circumstances such as those in the main proceedings, to be carried on in respect of an establishment situated in the territory of the Member State the powers conferred on it by national law, it is necessary to verify whether the two conditions laid down by Article 4(1)(a) of Directive 9/46 are satisfied, namely, on the one hand, whether it is an 'establishment of the controller', within the meaning of this Regulation. and, on the other hand, if such processing is carried out 'in the course of the activities' of that establishment, within the meaning of the same provision "31. 57. As to the first condition, the Court found it to be met by considering that it was "constant that Facebook Inc. as controller of personal data, 28 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH. 29 Infra, no. 64 et seq. 30 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH. Wirtschaftsakademie Schleswig-Holstein GmbH, paragraph 30. 31 Ibid, paragraph 53. Decision on the merits 37/2020 - 15/49 together with Facebook Ireland, has a permanent establishment in Germany, namely Facebook Germany, located in Hamburg, and that the latter company actually operates and activities in that Member State "32. 58. Mutatis mutandis, this is also the case of Google Belgium SA33 , which actually carries out and activities in Belgium. 59. As to the second condition, in order to ensure effective and comprehensive protection of persons with concerned and applying the Google Spain case-law referred to above, the Court of Justice has considered that the activities of Facebook's establishment in Germany were inseparably linked to those of the joint data controllers Facebook Inc. and Facebook Ireland34. 60. Mutatis mutandis, this is also still the case for Google Belgium SA, as this one has also confirmed, since it does not refute the complainant's argument on this point35. 61. On these bases, the Court concluded in the Wirtschaftsakademie case that German law was applicable pursuant to Article 4(1)(a) of Directive 95/46, and that the authority of the German supervisory authority was competent, in accordance with Article 28(1) of that Directive, to carry out the checks required by Article 28(1). to apply German law to the processing, and that it therefore had all the powers available to it under its national law transposing Article 28(3) of Directive No. 95/46 with regard to the German establishment of Facebook36. 62. The Court further held that "the circumstance ... that decision-making strategies regarding the to the collection and processing of personal data relating to persons residing on the territory of the Union are taken by a parent company established in a third country, such as, in In this case, Facebook Inc. is not such as to call into question the jurisdiction of the authority of supervision governed by the law of a Member State over an establishment situated in the territory of that Member State. the same State, of the controller of the said data "37. 63. The entry into application of the GDPMR does not change the relevance of this case law or even reinforces it, at least in the context of this case. Article 3(1) of the GDR is considered to be a "general rule". 32 Ibid, point 55. 33 Supra, No. 44-47. 34 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 56 to 60. 35 Supra, No 44-47, in particular No 45. 36 CJEU, 5 June 2018, Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 56-60. Wirtschaftsakademie Schleswig-Holstein GmbH, paragraphs 61 and 62. 37 Ibid, paragraph 63. Decision on the merits 37/2020 - 16/49 the successor to Article 4(1)(a) of Directive 95/4638. In the Google v CNIL judgment, those two provisions are also mentioned jointly39. 64. The Litigation Chamber considers that, for the three reasons set out below, it is appropriate, in order to to ensure the effective application of the RGPD, to follow the lessons of the Wirtschaftsakademie judgment in the present case, and that it is therefore competent to exercise its powers against Google Belgium SA on the basis of a complaint lodged against the latter with the Authority. 65. Firstly: the controller is established outside the Economic Area (EEA). European. Mutatis mutandis, and a fortiori with a view to ensuring effective and comprehensive protection of persons concerned in a situation such as the one in question where the legal person that is data controller is not located in the European Economic Area (EEA) (the Google LLC), it is necessary to transpose the case-law of the Court of Justice of the European Communities in the case of Wirtschaftsakademie under the RGPD. The new rules enshrined in the RGPD do not do not call into question the principles established by the Court in that case law: the GDMP standardizes the tasks and powers of the supervisory authorities (see Articles 57 and 58), whose competence remains subject to the principle of territoriality (see Article 55(1) of the GDGR). 66. 66. On the contrary, the DPMR intends to strengthen the effectiveness of data protection rules and to make them more effective. protect the persons concerned as best as possible. However, while the Court has held that even where the person responsible of the processing operation was established in the territory of a Member State, the supervisory authority of another State Member where an institution which is not jointly responsible for the processing operation is located was competent authority for such an establishment, this reasoning applies a fortiori when the person responsible for the treatment is established outside the European Union. 67. Second: the controller should not appoint a representative, since it is established outside the EU. in the territory of the European Economic Area. In view of the roles played by Google Belgium SA40 and Google LLC, the latter being a data controller subject to the DMPP pursuant to the Google LLC was therefore not required to appoint a representative in accordance with Article 27 of the RGPD. Recital No 80 of the GDPMR provides that : "The representative should be expressly designated by a written mandate from the head of the or of the subcontractor to act on its behalf in respect of the obligations that it shall fall within the scope of this Regulation. The appointment of such a representative shall not 38 THE EU GENERAL DATA PROTECTION REGULATION (GDPR), A Commentary, Edited by Kuner, Bygrave and Docksey, OUP 2020, p. 77. 39 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL), point 48. 40 Supra, No. 44-47. Decision on the merits 37/2020 - 17/49 breach of the responsibilities of the controller or processor under the this Regulation. This representative should carry out his/her tasks in accordance with the mandate received from the controller or the processor, including cooperation with the authorities competent control authorities in respect of any action taken to ensure compliance with the provisions of this Directive. of this Regulation. The designated representative should be subject to coercive procedures in the event of non-compliance with these rules by the controller or sub-contractor". 68. Article 27(4) of the DPMR provides that the "representative shall be mandated by the controller or the processor". processing or the processor to be the person to whom, in particular, the supervisory authorities and the data subjects must contact, in addition to or instead of the data controller or the processor, in all matters relating to the processing, for the purposes of ensuring compliance with this Regulation. regulation". 69. If the European legislator did not consider it useful, when adopting Article 3(1) of the GDPMR, to oblige a data controller in a situation such as that of Google LLC at issue in the judgment Google Spain to appoint a representative,41 is that it considered that the presence of an establishment of the controller in the territory of the Union within the meaning of Article 3(1) of the PGRD should have a sufficient territorial link with the territory of the European Union in order to ensure a proper application of the DMPR: it is implicit but certain that an establishment within the meaning of this provision does not may be less responsible for the applicability of the DP Regs than a section 27 representative. of the RGPD. 70. On the contrary, the Wirtschaftsakademie case law can be seen in this logic: in For the effective application of the DPMR in respect of the person concerned, it is appropriate to apply this case-law also to the establishment of a controller located in the territory of the Union such as Google Belgium SA, when the manager, subject to the PMPR pursuant to Article 3, 1. of the GDR, did not have to designate a representative within the meaning of Article 27 of the GDR. Not allowing the supervisory authorities to disregard the legal, social and functional division of a controller established outside the European Economic Area, where its However, an establishment on this territory carries on an activity that is inseparably linked to its own, would unduly restrict the territorial jurisdiction of these authorities by systematically obliging them to have to exercise jurisdiction extraterritorially, despite the existence of such a connection which constitutes at the same time a strong territorial connection. In such a situation, the recourse necessary for the exercise of extraterritorial jurisdiction, taking also into account its limits legal, procedural and practical aspects, would be such as to directly undermine the useful effect of the 41 Judgment that could not be ignored in the process of adoption of the RGPD: the judgment dates from 13 May 2014 and the RGPD has been adopted. almost two years later, on April 27, 2016. Decision on the merits 37/2020 - 18/49 RPGD. One might ask how the regulator would be in the exercise of the powers conferred on it on the basis of Articles 58 and 83 RGPD, in such a way that it is able to efficient and effective. 71. Thirdly: Google as a multinational entity does not allow the identification of the clearly the controller. The two previous arguments are reinforced by the makes the communications of Google LLC and Google Belgium SA, vis-à-vis the persons concerned, lack clarity as regards the identification of the controller. It is therefore all the more necessary to transpose the Wirtschaftsakademie case-law to the present case, with a view to to ensure the usefulness of the DP Regs. 72. Google Belgium SA notes, in its summary conclusions, inter alia, that the complainant 'has addressed its initial delisting request to Google LLC (Exhibits B.1 and B.2), through the form standard made available by the latter (Exhibit A.3)". He did not contact Google Belgium. SA. The data deletion request form in French is indeed referenced, to a certain extent, to the company Google LLC: reference is made to Google LLC concerning the use of the information provided with a view to identifying the data subject, also concerning the use of the information provided via the form, and the "copyright" also makes reference to Google LLC. 73. 