Datainspektionen - DI-2018-9274
|Datainspektionen - DI-2018-9274|
|Relevant Law:||Article 5(1)(b) GDPR|
Article 5(1)(a) GDPR
Article 6 GDPR
Article 9 GDPR
Article 10 GDPR
Article 17 GDPR
|National Case Number/Name:||DI-2018-9274|
|European Case Law Identifier:||n/a|
|Original Source:||Datainspektionen (in SV)|
|Initial Contributor:||Charlotte Godhe|
The Swedish DPA (Datainspektionen) imposed a fine of 75 million Swedish kronor (approximately € 7 million) on Google for failing to fulfill its obligation in respect of the right to be forgotten (Article 17 GDPR).
English Summary[edit | edit source]
Facts[edit | edit source]
The Swedish DPA finalised an audit of Google’s handling of individuals’ right to have search result listings for searches that includes their name in 2017. In its decision, the DPA concluded that a number of search result listings should be removed and subsequently ordered Google to do so.
During the DPA’s follow-up audit in 2018, it was critical to the fact that Google did not properly remove two of the search result listings that the DPA had ordered them to remove back in 2017. In one of the cases, Google has done a too narrow interpretation of what web addresses need to be removed from the search result listing. In the second case, Google has failed to remove the search result listing without undue delay. Google claimed it had followed the order and that the handling of the delisting requests had been lawful.
Further, when Google removes a search result listing, it notifies the website to which the link is directed in a way that gives the site-owner knowledge of which webpage link was removed and who was behind the delisting request. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. The DPA criticised this practice, alleging it puts the right to delisting out of effect. However, Goggle claimed this practice has been in accordance with Article 6.1(f) GDPR.
Dispute[edit | edit source]
The dispute concerned whether Google had followed the DPA’s order and sufficiently removed search links on request of data subjects or not.
It was also in dispute if Google’s practice to inform site-owners of the removal of search results had a legal basis.
Holding[edit | edit source]
The DPA held that Google had not complied with the previous order by the DPA by failing to remove search links sufficiently and within a reasonable time. Google had, therefore, processed personal data in violation of the GDPR.
The DPA also held that Google had processed personal data in violation of Articles 5(1)(b) and 6 GDPR by sending notifications to webmasters that search results had been deleted. Furthermore, the notice given to data subjects concerning these notifications was found misleading in a manner contrary to Article 5 (1)(a) GDPR.
Comment[edit | edit source]
For a deeper understanding of the right to request delisting under Article 17 GDPR, the following case and EDPB guidelines can be helpful:
Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, judgment of 13 May 2014.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Decision Diary No. 1 (31) 2020-03-10 DI-2018-9274 Google LLC Amphitheater Parkway, Mountain View, CA 94043 United States Supervision according to the EU Data Protection Regulation 2016/679 - Google's handling of requests on removal from its search services Table of Contents The Data Inspectorate's decision ....................................... 2 1 Report on the supervisory matter ............................. 4 1.1 General ................................................ .................................................. ........ 4 1.2 The content of previous decisions as far as is now relevant .......................................... ..6 1.2.1 Order concerning complaints 2 and 8 ......................................... ... 6 1.2.2 Obligation to investigate the circumstances of a request ....................... 7 1.2.3 Communication to webmasters that removal has taken place .......... 8 2 Grounds for the decision ........................................... 8 2.1 Starting points for the assessment of follow-up complaints ....................... 8 2.2 Follow-up of complaint 2 ............................................. ........................... 9 2.2.1 What has emerged during the proceedings ............................ 9 2.2.2 The Data Inspectorate's assessment ............................................. .............. 11 2.3 Follow-up of complaint 8 ............................................. ............................ 12 2.3.1 What has emerged during the proceedings ........................... 12 2.3.2 The Data Inspectorate's assessment ............................................. .............. 13 2.4 Communication to webmasters that search results have been deleted and information about this to individuals ............................................ ............... 14 2.4.1 What has emerged during the proceedings ........................... 14 Postal address: Box 8114, 104 20 Stockholm E-mail: firstname.lastname@example.org Website: www.datainspektionen.se Phone: 08-657 61 00Datainspektionen DI-2018-9274 2 (31) 2.4.2 The Data Inspectorate's assessment ............................................. ............. 15 3 Choice of intervention ........................................... 23 3.1 Possible intervention measures ............................................... ........................ 23 3.2 Injunction ................................................ .............................................. 24 3.3 Circumstances of significance for whether a penalty fee should be imposed ......... 25 3.3.1 What Google has stated ........................................... ........................... 25 3.3.2 Assessment of the infringement concerning complaint 2 .......................... 25 3.3.3 Assessment of the infringement concerning complaint 8 .......................... 26 Assessment of the infringement relating to notification to webmasters and information to individuals ............................................ 27 3.3.5 Penalty fees shall be imposed ............................................ ................. 28 3.4 Determining the size of the penalty fee ............................................ 28 3.4.1 General provisions ............................................. ......................... 28 3.4.2 The amount for which penalty fees can be set .................... 29 3.4.3 Determining the size of the penalty fee .................................... 30 3.5 Appendices ................................................ .................................................. ....... 30 4 How to appeal .......................................... 31 The Data Inspectorate's decision 1. The Data Inspectorate finds that Google LLC (Google) has not taken measures so that a certain search result in complaint 2 in the Data Inspectorate's earlier supervisory decision with registration number 1013-2015 is not displayed for searches on the complainant's name using Google's search services that can be made from Sweden during the period May 25, 2018 to October 12, 2018. Google has through this processed personal data in violation of Article 9 of the Data Protection Regulation by dealing with sensitive personal data consisting of data on ethnicity, religious REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the Data Inspectorate DI-2018-9274 3 (31) conviction, mental health and sexual life, without having for treatment a valid exemption from the ban on treating sensitive personal data. Article 10 of the Data Protection Regulation by considering personal data relating to offenses consisting of data on prosecution and preliminary investigation without the treatment being allowed. Article 17 of the Data Protection Regulation by not unnecessarily have delayed the complainant's request for removal. 2. The Data Inspectorate finds that Google has not taken any action so that a certain search result in complaint 8 in the Data Inspectorate's previous supervisory decision with registration number 1013-2015 is not displayed for searches on the complainant's name with using Google's search services that can be made from Sweden during the period May 25, 2018 to June 11, 2018. Google has dealt with this personal data in violation of Article 10 of the Data Protection Regulation by considering personal data relating to offenses consisting of data on allegations of crime and preliminary investigation without processing been allowed. Article 17 of the Data Protection Regulation by not unnecessarily have delayed the complainant's request for removal. 3. The Data Inspectorate finds that Google since May 25, 2018 regularly informs webmasters of websites when the company has taken deleted a URL as a result of a removal request. Google thereby processes personal data in violation of Article 5 (1) (b) of the Data Protection Regulation in that the procedure constitutes a personal data processing that is incompatible with the original purpose for which the data were collected. Article 6 of the Data Protection Regulation by not having a legal basis for the treatment. 