Datainspektionen - DI-2018-9274

From GDPRhub
Datainspektionen - DI-2018-9274
LogoSE.png
Authority: Datainspektionen (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 5(1)(b) GDPR
Article 5(1)(a) GDPR
Article 6 GDPR
Article 9 GDPR
Article 10 GDPR
Article 17 GDPR
Type: Investigation
Outcome: Violation Found
Decided: 10.03.2020
Published: 10.03.2020
Fine: 75000000 SEK
Parties: n/a
National Case Number/Name: DI-2018-9274
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): Swedish
Original Source: Datainspektionen (in SV)
Initial Contributor: Charlotte Godhe

The Swedish DPA (Datainspektionen) imposed a fine of 75 million Swedish kronor (approximately € 7 million) on Google for failing to fulfill its obligation in respect of the right to be forgotten (Article 17 GDPR).

English Summary[edit | edit source]

Facts[edit | edit source]

The Swedish DPA finalised an audit of Google’s handling of individuals’ right to have search result listings for searches that includes their name in 2017. In its decision, the DPA concluded that a number of search result listings should be removed and subsequently ordered Google to do so.

During the DPA’s follow-up audit in 2018, it was critical to the fact that Google did not properly remove two of the search result listings that the DPA had ordered them to remove back in 2017. In one of the cases, Google has done a too narrow interpretation of what web addresses need to be removed from the search result listing. In the second case, Google has failed to remove the search result listing without undue delay. Google claimed it had followed the order and that the handling of the delisting requests had been lawful.

Further, when Google removes a search result listing, it notifies the website to which the link is directed in a way that gives the site-owner knowledge of which webpage link was removed and who was behind the delisting request. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. The DPA criticised this practice, alleging it puts the right to delisting out of effect. However, Goggle claimed this practice has been in accordance with Article 6.1(f) GDPR.

Dispute[edit | edit source]

The dispute concerned whether Google had followed the DPA’s order and sufficiently removed search links on request of data subjects or not.

It was also in dispute if Google’s practice to inform site-owners of the removal of search results had a legal basis.

Holding[edit | edit source]

The DPA held that Google had not complied with the previous order by the DPA by failing to remove search links sufficiently and within a reasonable time. Google had, therefore, processed personal data in violation of the GDPR.

The DPA also held that Google had processed personal data in violation of Articles 5(1)(b) and 6 GDPR by sending notifications to webmasters that search results had been deleted. Furthermore, the notice given to data subjects concerning these notifications was found misleading in a manner contrary to Article 5 (1)(a) GDPR.

Comment[edit | edit source]

For a deeper understanding of the right to request delisting under Article 17 GDPR, the following case and EDPB guidelines can be helpful:

Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, judgment of 13 May 2014.

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

                                                        Decision Diary No. 1 (31)
                                                        2020-03-10 DI-2018-9274






                                                        Google LLC

                                                        Amphitheater Parkway, Mountain
                                                        View, CA 94043

                                                        United States






                  Supervision according to the EU Data Protection Regulation

                  2016/679 - Google's handling of requests


                  on removal from its search services


                  Table of Contents
                  The Data Inspectorate's decision ....................................... 2

                  1 Report on the supervisory matter ............................. 4

                     1.1 General ................................................ .................................................. ........ 4

                     1.2 The content of previous decisions as far as is now relevant .......................................... ..6

                       1.2.1 Order concerning complaints 2 and 8 ......................................... ... 6

                       1.2.2 Obligation to investigate the circumstances of a request ....................... 7

                       1.2.3 Communication to webmasters that removal has taken place .......... 8

                  2 Grounds for the decision ........................................... 8

                     2.1 Starting points for the assessment of follow-up complaints ....................... 8

                     2.2 Follow-up of complaint 2 ............................................. ........................... 9

                       2.2.1 What has emerged during the proceedings ............................ 9
                       2.2.2 The Data Inspectorate's assessment ............................................. .............. 11

                     2.3 Follow-up of complaint 8 ............................................. ............................ 12

                       2.3.1 What has emerged during the proceedings ........................... 12

                       2.3.2 The Data Inspectorate's assessment ............................................. .............. 13

                     2.4 Communication to webmasters that search results have been deleted
                     and information about this to individuals ............................................ ............... 14

                       2.4.1 What has emerged during the proceedings ........................... 14



Postal address: Box 8114, 104 20 Stockholm E-mail: datainspektionen@datainspektionen.se
Website: www.datainspektionen.se Phone: 08-657 61 00Datainspektionen DI-2018-9274 2 (31)