73. However, the introduction of the form simply refers to "Google" as does the latest check mark states "I understand that Google will not be able to process my request. […] ». On this first reference (in the introduction of the form), Google Belgium SA explained that at the hearing that the objective was to be the least "pompous" towards users and that the references to Google LLC were made explicit in important legal passages of the form. 74. 74. Google's French-language responses also refer to "Google" and "Google LLC. "The Google Team". 75. As regards the possibilities to challenge Google's decision on the requests for dereferencing, the response form is limited to specifying the following: "If you are not agree with our decision, you have the right to submit your problem to the authority responsible for data protection in your country. In this case, we advise you to include the number of the reference of your application [...] and a copy of the confirmation that you received after you have sent the application form. If Google is the webmaster of the site, you can try to contact the owner or author of the page and send him/her directly your request to deletion". Decision on the merits 37/2020 - 19/49 76. Neither the form nor Google's (LLC) responses explicitly identify an treatment. On the basis of these elements, the Litigation Chamber considers that the process of dereferencing thus maintains a certain ambiguity, for the persons concerned, as regards the identity of the controller. 77. 77. In that connection, at the hearing, Google Belgium SA expressed its surprise at the fact that the data subjects may still have doubts as to the identification of the controller in case of de-referencing, in the light of the Google Spain judgment already referred to, which identifies Google Int. as solely responsible. It therefore fails to understand that this established case-law still leaves some doubts as to the identity of the person in charge in respect of the persons concerned and their advice. 78. The Litigation Chamber considers on this point that this would in no way relieve the person responsible for the processing of its obligation to inform the data subject in accordance with Articles 12(1) and 12(2). of the DPMR, in a transparent, comprehensible and easily accessible manner, in clear and easily understandable terms and simple, and by facilitating the exercise of his rights by the data subject (on this point, see infra point Nos. 168). Thus, the data controller is obliged to provide precise information, such as provided for in Articles 13 and 14 of the GDGR. 79. 79. In conclusion, this ambiguity regarding the roles and responsibilities of Google LLC and Google Belgium in the SA which may legitimately create doubts on the part of the persons concerned as to the interlocutor responsible for the processing (or not) to which they are addressed, constitutes a third reason for transposing the Wirtschaftsakademie case-law in the present case, of the Litigation Chamber is competent to act on the basis of a complaint lodged with it. by a person concerned against Google Belgium SA alone. 80. Conclusion. On the basis of these elements, the Litigation Chamber decides that the plaintiff could direct his complaint, concerning the dereferencing of contents of the search engine indexes Google, against Google Belgium SA alone. For the Litigation Chamber, it is of little importance that the processing of its data is in fact carried out outside the European Union by employees of Google LLC. Decision on the merits 37/2020 - 20/49 5. Territorial application of dereferencing 81. In the present case, the complainant is requesting a worldwide de-listing on the grounds that he is a senior executive of a large corporation. 82. In the case of a request for dereferral addressed by a data subject to the authority of the centre of its interests, which is the case of the plaintiff in this case, the Chamber Litigation also considers that this authority is best placed to make a ruling. In another area, that of the international jurisdiction of courts and tribunals in civil matters or commercial law, the Court of Justice decided in its judgment of 25 October 2011 eDate Advertising42 : « 48. It is therefore necessary to adapt the connecting criteria set out in point 42 of this report. judgment in the sense that the victim of an infringement of a personality right by means of the Internet may, depending on the place where the damage caused materialises in the Union European Communities by that infringement, a forum for the entirety of that damage. Given that that the impact of online content on a person's personality rights can be best appreciated by the court of the place where the alleged victim has the centre of his or her interests, the conferral of jurisdiction on this court is consistent with the objective of a good administration of justice, recalled in paragraph 40 of this judgment. « 49. The place where a person's centre of interests is generally the place where he or she has his or her habitual residence. However, a person may also have a centre of interest as well. in a Member State in which he or she does not ordinarily reside, in so far as other indications that the exercise of a professional activity may establish the existence of a link particularly close with that State" (emphasis added by the Litigation Chamber). 83. Mutatis mutandis, these considerations are also relevant in the present case. Indeed, in the present case not only is the complainant habitually resident in Belgium, but also in the United Kingdom. Belgium that his professional career is unfolding43. It is therefore the Data Protection Authority which is best placed to assess the impact on its rights as a result of the content put online. 42 CJEU, 25 October 2011, C-509/09 and C-161/10, eDate Advertising GmbH and Others v X and MGN LIMITED. The judgment was pursuant to Council Regulation (EC) No 44/2001 of 22 December 2000 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters. recognition and enforcement of judgments in civil and commercial matters, now replaced by Regulation (EU) No ° 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction, recognition and enforcement of judgments of the Court of Justice of the European Communities and the enforcement of decisions in civil and commercial matters (without affecting this reasoning). 43 Infra, No 100-108. Decision on the merits 37/2020 - 21/49 84. With respect to the complainant's request for a worldwide de-listing on the ground that he is a senior executive of a large company, the Litigation Chamber first considers that it does not demonstrate to the aid evidence that it is also affected in its interests in (the territory of) other States members or third countries (which does not exclude that its interests in Belgium may be affected). from these territories). 85. 85. Furthermore, in Google v. CNIL, the Court held that Article 17 of the GDR (on which it bases the right of access to information in the context of the to dereferencing) cannot have the scope to impose on Google a worldwide dereferencing for all versions of its search engine. In addition to this, it should be noted that in national law nor the law of 3 December 2017 establishing the Data Protection Authority (see its in particular Article 4), nor the Law of 30 July 2018 on the protection of natural persons with disabilities. with regard to the processing of personal data, which define the scope of competence of the Litigation Chamber, do not give the Chamber the power to order a global dereferencing. The Litigation Chamber cannot therefore grant the request of the complainant of a worldwide deregistration. 86. 86. Next, the Litigation Chamber examines the arguments in favour of a European scope for the dereferencing. The Court has - in the Google/CNIL judgment cited above - established the following: « 67. It is important to note, however, that the public interest in access to a piece of information may, even within the Union, vary from one Member State to another, so that the result of the balance to be struck between the latter on the one hand, and the rights to privacy on the other hand and the protection of the personal data of the data subject, on the other hand, is not necessarily the same for all Member States, especially since, under the terms of Under Article 9 of Directive 95/46 and Article 85 of Regulation 2016/679, it is for the Member States to members to provide, in particular for salaries solely for the purposes of journalism or of artistic or literary expression, exemptions and derogations necessary for reconciling these rights with, in particular, freedom of information. 68. 68. It follows in particular from Articles 56 and 60 of Regulation 2016/679 that, for the cross-border processing within the meaning of, and subject to, Article 4(23) of the Regulation, and subject to that Article 56(2), the different national supervisory authorities concerned shall cooperate, in accordance with the procedure laid down in those provisions, in order to reach a consensus, and to a single decision binding on all these authorities and whose controller must ensure compliance with respect to processing activities carried out in the context of all its establishments in the Union. In addition, Article 61(1) of the Regulation 2016/679 obliges the supervisory authorities, in particular, to provide each other with relevant information. and to provide each other with mutual assistance in implementing and applying this Regulation Decision on the merits 37/2020 - 22/49 in a consistent manner throughout the Union and Article 63 of that Regulation states that it is to this end, the consistency checking mechanism set out in Articles 64 and 64a of the Treaty is provided for. 65 of the same regulation. Finally, the urgency procedure provided for in Article 66 of the Regulation 2016/679 allows, in exceptional circumstances, where a supervisory authority The Committee considers that there is an urgent need for action to protect the rights and freedoms of the persons concerned, to adopt immediate interim measures to produce legal effects on its own territory and having a specified period of validity which does not exceed three months. 69. This regulatory framework thus provides national supervisory authorities with the tools to ensure that the and the mechanisms needed to reconcile the rights to privacy and the protection of the data subject's personal data with the interest of the public at large in the Member States to access the information in question and thus to be able to adopt, if necessary, a deregistration decision covering all the searches made on the basis of that person's name from the territory of the Union". (emphasis added by the Litigation Chamber). 87. This extract from the case-law of the Court of Justice emphasises that consultation of other authorities The aim of the control system is also to be able to take account of the public interest in other areas of the economy. Member States to have access to the information, if a decision on delisting is being considered for all the European domain names of the Google website (google.be ; google.fr ; google.de ; etc.) and European residents. Indeed in the opposite case of a more limited dereferencing, by example to the Belgian top level domain name (.be) from Google and to a geoblocking of the users resident in Belgium, the public in other Member States would not suffer any harm to its opportunities to access information44. 