4. The Data Inspectorate states that Google since 25 May 2018 in its Web forms for removal requests inform individuals about and requires them to agree that Google may inform them free flow of such data and repealing Directive 95/46 / EC (General Data Protection Ordinance) .Data Inspectorate DI-2018-9274 4 (31) webmasters for such URLs that are removed from the search results to as a result of individual requests. Google deals with this personal data in violation of Article 5 (1) (a) in that the procedure is intended to persuade individuals to refrain from exercising its right to request removal. 5. The Data Inspectorate decides on the basis of ch. Section 3 of the Data Protection Act and 2 Articles 58 (2) and 83 of the Data Protection Regulation require Google to pay a administrative penalty fee of SEK 75,000,000 (seventy-five million). 6. The Data Inspectorate submits pursuant to Article 58 (2) (d) i Google's Data Protection Regulation that, as far as removal requests are concerned of displaying search results when searching for individuals' names using Google search services that can be done from Sweden, stop informing webmasters of URLs when Google has granted a request except in cases where the individual has requested the. cease to display the text “If URLs are removed from ours search results as a result of your request, we can provide information to them webmasters for the deleted URLs ”in their web form for request for removal or provide similar information to individuals if it is not clear that webmasters are only informed about that a request has been granted if the individual has requested it. 1 Report on the supervisory matter 1.1 General In May 2015, the Swedish Data Inspectorate started with the support of the Personal Data Act (1998: 204) and the Data Protection Directive a supervisory case with a record number 1013-2015 (the former case) against Google Inc. whose legal successor is Google LLC (Google or Company). The review was about how Google handles it requests from natural persons that certain search results should not be displayed at 2 The Act (2018: 218) with supplementary provisions to the EU Data Protection Regulation. 3 Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free flow of such information.Datainspektionen DI-2018-9274 5 (31) searches on their name on the company's search services (removal request). The review took place in the light of the ruling that stated that individuals are right to be granted in certain cases a request for removal and 4 data protection authorities' guidelines for interpreting the judgment (WP225- 5 guidelines) and this right (right of removal). In addition to Google's handling of removal requests in general included in The review also includes 13 complaints received by the Data Inspectorate from individuals who believed that the company had incorrectly rejected their respective request on removal. The review was terminated by decision of 2 May 2017 (the previous decision). In the decision, the Data Inspectorate presented Google with the latest take action on 2 August 2017 regarding five of the complaints (Nos. 2, 4, 5, 8) and 9) in such a way that the specified search results are not displayed during searches on the names of the complainants. The Data Inspectorate also made recommendations on how such requests should be handled. Google appealed the injunction regarding complaint no. 8. The appeal was rejected on 2 May 2018 in this part and entered into force on 24 May 2018. 7 On 25 May 2018, the Data Protection Ordinance began to be applied. Based on tips from the public that Google had not followed the decision and the judgment, the Data Inspectorate stated during an inspection on 8 June 2018 that search results from complaints 2 and 8 were still displayed. Against this background this supervisory matter was initiated. 4 Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12. 5 Article 29 Working Party on Data Protection, “Guidelines on the Enforcement of Judgments [Google Spain and Google] ”of 26 November 2014 (WP 225). The working group has in and with the entry into force of the Data Protection Regulation replaced by the European Data Protection Board (EDPB) (see Articles 68 and 94 (2) of the Data Protection Regulation). 6 The decision in its wording following the decision on reconsideration of 14 July 2017. References to the decision in the following refers to the decision in this wording. 7 The Administrative Court in Stockholm's judgment of 2 May 2018 in case no. 16590-17. The Data Inspectorate appealed the Administrative Court's judgment in the part in which it went The Data Inspectorate received, ie. repeal of the injunction 'in the part intended to remove search results that can be displayed when searching on the registrant's name using Google LLC's search services that can be done from countries other than Sweden ”. The Court of Appeal decided on 3 December 2018 in case no. 4635-18 not to grant leave to appeal, which was established by the decision of the Supreme Administrative Court on 11 September 2019 in case no. 6887-18.Data Inspectorate DI-2018-9274 6 (31) The supervision has taken place through correspondence. The review is about how Google is doing handled the complainants' requests and the Data Inspectorate's injunctions concerning complaints 2 and 8 in the previous decision. Against the background of what has emerged, the Data Inspectorate has also followed up on certain issues as well highlighted in the recommendations of the decision. This refers to how Google investigates removal requests as well as Google's routine to provide regular information webmasters for relevant URLs once a request has been granted and Google's information to individuals about this in Google's web form for request for removal. 1.2 The content of previous decisions as far as is now relevant 1.2.1 Order concerning complaints 2 and 8 In the previous decision, the Data Inspectorate stated that Google "processes personal data in violation of section 5 a, second paragraph of the Personal Data Act on display of search results after searching for the complainant's name in Google's search services regarding the search results referred to in Complaint 2 (Google No. 0-5877000003906) […] [och] complaint 8 (Google no. 1-8544000003955), the search hit that links to one article on the website www.sydsvenskan.se. ” The Data Inspectorate instructed Google to “take action to address the above the search results are not displayed when searching on the complainant's name using Google search services that can be done from Sweden "and stated that" [the] measures must be completed by 2 August 2017. " The Data Inspectorate stated in the reasons for the previous decision regarding complaints 2 that the public interest in having access to the information on the appellant in the current discussion thread via search in Google search services does not justifies the breaches of privacy that the treatment entails. This against given that the current discussion thread is extensive survey of the complainant and reports fairly extensively and at most private information about the complainant's ethnicity, religious beliefs, mental health, sexual preferences, offenses (information on prosecution and preliminary investigation), family and address. Google was thus ordered to cease with the treatment. The company did not appeal the decision. Data Inspectorate DI-2018-9274 7 (31) The Data Inspectorate stated in the reasons for the previous decision regarding complaints 8 that the Data Inspectorate limited its review to the search result that leads to an article published on Sydsvenskan's website with information about crime which the complainant is alleged to have committed (information on allegations of crime and ongoing preliminary investigation). The Data Inspectorate judged that such information may be considered particularly sensitive to privacy and instructed Google to cease the treatment. The company appealed the decision to the administrative court as in the judgment of 2 May 2018 agreed with the Data Inspectorate's assessment and confirmed 8 the decision. 1.2.2 Obligation to investigate the circumstances of a request In the previous decision, the Data Inspectorate mainly stated the following (see pp. 11–14). There are no formal requirements for a request for rectification under the Data Protection Directive or the Personal Data Act. When it comes to handling a request may, even if the provision in section 28 of the Personal Data Act is not directly applicable in this case, the preparatory work for that provision serve as guidance. According to these, it is sufficient that it appears from a request that the data subject is dissatisfied with the processing in any particular respect and wants correction to be taken. If such a request is made, it should personal data controllers urgently investigate the allegations the remarks are justified and, if so, make corrections as soon as possible. The scope of the investigation may depend on the remarks made by it registered have produced. It should in the first instance be the responsibility of the individual to state sufficient information to enable Google to process his request. Information on which search hit is meant by a request should preferably be made is identified by entering the URL of the web page being searched links to. In cases where the individual refers to the name of a website, a blog or similar and it is possible to identify the website and it information on the website in question, it should be the responsibility of Google to take action to identify the search result to which the request relates. The same goes for it individual has mistaken the top level domain in the web address for example .se i instead of .com and it appears from, among other things, the search result which search result to which the individual refers. About Google, despite investigative measures taken, considers that it is not possible to identify the search hit as the individual has requested that Google remove or if Google does not accept the individual 8 The Administrative Court in Stockholm's judgment of 2 May 2018 in case no. 16590-17, p. 12 para. 2.Datainspektionen DI-2018-9274 8 (31) facts of the case, the individual should be informed of this and given opportunity to complete their tasks. Against this background, the Data Inspectorate recommended that Google take action necessary measures to investigate a vague and incomplete request to: search results should be deleted. 