                          2.4.2 The Data Inspectorate's assessment ............................................. ............. 15


                     3 Choice of intervention ........................................... 23

                       3.1 Possible intervention measures ............................................... ........................ 23

                       3.2 Injunction ................................................ .............................................. 24

                       3.3 Circumstances of significance for whether a penalty fee should be imposed ......... 25

                          3.3.1 What Google has stated ........................................... ........................... 25

                          3.3.2 Assessment of the infringement concerning complaint 2 .......................... 25
                          3.3.3 Assessment of the infringement concerning complaint 8 .......................... 26

                          Assessment of the infringement relating to notification to

                          webmasters and information to individuals ............................................ 27

                          3.3.5 Penalty fees shall be imposed ............................................ ................. 28

                       3.4 Determining the size of the penalty fee ............................................ 28

                          3.4.1 General provisions ............................................. ......................... 28

                          3.4.2 The amount for which penalty fees can be set .................... 29

                          3.4.3 Determining the size of the penalty fee .................................... 30

                       3.5 Appendices ................................................ .................................................. ....... 30

                     4 How to appeal .......................................... 31





                     The Data Inspectorate's decision

                     1. The Data Inspectorate finds that Google LLC (Google) has not taken

                     measures so that a certain search result in complaint 2 in the Data Inspectorate's earlier
                     supervisory decision with registration number 1013-2015 is not displayed for searches on

                     the complainant's name using Google's search services that can be made from
                     Sweden during the period May 25, 2018 to October 12, 2018. Google has

                     through this processed personal data in violation of
                          Article 9 of the Data Protection Regulation by dealing with sensitive

                             personal data consisting of data on ethnicity, religious



                     REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016

                     on the protection of individuals with regard to the processing of personal data and on the Data Inspectorate DI-2018-9274 3 (31)






                          conviction, mental health and sexual life, without having for treatment

                          a valid exemption from the ban on treating sensitive
                          personal data.

                       Article 10 of the Data Protection Regulation by considering
                          personal data relating to offenses consisting of data on

                          prosecution and preliminary investigation without the treatment being allowed.

                       Article 17 of the Data Protection Regulation by not unnecessarily
                          have delayed the complainant's request for removal.


                  2. The Data Inspectorate finds that Google has not taken any action so that

                  a certain search result in complaint 8 in the Data Inspectorate's previous supervisory decision with
                  registration number 1013-2015 is not displayed for searches on the complainant's name with
                  using Google's search services that can be made from Sweden during the period

                  May 25, 2018 to June 11, 2018. Google has dealt with this
                  personal data in violation of

                       Article 10 of the Data Protection Regulation by considering

                          personal data relating to offenses consisting of data on
                          allegations of crime and preliminary investigation without processing

                          been allowed.
                       Article 17 of the Data Protection Regulation by not unnecessarily

                          have delayed the complainant's request for removal.


                  3. The Data Inspectorate finds that Google since May 25, 2018
                  regularly informs webmasters of websites when the company has taken

                  deleted a URL as a result of a removal request. Google
                  thereby processes personal data in violation of

                       Article 5 (1) (b) of the Data Protection Regulation in that the procedure constitutes a
                          personal data processing that is incompatible with the original

                          purpose for which the data were collected.
                       Article 6 of the Data Protection Regulation by not having a legal

                          basis for the treatment.


                  4. The Data Inspectorate states that Google since 25 May 2018 in its
                  Web forms for removal requests inform individuals about and

                  requires them to agree that Google may inform them


                  free flow of such data and repealing Directive 95/46 / EC (General

                  Data Protection Ordinance) .Data Inspectorate DI-2018-9274 4 (31)







                   webmasters for such URLs that are removed from the search results to

                   as a result of individual requests. Google deals with this
                   personal data in violation of

                        Article 5 (1) (a) in that the procedure is intended to persuade individuals to
                           refrain from exercising its right to request removal.


                   5. The Data Inspectorate decides on the basis of ch. Section 3 of the Data Protection Act and 2

                   Articles 58 (2) and 83 of the Data Protection Regulation require Google to pay a
                   administrative penalty fee of SEK 75,000,000 (seventy-five million).



                   6. The Data Inspectorate submits pursuant to Article 58 (2) (d) i
                   Google's Data Protection Regulation that, as far as removal requests are concerned

                   of displaying search results when searching for individuals' names using
                   Google search services that can be done from Sweden,

                        stop informing webmasters of URLs when Google
                           has granted a request except in cases where the individual has requested

                           the.
                        cease to display the text “If URLs are removed from ours

                           search results as a result of your request, we can provide information to them

                           webmasters for the deleted URLs ”in their web form
                           for request for removal or provide similar information to

                           individuals if it is not clear that webmasters are only informed about
                           that a request has been granted if the individual has requested it.