88. To this end, two opportunities for international cooperation are opened by the GDMPR: either the mandatory cooperation under Articles 56, 1. and 60 (competence of a lead authority) and one-stop shop) of the GDMP, i.e. voluntary cooperation on the basis of Article 61 of the GDMP, which allows you to limit yourself to communicating useful information. 89. Since the Litigation Chamber considered that the one-stop shop mechanism was not case,45 it is therefore incumbent upon the Litigation Chamber, if it intends to apply the pronounce a dereferencing for all (or several) of the domain names of the Google website 44 There are, of course, intermediate hypotheses in which, for example, cooperation with only two authorities could be sufficient, for example, if it were to order deregistration for two other extensions Google's national .fr and .lu domains, combined with a geoblocking of residents of these two countries, in which case they should only be consulted than the authorities of the latter. 45 Supra, No. 19-31. Decision on the merits 37/2020 - 23/49 reflecting the country codes of the European Economic Area, combined with a geoblocking of the entire of European resident users (or parts thereof), to consult (all or part of, depending on) its homologues on the basis of Article 61 of the GDR. Finally, as a follow-up to the Google/CNIL judgment and in particularly in its paragraph 69, the Litigation Chamber has consulted informally with the other parties to the European supervisory authorities pursuant to Article 61 of the RGPD, to ensure that the referrals do not disproportionately infringe freedom of information Internet users in other Member States. As a result of this consultation, it emerged that follows: with the exception of one supervisory authority in Germany (Hamburg), the supervisory authorities which have reacted have supported the intentions of the Litigation Chamber, including on dereferral. for the entire European Economic Area. 90. The Litigation Chamber considers that a dereferral can only be effective if it applies to searches carried out from outside Belgium. In the European area without borders internal, it would not be useful to order a limited dereferencing of searches conducted from within the of Belgian territory. 91. With regard to the geographical scope of the dereferral, the Litigation Chamber considers - in accordance with the Google/CNIL judgment - to be deregistered with effect throughout the Union (and the countries of the European Economic Area). On the one hand, the Chamber considers that searches from outside Belgium (on the spot or by using a proxy server in Belgium). to access the other versions of the search engine) may have a serious impact on the data protection rights of the complainant. Indeed, it is perfectly conceivable that in the in the course of his private or professional life, the complainant has contacts with other European countries (from Belgium's neighbouring countries, for example) and that as a result, people are seeking to find out about about the complainant via other versions of the Google search engine than the Belgian version (.be). In this context, a dereferencing limited to Belgium would not be effective enough. Decision on the substance 37/2020 - 24/49 6. On applications for deregistration 92. The complainant's requests to Google for de-listing at the The criteria and rules laid down by the Court of Justice in its above-mentioned Google Spain judgment, of the guidelines of the Working Group on Article 29 relating to this judgment,46 hereinafter "the guidelines". Group 29 guidelines", as well as in the GC et al. v. CNIL judgment of 24 September 201947 and the "Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases "48 in the European Data Protection Committee (hereinafter the "EDPS Guidelines"), in order to ensure that a fair balance between the human rights concerned and the freedom of expression of Internet users as well as their right to information. 93. It should be noted as a preliminary point that if an invasion of privacy caused by a referencing can be multiplied tenfold because of the unavoidable role of search engines in access to information via the Internet, in the same way and for the same reason, de-referencing may have an impact on the freedom of information of internet users. 94. In its GC et al. v. CNIL judgment, the Court of Justice states the following: "66 In any event, the operator of a search engine, when seized with a request for dereferral, must verify, as part of the significant public interest grounds referred to in Article 8(4) of Directive 95/46 or in Article 9(2)(g) of Directive 95/46. Regulation 2016/679 and in compliance with the conditions laid down in those provisions, if the inclusion of the link to the web page in question in the list displayed after a search has been carried out from the name of the data subject is necessary for the exercise of the right to liberty information for Internet users potentially interested in accessing this web page at the through such research, protected by section 11 of the Charter. If human rights protected by Articles 7 and 8 of the Charter shall, as a general rule, prevail over the information for Internet users, this balance may, however, in some cases depend on the nature of the information in question and its sensitivity to the privacy of individuals, the nature of the information in question and its sensitivity to the privacy of the person concerned as well as the public interest in having such information, which may vary, inter alia, according to the role played by that person in public life.... 46 Guidelines on the execution of the judgment of the Court of Justice of the European Union in the 'Google Spain and the United Kingdom' case Inc / Agencia Espanola de proteccion de datos (aepd) and Mario Costeja Gonzalez', C-131/12 , adopted on 26 November 2014 by the Article 29 Working Group. 47 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL). 48 Version 2.0, after consultation, adopted on 7 July 2020, available at www.edpb.europa.eu. Decision on the substance 37/2020 - 25/49 67 In addition, it should be noted that, if the processing operation relates to the categories of particular data referred to in Article 8(1) and (5) of Directive 95/46, or to In Articles 9(1) and 10 of Regulation 2016/679, interference with the duties fundamental to the respect for privacy and the protection of personal data of the person concerned is, as noted in paragraph 44 of this judgment, capable of to be particularly serious because of the sensitivity of these data "49. 95. In the same judgment, concerning information relating to judicial proceedings in respect of a criminal law, the Court held as follows: "It is thus incumbent on the operator of a search engine to assess, in the context of a request for dereferencing of links to web pages on which are published information relating to legal proceedings in criminal matters conducted against the person concerned, which relate to an earlier stage of this procedure and do not are more in line with the current situation, if, taking into account all of the circumstances of the nature and gravity of the infringement in question, the the course and outcome of the said proceedings, the time elapsed, the role played by that person in public life and its behaviour in the past, the public interest at the time of the request, the content and form of the publication, and the implications of the publication for the said person, the latter is entitled to have the information in question removed, at the current stage, linked to its name by a list of results, displayed following a search made from that name". 50 96. Group 29 also explains that : "The general objective of these criteria is to assess whether the information contained in a result are relevant to the public's interest in having access to these information. Relevance is also closely related to the age of the data. Depending on the facts of the case, information published long ago, for example 15 years ago, could be less relevant than information published a year ago. The authorities responsible for data protection will assess its relevance in the light of the parameters specified below. A. Does the data relate to the professional life of the data subject? At the time to consider the application for de-referral, the 49 CJEU, 24 September 2019, C-507/17, Google LLC v Commission nationale de l'informatique et des libertés (CNIL). 50 CJEU, 24 September 2019, C-507/17, Google LLC v Commission Nationale de l'Informatique et des Libertés (CNIL), point 77. Decision on the merits 37/2020 - 26/49 data must first of all make a distinction between private and professional life. The data protection - and, more broadly, legislation on respect for life privacy - aims first and foremost to guarantee the fundamental right of individuals to respect for their lives (and to the protection of their data) "51 . 97. In his complaint, under the complainant's "Party Y labelling" referrals, the complainant provides eight SEOs and URLs numbered from 1 to 8. These are listed in Exhibit 1 of its conclusions. The other contents, numbered from 9 to 12, are under the heading of references linked to a "harassment complaint". These are also set out in Exhibit 1 of its findings. In essence, in support of his claim, the complainant argues that the referenced content is inaccurate and/or obsolete and/or contain sensitive data unlawfully disclosed to the public. It does not challenge the lawfulness of the communication to the public of the content itself to which return referrals. 98. Before analysing the disputed referrals one after the other,52 the Litigation Chamber assesses whether the complainant plays a role in public life53 and whether the referrals contain about him or her special categories of data referred to in section 9 of the MGDR54. 6.1. The complainant's role in public life 99. Among the criteria to be taken into account in the analysis to be carried out,55 the role played by the person concerned in public life appears decisive. In the EDPS guidelines, the EDPS, repeating the Court of Justice, point out the following: "The Court has also held that the rights of the persons concerned will prevail, in the event of a breach of the principle of equal treatment, over the rights of the data subject. s interest in accessing information through the provider of the search engine. However, it has identified several factors that can influence this determination. These include: the nature of the information or its sensitivity, and especially the interest of Internet users in accessing information, which may vary depending on the role played by the person concerned in public life ... "56 . 51 Guidelines on the execution of the judgment of the Court of Justice of the European Union in the 'Google Spain and Inc / Agencia Espanola de proteccion de datos (aepd) and Mario Costeja Gonzalez', C-131/12 , adopted on 26 November 2014 by the Article 29 Working Group, p. 18. 