1.2.3 Communication to webmasters that removal has taken place In the previous decision, the Swedish Data Inspectorate mainly stated the following (p. 19-20). When Google deletes a search result, the company sends another message the webmaster whose web page is affected if he or she has signed up Google's Webmaster Tools service. In the complaints examined occur usually only one or a few names of the web pages that the search hits links to. It should therefore be relatively easy for the webmaster to determine who has requested removal. Google must therefore assume that information about which web pages are affected by a deletion indirectly involves a personal data processing. Against this background, the Data Inspectorate recommended that Google only send information to webmasters when it is clear that such information does not infringe on the privacy of data subjects. 2 Grounds for the decision 2.1 Starting points for the assessment of follow-up complaints A search engine provider must, within the framework of its responsibilities, its qualifications and ensure that the processing of personal data in the business meets the requirements of the data protection rules, since the business can significantly affect fundamental rights regarding 9 privacy and the protection of personal data of the persons concerned. The characteristics of a search engine's business do not mean that it is excluded the prohibitions and restrictions on the processing of sensitive data and Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 38 and 83. Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 41.Data Inspectorate DI-2018-9274 9 (31) criminal information, but these apply when the search engine has received a request on removal. 11 The Data Inspectorate states that if a personal data controller has taken receive a request for removal from a registrant, but does not remove the information without undue delay or rejects the request on incorrect grounds; the further processing takes place in violation of the Data Protection Regulation. When it is the question of search engine services does this require prompt handling particularly relevant as the dissemination of personal data risks becoming very extensive and an alternative attitude would erode the individual opportunities to exercise their rights and the protection of the personal integrity. The Data Inspectorate has already in the previous decision assessed the outcome of the balance in complaints 2 and 8 and then found that the treatment took place in violation with the Personal Data Act and the Data Protection Directive. Current legislation (Data Protection Regulation) and the practices that have been added do not there is reason to make a new assessment in this regard. During previous inspections, the Data Inspectorate has found deficiencies in the handling of complaints 2 and 8. Deficiencies have existed since the Data Inspectorate's decision won legal force in each part, or when measures were to be implemented at the latest, which was before the Data Protection Ordinance came into force on 25 May 2018. The regulation entails enhanced rights for individuals and provides The Data Inspectorate significantly more powerful powers. Starting point for the Data Inspectorate's assessment regarding continued violations is taken therefore on the date of implementation of the Regulation, ie 25 May 2018. 2.2 Follow-up of complaints 2 2.2.1 What has emerged during the proceedings During a control search on 8 June 2018 of complaint 2, the Data Inspectorate found that the search result specified in the decision ”is displayed as the first search result in the search result in a search performed on October 10, 2016 ”(search result 2) was still displayed at search on the complainant's name and therefore requested that Google comment. Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, points 43-47.Data Inspectorate DI-2018-9274 1 0 (31) Google stated in a response on June 15, 2018 that the company regarding complaint 2 per on 18 May 2017 had fixed a specific web address (search result 1). The Data Inspectorate stated in a letter dated 9 July 2018 to Google in essentially the following. The documents in the previous case show that it search result described in the reasons for the previous decision was search result 2. The URLs in search results 1 and 2 are identical except that the latter has two extra character at the end ("p2") which is an abbreviation for "page two" in one discussion thread on a forum. The URL in search result 1 identifies both the whole discussion thread and its first page. The Data Inspectorate pointed out that there may be reason to consider a request identifying one URL, which thus both identifies the entire discussion thread and constitutes its first page, not only includes search results leading to the first page but also to subsequent pages, such as search hit 2. This is especially true if individuals provide information that points in this direction, such as the complainant can be considered to have done by in addition to what is stated in the form clarifies that "the whole thread specified" violates the complainant's privacy (the original request). If Google nevertheless did not consider itself obliged to remedy search result 2, the Data Inspectorate reminded of the company duty of investigation and information in the event of an unclear or incomplete request. Google stated the following in its response on 30 August 2018 to the Swedish Data Inspectorate request to state whether action would be taken in relation to search results 2 and how similar situations are handled. Google took action regarding two other pages in the current thread in 2014 and another page in August 2018 in connection with the Data Inspectorate's request. Google will not take action concerning search hit 2, as the appellant did not specifically request it. One such request "is a personal right" which "can only be exercised by it registered "and Google" therefore respects the extent to which it registrants have given their request '. According to Google, this has support in WP225- the guidelines stating that data subjects must “identify the specifics the URLs ”. The obligation to investigate or inform has not arisen. 12The previous case, file appendix 1 appendix 2 p. 2. 13WP225 guidelines, p. 14 (Data Inspectorate's translation). Data Inspectorate DI-2018-9274 1 1 (31) The complainant contacted the Data Inspectorate on 9 October 2018 regarding search hit 2 and then received information about the company's attitude and opportunity to make a new request in addition to the current examination of it original request, which the complainant made on 12 October 2018 (the new one) request). Google stated the following in its response on October 25, 2018 to the Swedish Data Inspectorate request to state its assessment of the new request. Google remedied application meeting 2 on 12 October 2018 due to the appellant made the new request. Google deleted the search result because the content on the web page is basically the same as on the web pages that have been taken before away and especially when the website does not contain information about the complainant has been released. 2.2.2 The Data Inspectorate's assessment The Data Inspectorate notes that the original request in complaint 2 included search hit 2. This is because the appellant in a sufficient manner identified it by entering the URL that both identifies the entire discussion thread and its first page (search result 1) in the web form, partly refer to the whole thread in its supplement. In addition, a discussion thread must be judged as a whole and can not as Google has done is solely assessed on the basis of the information provided appears on the page that a search result links to. As the Svea Court of Appeal established, this follows from the fact that for an Internet user linked to one page in a discussion thread it is obvious that it does not only include posts on that page and that it is not possible based on the posts on just one page overview the content of the discussion. 14 Because Google has not processed the request, but the search hit continued has been shown until 12 October 2018, when the complainant made a new request on removal, Google has not addressed the request without undue delay in the meaning of Article 17 (1) of the Data Protection Regulation. Google has processed personal data in breach of Article 17 of the the Data Protection Regulation. 14Svea Court of Appeal judgment of 6 October 2017 in case no. FT 494-17, p. 4 with agreement in the assessment of the lower instance (p. 16 f.). Datainspektionen DI-2018-9274 1 2 (31) As stated in the previous decision is processed at the web address provided the search results lead to sensitive personal data and criminal data about the appellant within the meaning of Articles 9 and 10 of the Data Protection Regulation. During the current period, ie the 25th May to October 12, 2018, Google is responsible for the referral to the URL and in particular because the link appears in the search results as 15 presented to Internet users searching for the complainant's name. Something support for processing such data under the Data Protection Regulation not existed. Google has thus processed personal data in violation of Articles 9 and 10 of the Data Protection Regulation. Furthermore, the Data Inspectorate states that the injunction in the previous decision regarding complaint 2 included search result 2. What Google has stated about that the injunction shall be interpreted in the light of the reasons for the decision does not change it assessment. It is not clear from the wording of the decision that the injunction was limited to certain search results in complaint 2, which it did, however for example, complaints 8 and 9 (see section 1.2.1 above). It further appears from the reasons for the decision that search result 2 was the search result that was displayed when the search result was checked during the processing and thus what The Data Inspectorate assessed in the decision. Google could easily have detected this by checking the scope of the request and the search results provided was shown when the company took measures to comply with the injunction in May 2017. Because Google took action on search hit 2 only on October 12th 2018, ie after the date specified in the injunction in the previous decision, Google has failed to comply with an injunction that The Data Inspectorate announced on the basis of section 45 of the Personal Data Act and the Data Protection Directive. 2.3 Follow-up of complaints 8 2.3.1 What has emerged during the proceedings During a control search on 8 June 2018, the Data Inspectorate found that the search match from complaint no. 8 (search result 1) was still shown. The Data Inspectorate pointed this out in a letter to Google and referred to the Administrative Court Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, paragraph 46. 16See previous decision, p. 23.Data Inspectorate DI-2018-9274 1 3 (31) judgment of 2 May 2018 which upheld the injunction. It was further pointed out that According to the court, the verdict had been served on Google on the same day as it was announced and thus gained legal force on 24 May 2018. Google contacted the Data Inspectorate on 11 June 2018. Google then stated that the company was not notified of the judgment until 23 may 2018 and that it would therefore win entered into force on 14 June 2018 and that Google was still considering the ruling would be appealed. The Data Inspectorate then clarified that the Data Inspectorate had checked specifically with the administrative court that the task of the court provided on the day of service was not a misunderstanding, but reminded Google 17 on the possibility of obtaining judicial review of whether the judgment has become final. Google stated in a letter dated June 15, 2018 that the company on June 11, 2018 decided not to appeal the judgment and therefore that day had remedied application date 1. In support of the fact that service must have taken place on 23 May 2018 Google submits a service receipt signed and dated by the company agent. In addition, correspondence has taken place regarding a search match with identical content and leading to the same article as search hit 1 on the same site but with a different URL (search result 2). According to Google, there was that search hit not when the request to delete search hit 1 was made. Google has, however granted a request for deletion of search hit 2 on February 13, 2019 after a new request was received from the complainant on February 11, 2019. Google considered that that request could be granted without the need for a new balancing of interests done because the content of the web page was identical to the web page for search result 1. 2.3.2 The Data Inspectorate's assessment The Data Inspectorate finds that Google has not processed the request in complaint 8 in the previous decision so that search result 1 is not displayed during the period from 25 May 2018 to 11 June 2018. With regard to the Swedish Data Inspectorate had previously clarified in its decision that the request would be granted, which also had been confirmed by the administrative court in a judgment that Google according to its own information had in any case been served on May 23, 2018, Google can not be considered to have processed the request without undue delay within the meaning of Article 17 (1) (i) 17Acts Appendix 7 and 10–12.Data Inspectorate DI-2018-9274 1 4 (31) the Data Protection Regulation. Google has thus processed personal data in in breach of Article 17 of the Data Protection Regulation. As stated in the previous decision is processed at the web address provided the search leads to criminal information about the appellant within the meaning of Article 10 of the Data Protection Regulation. During the current period, it wants say May 25 to June 11, 2018, Google is responsible for the referral to the web page and in particular because the link appears in the search results as 18 presented to Internet users searching for the complainant's name. Something support for processing such data under the Data Protection Regulation not existed. Google has thus processed personal data in violation of Article 10 of the Data Protection Regulation. Furthermore, the Data Inspectorate finds that Google has not shown that the company has followed the injunction in the previous decision concerning complaint 8 within that time limit which was stated in the decision, which through the company's appeal may be considered to have been when the injunction became final. The Data Inspectorate states that this was on May 24, 2018, which is not changed by the circumstances and the evidence as invoked by Google. Google has thereby failed to comply an injunction issued by the Swedish Data Inspectorate on the basis of section 45 the Personal Data Act and the Data Protection Directive. Regarding search result 2, the Data Inspectorate finds that it was not covered by the original request or the Data Inspectorate's injunction because it according to Google, did not exist when the request was made. 2.4 Communication to webmasters that search results have been deleted and information about this to individuals 2.4.1 What has emerged during the proceedings If Google grants a removal request, Google has a routine to notify webmasters (that is, anyone who subscribes to Google) service "Search Console" formerly "Webmaster Tools") about which URL which has been removed and that this was done as a result of a request for removing. Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, point 46. Data Inspectorate DI-2018-9274 1 5 (31) Google's removal request webpage contains the text '[o] m URLs are removed from our search results as a result of your request we may provide information to the webmasters of the deleted URLs ”. IN connection to the text, the individual is encouraged to read the information and check a box that they approve such treatment. 19 Google has reported that 5,690 URLs have been removed upon request from Sweden during the period May 25, 2018 to February 11, 2019. The Data Inspectorate can thereby establish that information has been provided webmasters in a large number of cases. Google has further stated in essence the following. First is The Data Inspectorate is not the competent supervisory authority regarding Google's routine to send such messages. Secondly, such messages are not Processing of personal data. Third, such treatment is not included in violation of the Data Protection Regulation. This is because the messages are in compliance with the purpose limitation principle set out in Article 5.1.b, as the purpose is to facilitate the right to be forgotten. Furthermore, processing a legal basis, as Google has a legitimate interest to process the data in order to increase the impact of the right to be forgotten as well as to inform the webmaster in its capacity as concerned interested. Fourth, Google complies with the principle of proportionality obliged to balance the right to be forgotten against opinion and freedom of information. Fifth, the routine is an appropriate and proportionate action and industry practice. 2.4.2 The Data Inspectorate's assessment 22.214.171.124 The Data Inspectorate is authorized to exercise supervision in the matter The Data Inspectorate's competence follows from the main rule that each supervisory authority is competent in the territory of its own Member State (Article 55 (1) of the Data Protection Regulation). The current treatment is a step 20 in Google's search engine business and is affiliated with it obligation arising from such activities to ensure that the activities 19 Appendix 27.2, pp. 2-3. 