52 Infra, No. 123 et seq. 53 Infra, No. 99-107. 54 Infra, No. 109 et seq. 55 Supra, No. 93. 56 Free translation of point 48 of the English text of the Guidelines. Decision on the merits 37/2020 - 27/49 100. According to Group 29 guidelines (pp. 15-16) : "What is a "role" in public life? It is not possible to establish with certainty the type of role in public life that an natural person must play a role in justifying public access to information on that natural person. person by means of an Internet search. However, as an example, politicians, senior officials, business and professional (regulated) persons can generally be considered to play a role in public life. There are reasons for allowing the public to seek information about the role and activities of these people in public life. In general, it is appropriate to consider whether the fact that the public has access to the specific information about a person by means of a search on the basis of his or her name would prevent it from engaging in inappropriate public or professional conduct. It is equally difficult to define the sub-group of "public persons". In good standing public persons can be said to be persons who, because of the the functions they hold or the commitments they have made, are more or less exposed to the media. Resolution 1165 (1998) of the Parliamentary Assembly of the Council of Europe on the right to the The Privacy Act provides a possible definition of "public persons". It states that "public persons are those who hold public office and/or use of public resources and, more generally, all those that play a role in public life, whether political, economic, artistic, social, sports or other". Some information concerning public persons is of a purely private nature and does not s should not normally be included in search results, such as information about their health or family members. But as a general rule, if the persons making an application are public persons and that the information provided by the applicant is in question do not constitute information of a purely private nature, there will be moreover strong reasons for refusing the dereferencing of search results concerning them. The case law of the European Court of Human Rights (hereinafter the "ECHR") is particularly relevant for assessing the balance of interests" (italics added by the Litigation Chamber). » Decision on the merits 37/2020 - 28/49 101 In this context, both the complainant and Google raise issues that demonstrate that the complainant has played and continues to play a role in public life in Belgium. 102 It should first of all be pointed out that neither the Group 29 guidelines nor the The EDPS does not require the data subject to be a political figure in order for him to be able to act as a role in public life. 103 In his complaint, the complainant notes that he is an executive officer of Corporation Z and that "as [executive officer] of Corporation Z, he has a role to play in public life. officer] of [Company Z], [he] undeniably has a significant degree of exposure media". The complainant, however, points out directly following this statement, that the facts concerned are not likely to contribute to a democratic societal debate, and that the public has no or no longer a legitimate interest in having access to this information. He also notes that he was not a political figure, which, however, as just mentioned, is not decisive. in the analysis of its role in public life. Company Z operates in Belgium, and the complainant has been a senior executive of Company W for some time. years, i.e. a company that is closely related to Company Z. 105 In its conclusions, Google also lists a series of functions performed by the complainant in the past and which illustrate, also in the opinion of the Litigation Chamber, that it has also, by the past, played a role in public life. 106.Thus, in addition to the complainant's current responsibilities already mentioned, among the duties of the position are the following have, over a period of some twenty years, held the following positions: a member of a political cabinet of a Minister of Party Y; Government Commissioner in Entity A; Member of Entity B; Agent within the public service; Government Commissioner in Entity D; a very senior position responsibilities in organization E; and a senior position in public entity F. 107.In other words, the complainant is performing and has performed public duties and/or in which it has used and is using public resources, has been and is being exposed in the media, has acted and is acting in a public context as a public person and, more specifically, as a senior public servant, or agent of a public service. Decision on the merits 37/2020 - 29/49 108 In conclusion, on the basis of the elements just set out,57 the Appeals Chamber considers that the complainant has played and is playing a role in public life. 6.2. On the label "party Y" 109 In his complaint and submissions, the complainant alleges that Google is referencing sensitive data. about her. In her words: "In this case, Google's indexes show [the complainant] as a person labeled... [Y party]. The complainant's] political opinions are sensitive data within the meaning of [the complainant's] right to privacy. section 9 of the GDPR. These data benefit from a legal regime of enhanced protection. For example, Google's processing of such data is prohibited, as it cannot be based on none of the applicable exceptions (i.e. Article 9 §2 of the RGPD and Article 8 §1 of the Law of the 30 July 2018 on the protection of individuals with regard to the processing of personal data relating to personal data)". 110 The complainant further insists that portraying him as a person "labelled party Y".... is inaccurate information justifying its dereferencing, and that in particular the deductions of Google regarding the complainant's links to the Y party are hasty and based on evidence erroneous (this is discussed below58). 111 In its summary findings, Google notes that in the present context, namely that of the and its role in public life in Belgium, it "is clear to the public that the labelling of the policy does not in any way refer to [the applicant's] real or supposed political views, but only the political party to which he is professionally close and which supported his candidacy to obtaining public mandates "59. In its conclusions, Google intends to demonstrate in fact the professional ties between the applicant and the Y Party. In particular, in order to justify that the treatment of political labelling is important to ensure a relevant public interest debate by the manner in which the appointment of (senior) officials and the terms of reference of the (senior) public mandates in Belgium, Google quotes Professor David Renders as saying that the recruitment of senior officials is politicized. In the same vein, the second paragraph of the press article less than ten years ago from www.lecho.be profiled the complainant and reported his appointment to a senior position in Public Entity F (Exhibit B.14 in the Google file). 57 Supra, No. 99-107. 58 Infra, no. 116-122. 59 Summary conclusions, p. 22, point 29. Decision on the merits 37/2020 - 30/49 112 "Political labelling" of a public official/high-ranking official and section 9 of the GDR. In the specific context of this case, the Chamber Litigator considers that the reference to a political "labelling" of an agent of a function or a senior public servant does not by itself automatically reveal an "opinion" of the public or a policy: in principle, it limits itself to showing that the data subject is a political person. professionally supported60 in his public life61 and, more specifically, in the framework of his career as a public official and senior civil servant. Nothing precludes a party The policy professionally supports a person's candidacy for a senior position for their personal qualities, regardless of his political views. The complainant also pointed out that he did not not being a member of the Y party. 113 In other words, it is on a case-by-case basis, depending on the disputed listing, that it will be necessary to evaluate whether each listing in question also implies or not, in addition to the political labelling, the revelation of a political opinion of the complainant. 114 This is the intent of section 9(1) of the GAR, which states that "The treatment of personal data revealing [...] political opinions, [...]" is prohibited (emphasis added). added by the Litigation Chamber). Thus, even supposing that the initial salaries of the sources (the cited newspapers otherwise covered by the freedom of journalism62 ) reveal an opinion policy, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion, quod non, it is difficult to argue that Google's processing reveals a political opinion. political: referencing does not pursue such a purpose, it points in this case on names of people. Finally, in the same spirit, but more explicitly, Article 6 of Council of Europe Convention No. 108 on the Protection of the Rights of All Migrant Workers and Members of Their Families, which is modernised Europe for the protection of individuals with regard to automatic data processing of a personal nature63 according to which : "Article 6 - Special categories of data 1. Treatment : […] - of personal data for the information they reveal on racial origin or ethnic origin, political opinions, trade union membership, religious or other beliefs, health or sex life; 60 Supra, No. 106. 61 Supra, No. 101 - 108. 62 Infra, n° 123 et seq. 63 Protocol amending (CETS No. 223) to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223). of personal data (ETS No. 108) adopted on 18 May 2018 by the Committee of Ministers of the Council of Europe at its 128th Ministerial Session. Decision on the substance 37/2020 - 31/49 is permitted only on condition that appropriate safeguards, supplementing those of the this Convention, be provided for by law. 2. Such safeguards shall be such as to prevent the risks that the processing of Sensitive data may present a threat to the interests, rights and fundamental freedoms of the person concerned, including a risk of discrimination "64 . 116 On the inaccuracy of "Party Y labelling". To establish whether a proxy for a function supported by either political party in a context where the appointments are made by the public service. is a complex issue that may require investigative work. (journalistic or otherwise) and a certain appreciation, in fine, also of the expression an opinion with regard to the person concerned. It is not irrelevant in the present case that the references Nos 2, 3, 4 and 5 relate to articles from the Belgian press, whether or not the disputed referencing no. 6 is linked to a public information site (msn.com) and that finally, the litigious referencing n° 1 concerns a Belgian website specialized in the question of the cumulation of the mandates and transparency in this area in Belgium (www.cumuleo.be). 