20 See the judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 41 and the judgment of 24 September 2019, G.C. and others, C-136/17 point 35.Datainspektionen DI-2018-9274 1 6 (31) 21 meets the requirements of the Data Protection Regulation. Google has in letter of the 12th December 2018 to the data protection authorities stated that it is Google (it that is, Google LLC based in the United States) which determines the purposes and the means of that treatment and that this is not affected by them organizational changes that the company made on January 22, 2019. The 22 organizational changes referred to is that Google from this date has a principal place of business in Ireland regarding parts of their business. A principal place of business shall have the authority to: make decisions regarding the purposes and means of the treatment in question (Article 4.16 and recital 36). Google has not shown that Google Ireland has such powers in the field of search engine business. The Data Inspectorate considers because the single point of contact mechanism (Articles 56 and 60) does not is applicable and that the Data Inspectorate is thus the competent supervisory authority in the case. 126.96.36.199 The messages constitute personal data processing The Data Inspectorate finds that the messages in question are personal data and that the fact that Google sends the messages means that Google processes personal data for the following reasons. As can be seen from the expression “each information "in the definition of the concept of personal data (Article 4 (1)) shall: the term is given a broad meaning. It includes both objective and subjective information if they "refer" to a specific person, which is the case they, because of their content, purpose or effect, are attached to a person. 23 The information that Google has granted a search hit to a particular URL to be deleted refers to a person, especially since the use of the data affects the person's rights and interests, for example by being able to 24 be used to counter the purpose of the request. For that to be the case a personal data is not required that the information itself makes it possible to identify the person or that all information necessary for identification is held by a person. The question of whether someone is identifiable should assessed on the basis of the aids that can reasonably be used by someone to identify the person. A person is not considered identifiable if the risk of it in practice is negligible. In the present case, the risk is not 21EU Court Judgment of 24 September 2019, G.C. and others, C-136/17 paragraph 43. 22 Appendix 50 50 appendices 1 and 2. Judgment of the European Court of Justice of the European Communities of 20 December 2017, Nowak, C-434/16, paragraphs 34-35. 24See by analogy the judgment of the European Court of Justice of 20 December 2017, Nowak, C-434/16, paragraph 39. 25 Judgment of the European Court of Justice of 19 October 2016, Breyer, C-582/14, paragraphs 41, 43 and 46. Data Inspectorate DI-2018-9274 1 7 (31) negligible, since a granted request for removal is by definition linked to a person's name. Identification can thus be done directly about it there is only one name on the web page that the search results lead to. If it exists several names on the website, you can instead take one name at a time and search the name of the search engine. In one of these searches, the search result does not appear appear and thereby indirectly reveal that it is the person who requested and granted removal. 188.8.131.52 There is no legal support for sending the messages The Data Inspectorate finds that Google has no legal basis for the treatment and that it is also not permitted on the basis that it would be consistent with the original purposes for which the data were collected in. Google thus processes personal data without having a valid legal basis grounds for processing in breach of Articles 5 and 6 of the Data Protection Regulation. The reasons for the assessment are set out below. The notices are not supported by a legal obligation Google claims that the processing is based on a legal obligation (Article 6.1 (c) in accordance with Article 17 (2) of the Data Protection Regulation or, as may be understood, in accordance with Article 5 (4) of the EU Platforms Regulation, and that it is also to be considered as industry practice according to proposals and recommendations from the Commission. The Data Inspectorate finds that the processing is not supported by Article 17 (2) the Data Protection Regulation for the following reasons. The wording states that the provision imposes personal data controllers who have published personal data an obligation to take reasonable steps to inform personal data controllers who then reuse this personal data via links, copies or reproductions. Such an obligation to provide information does not apply search engine providers when engaging in the activity that the right to removal applies in relation to, namely to locate information such as contains personal data that has been published or posted on the internet by third men, index it automatically, store it temporarily and finally make it available to internet users according to a certain priority scheme. In addition, search engine providers, who has received a request to delete a search hit, informs it 26 Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019. 27 Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 41 and the judgment of September 24, 2019, G.C. et al., C-136/17 point 33 and 35.Datainspektionen DI-2018-9274 1 8 (31) third party who published the information on the internet as the search hit refers to. The purpose of the obligation under Article 17 (2) is to add greater responsibility for the personal data controller for the original publication which the search hit refers to and that individuals should not be forced to produce several requests for deletion. The requirements are higher for the one who originally has published the data shall grant a request for deletion than to a a search engine provider shall grant a request for deletion of a search result which refers to the original publication of the data. It can notes that the opinion of the Article 29 Working Party in the WP225 Guidelines, that messages such as those in the case current from search engine providers to webmasters do not have a legal basis under the data protection rules, 28 is still valid. The Data Inspectorate finds that the processing is not supported by Article 5 (4) i the Platform Regulation for the following reasons. First, note The Data Inspectorate that the regulation was adopted on 20 June 2019 and will be applied only from 12 July 2020 (Article 19) and thus not yet valid. For it others, it is clear from the purpose and scope of that regulation that it shall be without prejudice to Union law applicable to, inter alia in the field of data protection (Article 1.5). It is further stated that the requirements in the Platforms Regulation should not be seen as an obligation for a search engine provider to disseminate personal information to its business users and that any processing of personal data should take place in accordance with the legal framework of the Union for the protection of individuals with regard to processing of personal data and respect for privacy and protection of personal data, in particular the Data Protection Regulation (recital 35). As noted in the previous paragraph and developed in the following two sections (on legitimate interest and purpose limitation) speaks the circumstances of it the present case against the treatment being allowed or justified because the display of a search hit may be illegal without the original the publication is. A webmaster's interest in knowing that a search hit does not appear when searching on a person's name is weak compared to those interests that apply in the cases covered by the Platforms Regulation protect (recitals 1-5). Against the same background, the treatment can not, such as 28Se EDPB, Guidelines 5/2019 “on the Criteria of the Right to be Forgotten in the search engine cases under the GDPR ”(part 1), adopted on 2 December 2019 for the public consultation, pp. 4-5, with reference to the WP225 guidelines, item 23.Data Inspectorate DI-2018-9274 1 9 (31) Google alleged, is considered compatible with established and prevalent industry practice. The messages are not supported by a legitimate interest Google claims that the treatment is based on Google's legitimate interest (Article 6 (1) (f)) of 'informing the webmaster, as a key stakeholder, that a URL that links to the webmaster's webpage has been removed having regard to the [Data Protection Regulation] '. Google states that consideration should ensure that the individual is informed of and can expect treatment, which can have a positive effect on him by removing the data from the original web page. Furthermore, Google believes that the information does not constitute specific categories of personal data, minimized as far as possible and only shared with a recipient who already has access to them. The Data Inspectorate finds that Google's processing is not permitted reference to any of the interests expressed by Google. None of the conditions of Article 6 (1) (f) are met, namely the existence of a legitimate interest of the controller or third party, that the treatment is necessary for the legitimate interest sought and that the interests of the individual or fundamental freedoms and rights do not weigh heavier and requires protection of personal data. 30 Google has first stated that the treatment may lead to it webmaster deletes the original data, i.e. what gets perceived as the webmaster's interest in trying their own possible obligation to delete the information from the website. The Data Inspectorate notes, however, that the interest relied on by Google is hypothetical the time of processing, because Google does not know about it webmasters have an interest in making any such assessment. It is thus not a legitimate interest within the meaning of the Data Protection Regulation. 