117 It is not for the Litigation Chamber to exhaust the debate on the accuracy of such an information which opposes the data subject to the provider of the search engine and not to the data subject. to the authors of this information, which is at the heart of a subject of undeniable interest. and generating public debate. In essence, the latter is about transparency in the appointment to and the exercise of public office in Belgium, a subject at the heart of the Belgian civil service of democracy and which is meant to be studied over time. Article 17, 3., a), of the RGPD, does not require such a debate to be exhausted. 118 In the present case, in order to justify the existence of political labelling, Google refers to five elements first, the complainant was a member of the political staff of a minister of the Y he party; second, the complainant was a member of the political staff of a minister of the Y he party; and third, the complainant was a member of the political staff of the Y he party. about 20 years ago. Second, in an article that is being requested for dereferencing, is alleged to be a violation of the cumulation rules provided for in the statutes of Party Y and is reproduced here an excerpt from a letter in which a political agent, P, addressed a letter to the complainant a few days ago. has about 15 years to clarify the rules of accumulation within the party. Third, the applicant participated as a speaker, less than 5 years ago, in a convention of the Y party. Fourth, he gave another lecture at the Y Party, according to a Twitter posting from a Member of the Y party in the Brussels Parliament posted a few years ago. Fifthly and finally, he appears to have worked at the study centre of Party Y according to a senior official of a department 64 Emphasis added by the Litigation Chamber. 65 Supra, No. 111. Decision on the Merits 37/2020 - 32/49 public (in office at the time) reported in a section66 portraying the complainant. The complainant The article also informed the complainant that he was "labelled party Y". 119 The complainant refutes Google's position by considering that portraying her as a person labeled party Y is inaccurate information justifying its dereferral by arguing that: it did not have ever been a member of Party Y, that to find that the proximity between the applicant and Party Y is demonstrated in SEO No. 3 (the reference to the letter from a political representative P) is a hasty inference based on erroneous elements, that the applicant was not guilty of any cumulation which could infringe the rules applying to him, and that the agent's mail policy P (otherwise constituting private correspondence disclosed in breach of Article 22 of the the Constitution, Article 8 § 2 of the ECHR and Article 314 of the Criminal Code) does not prejudge the whether the complainant is (which is not the case) or is not a member of Party Y (the mail, addressed to the complainant, stating: "...if you are a member of Party Y,...". (120) At the hearing, the complainant noted, among other things, that the position of member of a political cabinet of a Minister from Party Y some 20 years ago is old and that in the meantime, the relationships can also change. He notes that even though in his private life he has regular contact with members of this (and other) political family, this does not make him a member of the political family. of the Y party. This is a dangerous shortcut that undermines the way it is perceived by the public and its administration. 121 On the one hand, however, Google does not rely on these elements alone, as the references in dispute and the elements put forward by it above67. On the other hand, more fundamentally again, the complainant does not dispute that he has been professionally supported by the Y party in his life. and more specifically, in the course of his career as a public servant and senior civil servant68. In the light of these elements,69 the Litigation Chamber considers that the Complainant's criticisms of the to the inaccuracy of the Party Y labelling attributed to it in the disputed referencing cannot exclude the application of Article 17(3)(a) of the GDGR. 66 Article in L'Echo at www.lecho.be. 67 Infra, no. 123 et seq. and supra, nos. 105 and 118. 68 Supra, no. 106. 69 Supra, n° 116-122. Decision on the merits 37/2020 - 33/49 6.3 Disputed referrals 123 For the disputed citations, see Exhibit 1 of the from which the factual elements set out below are drawn, unless otherwise specified. The The disputed referencing is also explained in more detail in the conclusions of the summary of the Google and related parts. 124 SEO No. 1. This referencing refers to the site cumuleo.be, and refers to the mandates, duties and professions performed by the complainant who is cited as "Tagged party Y". 125.Having regard to the role played by the complainant in public life,70 the fact that political labelling constitutes information related to transparency in the appointment to and exercise of mandates in an public service (a subject at the heart of the democratic debate and one that is destined to be studied in the course of the time), the Law of 2 May 1995 on the obligation to file a list of mandates, offices and professions and a declaration of assets (and Article 2(2) thereof in particular), therefore that in the present context, the mention of its labelling party Y does not reveal any of its opinions policies71, with respect to the referencing of content whose accuracy is not in dispute (in addition to the however, the criticism of party Y labelling advanced by the plaintiff72) the Litigation Chamber Considers that referencing No 1 is necessary for the exercise of the right to freedom of expression, and information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly that Google maintained it. 126 SEO No. 2. This SEO refers to an article in the newspaper Le Soir (www.lesoir.be ). (127) As regards the referencing of an article in a Belgian press organ, the accuracy of the content of which related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling party Y advanced by the complainant73), in light of the complainant's role in public life74, and the fact that political labelling constitutes information linked to transparency in designation and the exercise of public service mandates (a subject at the heart of the democratic debate and the which is intended to be studied over time), and provided that in the present context, the reference to of its labelling party Y does not reveal any of its political opinions,75 the Litigation Chamber Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and 70 Supra, No. 99-108. 71 Supra, n° 112-115. 72 Supra, n° 116-122. 73 Supra, n° 116-122. 74 Supra, n° 99-108. 75 Supra, n°109-115. Decision on the merits 37/2020 - 34/49 information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly that Google maintained it. 128 SEO No. 3. This referencing refers to an article on the RTL Info website. (www.rtl.be). 129 With regard to the referencing of an article in a Belgian press organ, the accuracy of its content related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling party Y advanced by the complainant76), in view of the complainant's role in public life77, and the fact that political labelling constitutes information linked to transparency in designation and the exercise of public service mandates (a subject at the heart of the democratic debate and the which is intended to be studied over time), and provided that in the present context, the reference to of its labelling party Y does not reveal any of its political opinions,78 the Litigation Chamber Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and of information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly that Google maintained it. 130 While it is true that the No. 3 SEO refers to information that is more than 10 years old and therefore of a certain seniority, this information nevertheless remains relevant since at that time and to this day, the complainant has played and continues to play a professional role in public life. 131 S.C.R. No. 4. This referencing refers to an article on the website of the newspaper La Libre Belgium (www.lalibre.be). 132 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling party Y advanced by the complainant79), in view of the complainant's role in public life,80 and the fact that political labelling constitutes information linked to transparency in designation and the exercise of public service mandates (a subject at the heart of the democratic debate and the which is intended to be studied over time), and provided that in the present context, the reference to of its labelling party Y does not reveal any of its political opinions81 , the Litigation Chamber Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and 76 Supra, No. 116-122. 77 Supra, n° 99-108. 78 Supra, n°109-115. 79 Supra, n° 116-122. 80 Supra, n° 99-108. 81 Supra, n°109-115. Decision on the merits 37/2020 - 35/49 information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly that Google maintained it. 133.SEO No. 5. This SEO refers to an article on the website of the newspaper La Libre Belgium (www.lalibre.be). 134 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling party Y advanced by the complainant82), in view of the role played by the complainant in public life83, and the fact that political labelling constitutes information linked to transparency in designation and the exercise of public service mandates (a subject at the heart of the democratic debate and the which is intended to be studied over time), and provided that in the present context, the reference to of its labelling party Y does not reveal any of its political opinions,84 the Litigation Chamber Considers that referencing No 2 is necessary for the exercise of the right to freedom of expression, and information, and that therefore, pursuant to Article 17(3)(a) of the GDPR, it is rightly that Google maintained it. 135 In the same way as for SEO No. 3, while it is true that SEO No. 5, is not a new product. relating to information that is about ten years old, i.e. information that is more than ten years old. of 10 years, is also old, this information is nevertheless relevant since at this time, the Then and now, the complainant was and is playing a professional role in public life. 136 S.C.R. No. 6. This referencing refers to an article on the information website www.msn.com. 137 Google claims that the url of SEO No. 6 leads to a page that no longer exists. But that's just As such, the complainant considers that it is the referencing as such by Google that is at issue. 138 Google replies in its summary conclusions that url 6 is no longer referenced at all in the search engine. in the first ten pages of search results, or any further. She confirmed at At the hearing that url 6 was no longer referenced and the complainant did not contest it. The request for The complainant's dereferencing is therefore no longer relevant as far as referencing No 6 is concerned. Referral No 7. This referencing refers to a GERFA press release from the website www.gerfa.be. GERFA is the Study and Reform Group on the Administrative Function. Google 82 Supra, No. 116-122. 