31 The treatment can then also not be considered necessary. The webmaster interests can, in a balance of interests, also not be considered to outweigh those registered fundamental rights and freedoms. 29Act Annex 45, p. 14. 30 See the judgment of the European Court of Justice of 4 May 2017, Rīgas satiksme, C ‑ 13/16, paragraph 28. Judgment of the European Court of Justice of the European Communities of 11 December 2019, TK, C ‑ 708/18, paragraph 44.Datainspektionen DI-2018-9274 2 0 (31) In addition, Google has invoked the public's legitimate interest in Google does not make erroneous removal decisions. The Data Inspectorate finds that Google only sends the messages after Google has already deleted one search hit, ie after Google has already made the required balance in order not to make wrong decisions. It is thus not an actual interest in the time of treatment. It is thus not a legitimate interest in 32 meaning of the Data Protection Regulation. If what Google has stated regarding incorrect decisions should instead be perceived as that the legitimate interest is the public interest in making wrong decisions whether deleting search results afterwards can be corrected to is The Data Inspectorate's assessment is that the processing is not necessary. The information that Google has removed a URL is not sufficient to the webmaster should be able to assess whether the decision is incorrect, then it webmasters lack knowledge of what the individual has stated in their request. The Data Inspectorate also assesses that the individual's interests weigh heavier based on the following circumstances. The fact that the data protection authorities in the WP225 guidelines (paragraph 23) explicitly advised against search engine providers from submitting such messages argue that it would be permissible in a balance of interests. Only Google and the individual know that Google has granted one request for removal. By Google disclosing the information to third parties this is a more serious violation than if the data had been publicly available.33 The disclosure of the information to the webmaster also takes place without adequate safeguards, as Google has not shown that the company can guarantee or have any opportunity to influence that the webmaster does not use the information in an improper manner or that the information is not disclosed to third-party webmasters who are not subject to adequate safeguards. As for the legitimate expectations of the individual, Google certainly has informed in its web form that the treatment may take place, but Judgment of the Court of Justice of the European Communities of 11 December 2019, TK, C ‑ 708/18, paragraph 44. 33 Judgment of the European Court of Justice of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C ‑ 468/10 and C ‑ 469/10, paragraph 45. Data Inspectorate DI-2018-9274 2 1 (31) has done this in a misleading way that gives the impression that the treatment must be approved by the individual for the removal request to is handled, or that the processing follows from Google's legal obligation to handle request. It must be borne in mind that Google has not informed them registered that the legal basis for the processing is justified interest pursuant to Article 6 (1) (f) (Article 13 (1) (c)), the company or third parties legitimate interests which make the treatment necessary (Article 13 (1) (d)) or the company's intention to transfer the data to third countries (Article 13 (1) (f)). It has nor has it emerged that Google has expressly notified the individual on the right of the individual under Article 21 (1) to object at any time treatment based on a legitimate interest and clearly stated, clear and distinct from other information (Article 21 (4)). Against this background, the treatment is not allowed on the basis of a justified interest. The messages are not compatible with the original purpose Finally, Google claims that the sending of the message is compatible with the original purpose for which the data was collected, ie Google obligation to remove search results in certain cases on request (Article 17 (1) and (3)). According to Google, the purpose of the treatment is to “give the webmaster one possibility to delete the actual content of the web page, as this increases impact on the right to be forgotten ”. Google thus claims that the company sends these messages in accordance with Article 6 (4) of the Data Protection Regulation. The Data Protection Regulation contains criteria for determining whether a processing for other purposes is consistent with the purposes for which the data originally collected or if the treatment violates the principle of purpose limitation in Article 5 (1) (b) of the Data Protection Regulation (points (a) to (e) (i) Article 6 (4) and recital 50). Several of the circumstances that are relevant according to these criteria have already been described in the previous section and will therefore only summarized here. The Data Inspectorate states that the current processing is unfounded with the consent of the data subject or Union law or that of the Member States national law. Furthermore, the Data Inspectorate states in accordance with the criteria in Article 6 (4) that the link between the objectives (point (a)) is weak; as stated in the previous section, the possibilities of the data subjects and rights regarding requests to search engine suppliers and the Swedish Data Inspectorate DI-2018-9274 2 2 (31) website owners are not equivalent. The context is not like that either that the latter treatment is what the individual can typically expect (point (b)), which is not altered by the information provided by Google the treatment in its web form as that information is misleading. To a request for removal made and granted may in itself be considered as personal data of a privacy-sensitive nature (point c). In addition, it speaks for itself that a request for removal has been granted to the underlying the information on the website is often such particularly sensitive information or criminal offenses referred to in Articles 9 and 10 of the Data Protection Regulation. The consequences of the subsequent treatment (point d) can generally be considered negative for the individual and can even be used to counteract the purpose of request. The individual is also not obliged to turn first or at the same time to the webmaster where the data was published and request that it be deleted and can also be assumed to have a worse chance of success with one request due to the fact that the original publication may have a stronger freedom of expression protection. In addition, knowledge of the search engine granted a request is assumed to entail the risk that some webmasters will try circumvent the deletion decision by republishing the information on a other address or otherwise disseminate them. As stated above, Google has has not shown that the company has set up any guarantees or protective measures to counteract this (point e). Google does not test the suitability of sending the messages in the individual case and also does not offer the individual any opportunity to object. Google's routine in general to deal with deletion, namely only based on specific URLs, with requirements for new requests even when the same content is republished, entails a risk that individuals are exposed to unnecessary suffering as a result of the treatment. An example of this is search result 2 i complaint 8, where the company had blocked the search hit as the Data Inspectorate resubmitted, but where the same content reappeared in the search results then the webmaster republished the content on the same site, but on a new URL. The individuals themselves must monitor and react to any republishing in the company's search services. This erodes the effectiveness of their rights and is therefore not in their interest. Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 83 and 85 and the judgment of September 24, 2019, G.C. and others, C-136/17, paragraph 52 and Opinion of the Advocate General at the sitting, Item 81.Data Inspectorate DI-2018-9274 2 3 (31) The Data Inspectorate finds that Google does not support Article 6 (4) and that the procedure infringes the principle of purpose limitation in Article 5 (1) (b) of the Data Protection Regulation. 