83 Supra, n° 99-108. 84 Supra, n° 109-115. Decision on the merits 37/2020 - 36/49 explains in its summary conclusions that PREFA is a group founded in response to the of public services in Belgium and to bring about a massive politicisation of public services in Belgium and to raise awareness and a reflection on the improvement of their management, that it became a certified trade union organization in 1990 and now has about 1500 members. 140 Google also maintains here that the url of SEO No. 7 leads to a page that no longer exists. But the complainant rightly considers that it is the referencing as such by Google, which is contentious. 141 Google replies in its summary conclusions that url 7 is no longer referenced at all in the search engine. in the first ten pages of search results, or any further. She confirmed at the hearing that url 7 was no longer referenced and the complainant did not contest it. The complainant's request did not Therefore, no more purpose for listing No. 7. 142 Referencing n° 8. This referencing refers to an article on the website www.7sur7.be. 143 With regard to the referencing of an article from a Belgian press organ, the accuracy of the content of which is not guaranteed. related to the complainant's professional life is not contested (apart, however, from the criticism of the labelling party Y put forward by the complainant in relation to which reference is made above85), having regard to the role played by the by the complainant in public life,86 and the fact that political labelling constitutes information related to transparency in the appointment to and exercise of public service mandates (a subject at the heart of the democratic debate and which is destined to be studied over time), and therefore that in the present context, the mention of its labelling party Y does not reveal any of its opinions the Litigation Chamber considers that referencing No. 2 is necessary for the exercise of its jurisdiction. of the right to freedom of expression and information, and that therefore, in application of Article 17, 3., a) of the GDR, Google has rightly upheld it. 144 In the same way as for referencing Nos 3 and 5, if it is true that referencing No 5 relates to information that is about ten years old, namely information that is more than ten years old. of 10 years, this information nevertheless remains relevant since at that time and today Again, the complainant was and is playing a professional role in public life. 145 In view of the foregoing considerations, the Litigation Chamber concludes that it is correct that Google decided not to pursue the complainant's request for deregistration in the To the extent that this request requests the dereferencing of information related to political labelling. The 85 Supra, No. 116-122. 86 Supra, n° 99-108. 87 Supra, n°109-115. Decision on the merits 37/2020 - 37/49 The Litigation Chamber dismissed the complaint concerning the requests for deregistration of our 1 à 8. 6.4 On alleged harassment 146 References Nos. 9 to 12 all refer to articles from Belgian press sites. (respectively www.lalibre.be, www.dhnet.be, www.7sur7.be, www.sudinfo.be) all dated from a The complainant's complaint of harassment was filed against him at the within the public service. The existence of this complaint is not disputed. 148 However, in the application form for dereferral submitted by the complainant to Google on May 31, 2019, it wrote, among other things, the following: "These indexes refer to information that [the complainant] has been the subject of a harassment complaint. This complaint was declared unfounded in 2010. The fact that this information has not been updated justifies the request. of dereferencing, formulated on the basis of Article 17 of the GDR". 149 In Exhibit 7 of his file, the complainant attaches what appears to be the first page (out of 22) of a "Notice in the context of a reasoned complaint, Law of 11 June 2002, as amended by the Law of 10 January 2007, Confidential", rendered by "ARISTA, External Prevention and Protection Service", and the 20th page elements of which are omitted, and the following textual excerpts remain: "...] On the basis of this definition, the elements at our disposal and the points discussed... previously, we cannot recognize this situation as falling within the scope of the harassment. 9. CONCLUSIONS [...] We have no basis for concluding that there were any abusive behaviour or harassment by the respondent". 150 In this context, first, the complainant points out that the document (which Google does not dispute or contest) was not a "workable document". authenticity, nor integrity) is dated December 2, 2010, and that the complaint against the complainant was declared unfounded. It does not appear from the documents in the file that the complaint in question was the subject of other possible proceedings, or even that other complaints of the same nature have been lodged later against the complainant. In other words, the referenced information is no longer up to date, and is no longer relevant. Decision on the merits 37/2020 - 38/49 151 Second, it should be noted that the articles referred to are about ten years old. of years and evoke facts that are more or less ten years old. Thus, in addition to the fact that the of these facts has not been established, they are old. 152 Thirdly, in this context, the reference to the fact that a complaint was made for harassment against the complainant is likely to have a detrimental impact, both in terms of the in his professional life than in his private life. 153 While the disputed referrals may at one time have been able to participate in a public debate about an matter of general interest, the Litigation Chamber considers that, as of today, for the For the above-mentioned reasons, these listings are no longer up to date and obsolete, and therefore cannot be used as a reference. considered necessary for the exercise of the right to freedom of information in accordance with Article 17, 3., a) of the RGPD. 154 In the present case, Google cannot maintain such a listing on the basis of Article 6(1)(f) of the DMPR, with the rights and interests of the complainant prevailing for the just cause cited. It is incumbent upon Consequently, Google will proceed with their dereferencing. 155 In view of these considerations, the Litigation Chamber finds a breach of Articles 17, 1, (a) and 6(1)(f) of the RGPD and orders Google Belgium SA to bring the processing into conformity and to To this end, to ensure that all effective technical measures are implemented in order to cease the referencing nos. 9 to 12. 156 Consequently, it is not necessary to assess the additional elements put forward by the complainant. concerning the other disputed contents in reference No 10, relating to a budget annual amount that would have been allocated by a public service administration. 7. Violations of the DMPP 157 Upon submission of his deregistration request form to Google on May 31, 2010 2019, under "Reason for deletion", the complainant, through his lawyer, reported that that the harassment complaint had been declared unfounded in 2010 and that the information referenced was therefore no longer up to date88. This fact, regardless of its demonstration on the basis of parts (such as the 88 Supra, No. 148. Decision on the merits 37/2020 - 39/49 that the opinion referred to above89), at this stage of the process, has therefore been brought to Google's attention as soon as the dereferral form has been submitted, and this, moreover, by a lawyer. 158 Also at that time, Google must have become aware of the fact that the referenced content was about ten years old and concerned facts that were more than ten years old. The Chamber therefore considers that, upon receipt of the application form for a dereferencing introduced by the complainant, Google had actual knowledge of the of the harassment complaint, the fact that this information was not updated, and finally, in the case of a harassment complaint, that it was likely to cause harm to the complainant. In other words, Google had effective knowledge from that moment on of serious grounds for the grounds for requiring a dereferral on the basis of Article 17, 1., a) of the GDR, which in fact led the Litigation Chamber to consider that citations Nos. 9 to 12 should be dereferred90. However, on June 18, 2019, the "Google team" limited itself to answering the following to the plaintiff: "...] After considering the balance of interests and rights associated with the content in question, including factors such as your role in public life, Google has decided to don't block it. For the time being, we have decided not to intervene with respect to these URLs. We encourage you to send your removal request directly to the webmaster. that controls the site in question. This person has the ability to remove the content on the Web or prevent it from appearing in search engines. To find out more how to contact the webmaster [...] . If the obsolete content of a site continues to appear in Google results, you can ask us to update or delete the page in question. To do this, use the […]. If you do not agree with our decision, you are entitled to submit your problem to the data protection authority in your country [...]". Failure to comply with Articles 17(1)(a) and 6(1)(f) of the DPMR. In deciding to refuse to dereferencing referencing numbers 9 to 12 on June 19, 2019, when Google LLC should have 89 Supra, No. 149. 90 Supra, n° 150-153. Decision on the merits 37/2020 - 40/49 promptly proceed with their dereferral because it had effective knowledge of the reasons for their dereferral. serious enough to justify that it could not be maintained pursuant to Article 17(3) , (a) of the RGPD91, it being understood that Google LLC could also have deregistered the temporarily in order to verify in fact and in more detail with the complainant and his or her counsel. the serious grounds alleged, Google LLC has failed to comply with its obligations under Article 17(1)(a), of the RGPD. 162 The same facts also constitute a breach of section 6(1)(f) of the GDPR when in the circumstances of this case and for the reasons already given,92 the interests of the complainant who require protection of personal data prevail over Google's legitimate interest to reference content available via the Internet. 