184.108.40.206 The information to individuals violates the principle of transparency Google has stated that the purpose of the information to the individuals in the web form that messages are sent to webmasters is that meet the requirements of the right to information and the principle of legality, accuracy and transparency and that this follows from practice. 35 The Data Inspectorate does not question that Google is obliged to inform them registered which recipients will have access to their information pursuant to Article 13 (1) (e), but notes that the obligation to provide information is intended to: protect the data subjects. As stated in the previous section, it is current transfer is illegal and to the detriment of the individual. Like there too Google has provided misleading information to individuals about it legal basis on which the treatment is based. In addition, the data protection authorities jointly, and the Data Inspectorate in particular, previously alerted Google to the shortcomings of the routine of submitting such messages without Google fixing it. In addition, Google requires that they individuals approve the procedure for submitting a request for removing. Against this background, the information provided by Google appears leaves to individuals about the treatment as misleading in a way that may considered to be conducive to persuading individuals to refrain from exercising their right to request removing. By doing so, Google is processing personal data in violation of the principle of transparency in Article 5 (1) (a) of the Data Protection Regulation. 3 Choice of intervention 3.1 Possible intervention measures The Data Inspectorate has a number of corrective powers available according to Article 58 (2) (a) to (j) of the Data Protection Regulation, inter alia to impose it Judgment of the European Court of Justice of 16 January 2019, Deutche Post AG, C-496/17, paragraph 59 and Judgment of 1 October 2015, Bara and Others, C-201/14, paragraph 34. Judgment of the European Court of Justice of 7 May 2009, Rijkeboer, C-553/07, paragraphs 34-35. Data Inspectorate DI-2018-9274 2 4 (31) personal data controller to ensure that the processing takes place in accordance with Regulation and, if necessary, in a specific way and within a specific period. Of point (i) of Article 58 (2) and Article 83 (2) of the Data Protection Regulation it appears that the Data Inspectorate has the authority to impose administrative penalty fees in accordance with Article 83. Depending on the circumstances of in the individual case, administrative penalty fees shall be imposed in addition to or in instead of the other measures referred to in Article 58 (2). Furthermore, it appears from the article 83.2 which factors are to be taken into account when deciding on administrative penalty fees shall be imposed and in determining the size of the fee. If it is a question of a minor violation, the Data Inspectorate receives according to what set out in recital 148 of the Data Protection Regulation instead of imposing a issue a reprimand in accordance with Article 58 (2) (c) aggravating and mitigating circumstances in the case, such as the infringement nature, severity and duration as well as previous violations of relevance. 3.2 Order The Data Inspectorate has found that Google by regularly submitting notification to webmasters that search results have been removed processing personal data in breach of Articles 5 (1) (b) and 6 of the Data Protection Regulation. Furthermore, it has been found that Google provides misleading information about the transmission of such messages in a manner contrary to Article 5 (1) (a) (i) the Data Protection Regulation. Google should therefore be instructed to ensure that the processing of these parts takes place in in accordance with the Data Protection Regulation as follows. The Data Inspectorate submits pursuant to Article 58 (2) (d) i Google's Data Protection Regulation that, as far as removal requests are concerned of displaying search results when searching for individuals' names using Google search services that can be done from Sweden, stop informing webmasters of URLs when Google has granted a request except in cases where the individual has requested det.Datainspektionen DI-2018-9274 2 5 (31) cease to display the text “If URLs are removed from ours search results as a result of your request, we can provide information to them webmasters for the deleted URLs ”in their web form for request for removal or provide similar information to individuals if it is not clear that webmasters are only informed about that a request has been granted if the individual has requested it. 3.3 Circumstances of significance for whether a penalty fee is to be imposed 3.3.1 What Google has stated Google has stated that in the case of complaints 2 and 8, these are isolated cases events concerning two individual data subjects and are consequences of acceptable and well-founded interpretations of applicable law. It can not be consistent with the intent or overall purpose of the Data Protection Regulation to impose excessive penalties for infringements relating to individual material interpretations of existing right with little or no impact on data subjects. In the present case has no damage was shown at all with respect to the alleged the infringements. If high levels of sanctions were to be applied for relatively small infringements and isolated events and with little or no impact on registered, they would risk as a tool to ensure compliance lose its effect because data controllers would have nothing incentives to strive for compliance at a systematic level. In summary, Google claims that the following circumstances should considered mitigating. It is a matter of isolated events, which have been going on for a limited time and concerns a limited number of registered who have not suffered any damage as a result of the alleged infringements. Google has notified the data subjects that they can complain to the Data Inspectorate. Google has has not been intentional or has been negligent and cannot be considered as principal or solely responsible. Google complies with the Data Protection Regulation on a systematic level and act in accordance with a code of conduct by following WP225 guidelines. Google has cooperated with the Data Inspectorate. Google have not gained any financial benefits or avoided losses. 3.3.2 Assessment of the infringement concerning complaints 2 In the mitigating direction, the circumstance speaks that the infringement only concerns one person.Datainspektionen DI-2018-9274 2 6 (31) The following circumstances point in an aggravating direction. The violation is a step in a systematic procedure because it follows the procedures of Google. Further are the current categories of data, such as sensitive data and criminal offenses, particularly worthy of protection. If a search result leads to a web page with such personal information about a person, it can have a significant impact on his fundamental rights with respect to privacy and the protection of personal data and constitute an exceptional 37 serious intervention. It should typically result in damaged reputation, unauthorized disclosure and significant financial disadvantage for individuals, whereby it should be mentioned that the appellant in the present case has likened the effect of the violation that a professional ban would have been issued against him. 38 Google has not taken sufficient measures to alleviate the damage, but let the search meeting remains despite the Data Inspectorate's previous decision. The infringement has lasted for about 4.5 months during the time that the Data Protection Ordinance has been applicable. Because the procedure followed Google's procedures, this is not the case an individual mistake without the action has been done intentionally. It can too finds that Google has failed to comply with the order The Data Inspectorate announced in the previous decision on the basis of section 45 the Personal Data Act and the Data Protection Directive to cease the treatment. Because Google requires individuals to enter an exact URL in Google's web form and does not investigate requests covers more than that, the company at least indirectly avoids costs. 3.3.3 Assessment of the infringement concerning complaints 8 In the mitigating direction, the circumstances indicate that the infringement only concerns one person and that the time the infringement has been going on while data protection ordinance has been applicable, about two weeks, is a relative short time. The following circumstances speak in an aggravating direction. The Data Inspectorate has found that Google had failed to comply with the order the supervisory authority announced in the previous decision on the basis of § 45 the Personal Data Act and the Data Protection Directive to cease processing and which became final on May 24, 2018. Google has done regarding that the company intended to comply with a legally binding agreement 37 European Court of Justice judgment of 24 September 2019, G.C. and others, C-136/17, paragraphs 44 and 46. 