163 The Litigation Chamber considers that these failures are of a serious nature on the part of from Google. Although the provisions that were violated are open to interpretation and the right to data protection is not an absolute right, dereferencing is an obligation clear from a search engine following the Google Spain shutdown. As referred to by the Court of Justice, the potential seriousness of the interference is serious and the rights of the person concerned prevail, by principle, on the interest of this public in finding this information when searching for the name of that person.93 164 In this case, Google was fully aware of all the facts as a result of the the complainant's request, did not act diligently in refusing to derefer to the content in question, when the complainant had provided him with evidence of their outdated nature. The House Litigation considers in this context that these elements are comparable to the elements underlined in the case of Google Spain, in particular those relating to inadequacy and elapsed time. From Therefore, responding to the complainant's request does not require a complicated legal assessment. The Litigation Chamber adds that in these circumstances, there is no disproportionate prejudice. to freedom of expression and information, contrary to what Google Belgium SA supports. (165) Failure to comply with Article 12(1) and (4) of the GDR. Finally, as regards the analysis of the balance of rights and obligations, the interests to be realised pursuant to Article 17(3)(a) of the GDR and the case law of the Court of Justice of the European Communities. the Court of Justice,94 and merely replied to the complainant that "[f]ollowing consideration of the the balance of interests and rights associated with the content in question, including such factors as 91 Supra, No. 157-159. 92 Supra, n° 150-153. 93 CJEU, 13 May 2014, C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, points 81 and 97. 94 Supra, Nos. 92-96. Decision on the merits 37/2020 - 41/49 that your role in public life, Google decided not to block it", Google failed the obligations enshrined in Article 12(1) and (4) of the GDR. Indeed, the complainant was confronted with to a reason for the refusal of his incomplete application which does not enable him to know or understand the reasons for the refusal. completely Google's motivation. In fact, Google has closed the door of discussion to the complainant, by inviting him, in conclusion, if he did not agree with Google's decision, to submit directly his problem to the data protection authority in his country. At conclusion, Google's response as to the reason for the refusal to deregister lacked transparency and was not sufficiently comprehensible, in violation of Articles 12, 1. and 4. of the GDR. 8. Corrective and deterrent measures. First, the Litigation Chamber orders Google Belgium, pursuant to Article 100(1) of the GDR, to take the following corrective and deterrent measures. 1, 8° and 9° of the LCA, to bring the treatment into conformity and, to this end, to have the following implemented all effective technical measures to stop referencing numbers 9 to 12 on the one hand, and to all the other websites of the search engine in all their language versions but only for users consulting them from the European Economic Area, and this at no later than seven days after the notification of this decision and to inform the Chamber by e-mail Litigator at email@example.com that the above-mentioned order has been executed, in the same timeframe. 167 In addition to the injunction to dereferencing references Nos. 9 to 12, the Litigation Chamber Considers that the two failures referred to above require in addition, for purposes of deterrence, the imposition of administrative fines. 168 The Litigation Chamber emphasises that the purpose of imposing an administrative fine is not to only to put an end to an offence committed but, above all, to ensure effective enforcement of the rules of the GSPD. As can be seen from recital 148, the PGRD wants to see sanctions, y including administrative fines, be imposed in cases of serious infringements, in addition to or instead of the appropriate measures that are imposed. The Litigation Chamber acts as follows application of section 58.2(i) of the DP Regs. The instrument of an administrative fine does not therefore have the purpose of main objective to end violations. This goal can be achieved through several measures including the injunctions referred to in Article 100, § 1, 8° and 9° of the LCA, which are provided for in the by the RGPD. With respect to a sanction in the form of an administrative fine, the nature and the gravity of the violation are taken into account by the Litigation Chamber in order to examine the imposition and extent of this sanction. Decision on the merits 37/2020 - 42/49 169 It should be noted that this decision is not the first time that a fine has been imposed. administratively vis-à-vis Google for a breach in the context of deregistration. The Swedish supervisory authority, for example, imposed on Google on 11 March 2020 a fine of 75 million Swedish kronor (approximately EUR 7 million) for several breaches by it to its delisting obligations.95 A form for the imposition of an administrative fine was sent to Google Belgium SA, a company that is not a member of the European Union. on 4 June 2020 to make these arguments regarding the imposition of administrative fines.96 In response to this form Google Belgium SA puts forward several arguments. First and foremost Google Belgium argues that no sanctions should be imposed on it, since this would be "totally inappropriate, dangerously counterproductive and even illegal "97. In the alternative, Google Belgium SA states that "the envisaged sanctions would violate the principle of proportionality of the standards.... repressive. In addition, the publication by name of a sanction against Google Belgium SA would be counterproductive "98. In the further alternative, Google Belgium SA considers that the the determination of the amount is not properly justified because "the Litigation Chamber has ... and did not take into account the mitigating circumstances "99. The amount of the fine is also considered problematic by Google Belgium SA because it is not able to control the scale, formula and method of calculation used for its determination. 172. In response to these arguments, the Litigation Chamber specifies that it is relying on Article 83 of the to conclude that an administrative penalty is warranted and to calculate the amount. The Litigation Chamber gives reasons for its decision on the basis of the findings set out below. As indicated in the fine form, in respect of the determination of the amount of the fine, the of the turnover of Google Belgium SA, which is a criterion for the calculation of the fine, the Litigation Chamber is based on the opinion of the European Data Protection Committee which is the following: "In order to impose effective, proportionate and dissuasive fines, the enforcement authorities will rely on the definition of business provided by the ECJ for the purposes of the application of Articles 101 and 102 TFEU, namely that the concept of undertaking must be understood as an economic unit that can be formed by the parent company and all of its subsidiaries. 95 EDPB "The Swedish Data Protection Authority imposes administrative fine on Google", 11 March 2020, available at www.edpb.europa.eu. 96 Supra, No. 10. 97 Response of Google Belgium SA to the fine form, 24 June 2020, p. 2. 98 Ibidem 99 Ibidem Decision on the merits 37/2020 - 43/49 the subsidiaries concerned. In accordance with Union law and case-law, it is necessary to to define an enterprise as the economic unit engaged in commercial activities, or economic, irrespective of the legal person involved (recital 150). »100 174 The Litigation Chamber therefore bases itself on the turnover of the Alphabet conglomerate, the presumed parent company of Google Belgium SA, the amount of which for the last three years was can be found below : . - Alphabet turnover 2019: $161,857 billions. - Alphabet turnover 2018: $136,819B billions. - Alphabet turnover 2017: $110.855 billion.101 175 Concerning the failure to comply with articles 17, 1, a) and 6, 1, f) of the RGPD, the Litigation Chamber, having regard to Article 83(2) of the GDR, decides to impose an administrative fine in the amount of EUR 500,000, taking into account : (i) at least from 19 June 2019 to 6 May 2020, being the date of the hearing held in the the present case, i.e. for a period of 10 months, despite the fact that, in the the communication in the course of the proceedings by the complainant in the context of the exchange of findings of a dismissal notice issued by ARISTA regarding the harassment complaint102, Google has maintained referencing numbers 9 to 12, even though it had some serious elements at its disposal of such a nature as to justify deregistration since 19 June 2019. The maintenance of references 9 to 12 has caused (and could still cause) significant damage to the reputation of the complainant, since the complainant saw particularly negative information at the time. its subject maintained in the search engine referencing for more than ten months, when he had requested its removal and provided evidence of inaccurate information. The Litigation Chamber considers that the decision directly concerns the Complainant. and indirectly, all Internet users who may have searched for information about it. on the search engine. During this period, the disputed referrals have been maintained by Google without any legal basis under Article 6(1) of the GDR, which constitutes a serious breach of the GDPR. The violation of Article 17, 1., a) constitutes also a violation of an essential principle of the GDPR and constitutes at least a violation of a fundamental principle of the GDPR. gross negligence (Article 83(2)(a) of the GDR) ; 100 "Guidelines on the application and setting of administrative fines for the purposes of Regulation (EU) 2016/679", WP 253, adopted 3 October 2017, p. 6, available at www.edpb.europa.eu. 101 Available at: https://www.macrotrends.net/stocks/charts/GOOG/alphabet/revenue. 102 Supra, No. 149. Decision on the merits 37/2020 - 44/49 (ii) the above elements constitute a serious breach of the PMPRB and a serious breach of the PMPRB. negligence on the part of Google Belgium SA (Article 83(2)(b) of the GDR). Google Belgium cannot in this respect claim that it has put a dedicated online form at the persons concerned, formed teams and set up a committee for the purpose. legislative, or that it responds favourably to a large number of requests for dereferencing. This is part of Google's responsibilities in relation to the RGPD, which are proportionate to the importance and risks of the processing operation (Article 24(1) of the RGPD). Google Belgium SA also cannot rely on the absence of mediation. organized by the ODA Front-Line Service to mitigate its shortcomings. Indeed, pursuant to Article 62.§ 2 of the ACL, only applications may be the subject of mediation of the Front Line Service. Complaints considered admissible must be directly transmitted to the Litigation Chamber (62.§ 1 of the LCA). In the case that we concerned, the complainant had lodged a complaint and not a request103. Furthermore, the Chambre Contentieuse recalls that the administrative fine is not a corrective measure, but a deterrent104 , the effect of which cannot be replicated by mediation ; (iii) to date, the defendant has not taken any steps, even temporary, to mitigate the damage suffered by the plaintiff, even though she has known since the fine form was sent on June 4, 2020 that the Litigation Chamber was questioning a violation of the GDR and that the Litigation Chamber considered the imposition of a sanction (Article 83. 2, c). On this point, the Litigation Chamber clarifies that it is under no obligation to suggest or impose on the party defendant to take measures which would enable it to reduce the amount of the fine or no fine at all. (iv) as has been pointed out on several occasions105 , Google LLC is the subject of litigation important with regard to the implementation of the right to oblivion and the provisions contained therein in France, Spain and Sweden. It must be noted that despite these precedents, the group's modus operandi still does not allow it to fully and adequately fulfil its obligations arising from the right to oblivion. Even if it requires a case-by-case analysis, the right to oblivion constitutes an obligation clear 106. The Litigation Chamber notes, however, that there is not strictly speaking any recidivism where the legal entities concerned are different (Article 83(2)(e)); 103 Text from the original complaint of the complainant: "[The complainant] instructed me to lodge a complaint with of your Authority following GOOGLE's refusal to grant its requests for deregistration, sent via the forms of request for deletion of personal information". 104 Supra, No. 168. 105 Supra, notes 6-9. 106 Supra, no. 163. Decision on the merits 37/2020 - 45/49 (v) the data concerned are data of a sensitive nature, as they are facts of criminal in nature, even if in this case the harassment complaint against the complainant and included in the disputed references has not been brought before a criminal court. (Article 83.2, g). (vi) With regard to Rule 83.2 (i), the Chamber refers to (iv) above, (vii)these elements are finally aggravated by the fact that, on the one hand, Google's search engine is widely used by Internet users, and that Google is a company with (its annual worldwide turnover in 2019 was $161.857 billion). Its deregistration obligations are proportional to its size and to the group turnover. In view of the significant litigation it has had to manage before the Court of Justice of the European Union107 , the Litigation Chamber considers that Google should have Since then, the company has developed a great deal of expertise in the field, which should help to avoid shortcomings. such as those found by the House. This also justifies that greater diligence is expected from it (Article 83(2)(k) of the GDR). 176. The Litigation Chamber further recalls that, under Article 83(5)(b) of the GDR, it provides as follows the power to impose fines of up to EUR 20 000 000 or up to 4% of the turnover of the company. The amount of the fine provided for in this decision is well below These ceilings and represent a reasonable amount in relation to sales ($161.857 billion in 2019) of the Google Group. It cannot therefore be considered disproportionate. As regards the failure to comply with Article 12(1) and (4) of the RGPD, the Litigation Chamber, having regard to Article 83(2) of the RGPD decides to impose an administrative fine of EUR 100 000, taking into account the following elements : (i) having regard to the key role played by Google's search engine in the dissemination of information via the Internet, and its widespread use by Internet users, the lack of motivation of an understandable and transparent refusal to deregister content of a nature to prejudice to a person concerned, constitutes a serious breach of the DMPR, which is furthermore likely to prejudice the person concerned, who is irritated by the receive a seemingly standard and untidy response, to feel the injustice of not being able to be as it could be from an entity such as Google (see the following indent on this point), and to be forced in this context, in the event of dissatisfaction, to turn to an other entity (the publisher of the referenced content or the data protection authority of its countries) (Article 83(2)(a) and (b) of the GDGR) ; 107 See, in particular, notes 6, 7 and 8 above. Decision on the merits 37/2020 - 46/49 (ii) Items 177, (iv), (vi), (vii), and 178 above. Concerning the application and reply forms for de-listing 178 Previously, in paragraphs 71 to 79 of this decision, the Litigation Chamber has noted that that as part of Google's delisting request management process LLC, some ambiguity was maintained as to the identification of the controller who is not clearly and unambiguously identified. The facts pinned at that point in this decision constitute a breach of Articles 12(1) and (2) and 14(1)(a) of the GDR. Google LLC is is unable to clearly identify the precise legal entity responsible for the data processing carried out in the context of referencing (and de-referencing) activities Google's search engine, which makes it difficult for the individual to exercise his or her rights. concerned, not knowing precisely in fine, who his interlocutor is. The Litigation Chamber decides to order Google Belgium SA to have the forms adapted. and communicates to the users who use its electronic services of internet search engine from the Belgian territory, for the purpose of dereferencing, in clearly and precisely identifying which legal entity(ies) is/are responsible for the treatment and what treatment. 9. Administrative transparency 180.Given the importance of transparency in the decision-making process and in the decisions of the Litigation Chamber, also taking into account the scope of the present decision which concerns a very large number of people concerned, namely all Belgian residents - and by analogous to all residents of the EEA - who are likely to be referenced via the search engine from Google on the basis of a search including their first and last names as keywords, this The decision will be published on the website of the Data Protection Authority. In the present case, the Litigation Chamber decides not to delete the data. of Google's identification. However, it decided to delete the complainant's personal data. and the other people mentioned. The Chamber considers that such a deletion is necessary in order to of the objective pursued by the complainant, namely dereferencing by Google. Decision on the merits 37/2020 - 47/49 182 In the reaction to the fine form, Google Belgium SA states, inter alia, that a publication would be counterproductive and would stigmatize Google. This argument is not convincing. First of all, Google Belgium SA considers that such a publication would be counterproductive. since it would encourage people seeking dereferencing to turn to Google unnecessarily Belgium SA rather than Google LLC. This argument cannot be accepted. Indeed, the request for dereferencing is not done by postal mail, but by an online form put at disposition by Google LLC. It is not possible to turn to the wrong entity during a request for dereferencing since it is Google LLC that makes the web page available and that runs the process for dealing with his complaint. Apart from extremely marginal cases, the Litigation Chamber can't see how a person could direct his or her request for dereferral to Google Belgium SA. Second, with regard to the stigmatisation argument, the Litigation Chamber points out that the publication with identification of the defendant pursues two objectives. First of all, it aims to an objective of general interest, because it explains the responsibilities (of the subsidiaries in the Union) of Google under RGPD. Indeed, in view of the importance of the search engine "Google" for very and the fact that a large proportion of people living in Belgium are now using the Internet. find referenced in one way or another on the search engine "Google", the Chamber Litigator considers it appropriate to give this decision publicity that can raise awareness among the Internet users to their rights under the GDR. As such, even if the decision does not concern directly as the complainant, it is of interest to a large segment of the general public. The publication of the decision is highly relevant in this respect. The publication of the decision is also intended to act as a deterrent. The Litigation Chamber challenges the that the decision is discriminatory, as argued by the defendant. Article 100(1), 16 of the Act of 3 December 2017 establishing the Data Protection Authority gives the power of the Administrative Jurisdiction Division to decide on the publication of the decision "on a case-by-case basis". The Chamber has in the past already decided to publish decisions with identification of the party. defendant, when it considered that such publication would contribute to the rapid compliance of the litigious situation and to reduce the risk of repetition108 and that, furthermore, any pseudonymization of the defendant's name would be illusory. 108 See, inter alia, Litigation Chamber, 9 July 2019, Decision on the merits 05/2019; Litigation Chamber, 23 June 2020, Substantive Decision 34/2020. Decision on the merits 37/2020 - 48/49 10. Device ON THESE GROUNDS, the Litigation Chamber of the Data Protection Authority shall decide, after deliberation : (1) pursuant to Article 100, paragraph 1, 2°, of the DPA, dismiss the complaint concerning the requests for dereferral of referrals Nos. 1 to 8. (2) pursuant to Article 100(1), 8° and 9° of the LCA, orders Google Belgium SA to bring the processing into conformity and, to this end, to have all the necessary effective technical measures to stop referencing numbers 9 to 12 on the one hand, for all the other websites of the search engine in all their versions language, but only for users consulting them from the Economic Area. European Union, no later than seven days after the notification of this Decision, and to inform by e-mail the Data Protection Authority (Litigation Chamber) that the above-mentioned order has been executed, within the same period of time (via the e-mail address firstname.lastname@example.org); (3) pursuant to sections 100, 13° and 101 of the LCA and 83 of the GDR, requires Google to Belgium SA a fine of EUR 500 000 for failure to comply with Articles 17(1)(a) and 6, 1., (f), of the GDR. (4) pursuant to sections 100, 13° and 101 of the LCA and 83 of the GDR, requires Google to Belgium SA a fine of EUR 100 000 for failure to comply with Article 12(1) and (4) of the RGPD; (5) pursuant to Article 100(1), 9° of the LCA, orders Google Belgium SA to to adapt the electronic forms it makes available and communicates to the users who use its internet search engine services from the territory for dereferencing purposes, clearly and precisely identifying which Belgian legal entity(ies) is (are) responsible for the processing and for which processing operations, at the no later than two months after notification of this Decision and to inform by e-mail the Data Protection Authority (Litigation Chamber) that the aforementioned order has has been executed, within the same time frame (via the e-mail address email@example.com). Decision on the merits 37/2020 - 49/49 According to Article 108 § 1 of the ACL, this decision may be appealed against within a time limit of of thirty days from the notification to the Market Court, with the given as a defendant. (sé.) Hielke Hijmans President of the Litigation Chamber