38 See file appendix 31, p. 2.Data Inspectorate DI-2018-9274 2 7 (31) injunction, but on the other hand has not shown due diligence by correcting itself at the discretion of the regulatory authority by temporarily restricting the display of the search results pending court review or even when Google according to own information on 23 May 2018 was served the judgment that upheld Data Inspectorate assessment. Regarding the current categories of information has been about criminal information, which is particularly sensitive to privacy. If a search result leads to a web page with such personal information about one person, it can have a significant impact on their fundamentals rights regarding respect for privacy and the protection of personal data and constitute a particularly serious interference. It dared typically result in damaged reputation, unauthorized disclosure and significant financial disadvantage for individuals, whereby it should be mentioned that the appellant in it The present case has been likened to the effect of the infringement by a professional ban should have been communicated to him. Google has not taken enough measures to alleviate the damage, but left the search hit in spite The Data Inspectorate's decision and the court's judgment. Because the procedure followed Google's routines have been intentional. Assessment of the infringement regarding notification to webmasters and information to individuals The following circumstances are aggravating. The infringement intended to send message is such that it erodes the effectiveness of the right to removal and affects anyone who has been granted a removal request. For the current period, potentially 5,690 people can be covered by procedure. The infringement regarding misleading information affects anyone who may have an interest in making such a request. The current category of information, ie that someone has requested and been granted removal, may typically considered to be a task for which the individual does not want to be disclosed the webmaster or someone else, as the task can be used for to counteract the purpose of the request. The infringements thus cause damage in form of lost opportunity for the individual to exercise their rights, lack of control over their personal data and unauthorized disclosure. The infringements has been going on since May 25, 2018 and is still going on. It appears from the investigation into the case that Google has been aware of the treatment and so that it was done intentionally. Since the procedure can be assumed to entail that Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, paragraphs 44 and 46. 40The previous decision, p. 31.Data Inspectorate DI-2018-9274 2 8 (31) Individuals refrain from requesting removal Google avoids in any case indirect costs. 3.3.5 Penalty fees shall be imposed The proceedings covered by this supervision concerning complaints 2 and 8 thereof previous decision has meant that Google processes data such as The Data Inspectorate in previous decisions found that Google treated in violation of the Personal Data Act and the Data Protection Directive and instructed Google to cease. It can thus not be considered an excuse, material misinterpretations. It also shows a lack of respect for the rights of individuals and are thus not minor infringements within the meaning of recital 148 in the preamble the Data Protection Regulation. There is thus no reason to replace one penalty fee with a reprimand. There is no other corrective action current. Google will therefore be subject to administrative penalty fees for the infringements. The procedure to send message to webmasters and the information provided to the individual in the web form is done systematically and at risk to put the right to removal out of play. It's not about less infringements. There is no reason to replace a penalty fee with one reprimand. Nor is it enough that Google is ordered to cease with the procedure. Google will therefore be subject to administrative penalty fees also for these violations. 3.4 Determination of the amount of the penalty fee 3.4.1 General provisions According to Article 83 (1) of the Data Protection Regulation, each supervisory authority shall: ensure that the imposition of administrative penalty fees in each individual cases are effective, proportionate and dissuasive. The Data Inspectorate has found that Google has violated Articles 5, 6, 9, 10 and 17 of the Data Protection Regulation. These Articles are covered by Article 83 (5), which means that a higher penalty amount can be imposed. According to ch. 6 Section 3 of the Data Protection Act, the Data Inspectorate may also levy one penalty for infringements of Article 10 of the Data Protection Regulation and shall then apply Article 83 (1), (2) and (3) and determine the amount of the fee pursuant to Article 83 (5). Data Inspectorate DI-2018-9274 29 (31) According to Article 83 (3), the administrative penalty fee may not exceed the amount of the most serious infringement in the case of one or the same data processing or interconnected data processing. As regards the calculation of the amount, Article 83 (5) (i) the Data Protection Regulation that companies that commit infringements are the ones in question may be subject to penalty fees of up to EUR 20 million or four percent of total global annual sales in the previous financial year, depending on which value is highest. 3.4.2 The amount at which penalty fees can be determined When determining the maximum amount for a penalty fee to be imposed on one companies, the definition of the term company must be used as the European Court of Justice apply in application of Articles 101 and 102 of the TFEU (see recital) 150 of the Data Protection Regulation). It is clear from the case - law of the Court that this includes any entity engaged in economic activities, regardless of the entity's legal form and method of financing and whether the entity in legal meaning consists of several natural or legal persons. 41 The Data Inspectorate assesses that the company's turnover is to be added basis for calculating the administrative penalty fees that Google can imposed is Google's parent company Alphabet Inc (Alphabet). Of collected data, Alphabet's global annual sales in 2018 were approximately 136,819,000,000 US dollars (USD), which is equivalent to approximately 119,500,000,000 euros 43 44 (EUR). This corresponds to approximately SEK 1,280,000,000,000. The highest the amount of the sanction that can be determined in the case is four percent of this amount, that is to say about 51 200 000 000 (fifty-one billion two hundred million) kronor. 41Article 29 Working Group, Guidelines for the application and determination of administrative penalty fees in accordance with Regulation 2016/679 (WP253 Guidelines), p. 6. 42A ktbilaga 40, s. 47. 43 Based on the exchange rate USD to EUR as of March 9, 2020 according to European central banks, 0.8729. 44Due to the exchange rate EUR to SEK as of March 9, 2020 according to European central bank, 10.7203.Data Inspectorate DI-2018-9274 3 0 (31) 3.4.3 Determining the size of the penalty fee In order for penalty fees to be effective and dissuasive, according to The Data Inspectorate's opinion on the turnover of the data controller be taken into account in determining the size of the penalty fees. One proportionality assessment must also be made in each individual case. In a proportionality assessment, one must ensure that the penalty fee does not become too high in relation to the current infringements. Thereby shall take into account that the complaints concern two people and that the routine to regularly notify webmasters of deletion and information to individual refers Sweden and in the current case can amount to 5,690 registered. At the same time penalty fees must be effective and dissuasive. Overall, the Data Inspectorate finds that an efficient, proportionate and dissuasive penalty for the infringements found Complaints 2 and 8 are SEK 25,000,000 (twenty-five million) message to webmasters and misleading information to individuals is 50,000,000 (fifty million) kronor. Against this background, the Data Inspectorate decides with the support of ch. § 3 the Data Protection Act and Articles 58 (2) and 83 of the Data Protection Regulation that Google will pay an administrative penalty fee of 75,000,000 (seventy-five) million). This decision was made by Director General Lena Lindgren Schelin after presentation by the lawyer Olle Pettersson. At the final processing also has General Counsel Hans-Olof Lindblom, Unit Manager Catharina Fernquist and lawyer Nidia Nordenström participated. Lena Lindgren Schelin, 2020-03-10 (This is an electronic signature) 3.5 Appendices Appendix 1 - How to pay a penalty feeData Inspectorate DI-2018-9274 3 1 (31) 4 How to appeal If you want to appeal the decision, you must write to the Data Inspectorate. Enter i the letter which decision is being appealed and the change you are requesting. The appeal must have been received by the Data Inspectorate no later than three weeks from the day you received the decision. The Data Inspectorate sends the appeal on to the Administrative Court in Stockholm for review if the inspection does not yourself change the decision in the way you have requested. You can e-mail the appeal to the Data Inspectorate if it does not contain any privacy-sensitive personal information or information that may be covered by secrecy. The authority's contact information can be found on the first page of the decision.