                   1 Report on the supervisory matter


                   1.1 General

                   In May 2015, the Swedish Data Inspectorate started with the support of the Personal Data Act
                   (1998: 204) and the Data Protection Directive a supervisory case with a record number

                   1013-2015 (the former case) against Google Inc. whose legal successor is

                   Google LLC (Google or Company). The review was about how Google handles it
                   requests from natural persons that certain search results should not be displayed at



                   2 The Act (2018: 218) with supplementary provisions to the EU Data Protection Regulation.
                   3
                     Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995 on the protection of
                   individuals with regard to the processing of personal data and on the free flow of
                   such information.Datainspektionen DI-2018-9274 5 (31)








                    searches on their name on the company's search services (removal request).

                    The review took place in the light of the ruling that stated that individuals are right
                    to be granted in certain cases a request for removal and 4

                    data protection authorities' guidelines for interpreting the judgment (WP225-
                                  5
                    guidelines) and this right (right of removal).


                    In addition to Google's handling of removal requests in general included in

                    The review also includes 13 complaints received by the Data Inspectorate from

                    individuals who believed that the company had incorrectly rejected their respective request
                    on removal. The review was terminated by decision of 2 May 2017

                    (the previous decision). In the decision, the Data Inspectorate presented Google with the latest

                    take action on 2 August 2017 regarding five of the complaints (Nos. 2, 4, 5, 8)
                    and 9) in such a way that the specified search results are not displayed during searches on

                    the names of the complainants. The Data Inspectorate also made recommendations

                    on how such requests should be handled. Google appealed the injunction
                    regarding complaint no. 8. The appeal was rejected on 2 May 2018 in this part

                    and entered into force on 24 May 2018. 7


                    On 25 May 2018, the Data Protection Ordinance began to be applied.



                    Based on tips from the public that Google had not followed the decision
                    and the judgment, the Data Inspectorate stated during an inspection on 8 June 2018 that

                    search results from complaints 2 and 8 were still displayed. Against this background

                    this supervisory matter was initiated.





                    4
                      Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12.
                    5 Article 29 Working Party on Data Protection, “Guidelines on the Enforcement of Judgments
                    [Google Spain and Google] ”of 26 November 2014 (WP 225). The working group has in and

                    with the entry into force of the Data Protection Regulation replaced by the European Data Protection Board
                    (EDPB) (see Articles 68 and 94 (2) of the Data Protection Regulation).
                    6 The decision in its wording following the decision on reconsideration of 14 July 2017. References to

                    the decision in the following refers to the decision in this wording.
                    7 The Administrative Court in Stockholm's judgment of 2 May 2018 in case no. 16590-17.
                    The Data Inspectorate appealed the Administrative Court's judgment in the part in which it went

                    The Data Inspectorate received, ie. repeal of the injunction 'in the part intended to remove
                    search results that can be displayed when searching on the registrant's name using Google

                    LLC's search services that can be done from countries other than Sweden ”. The Court of Appeal decided
                    on 3 December 2018 in case no. 4635-18 not to grant leave to appeal, which was established
                    by the decision of the Supreme Administrative Court on 11 September 2019 in case no. 6887-18.Data Inspectorate DI-2018-9274 6 (31)






                  The supervision has taken place through correspondence. The review is about how Google is doing

                  handled the complainants' requests and the Data Inspectorate's injunctions
                  concerning complaints 2 and 8 in the previous decision. Against the background of what

                  has emerged, the Data Inspectorate has also followed up on certain issues as well
                  highlighted in the recommendations of the decision. This refers to how Google investigates

                  removal requests as well as Google's routine to provide regular information
                  webmasters for relevant URLs once a request has been granted and

                  Google's information to individuals about this in Google's web form for
                  request for removal.


                  1.2 The content of previous decisions as far as is now relevant


                  1.2.1 Order concerning complaints 2 and 8

                  In the previous decision, the Data Inspectorate stated that Google "processes
                  personal data in violation of section 5 a, second paragraph of the Personal Data Act on display

                  of search results after searching for the complainant's name in Google's search services regarding
                  the search results referred to in

                       Complaint 2 (Google No. 0-5877000003906)
                       […] [och]

                       complaint 8 (Google no. 1-8544000003955), the search hit that links to one
                          article on the website www.sydsvenskan.se. ”


                  The Data Inspectorate instructed Google to “take action to address the above
                  the search results are not displayed when searching on the complainant's name using

                  Google search services that can be done from Sweden "and stated that" [the] measures
                  must be completed by 2 August 2017. "


                  The Data Inspectorate stated in the reasons for the previous decision regarding complaints

                  2 that the public interest in having access to the information on the appellant in
                  the current discussion thread via search in Google search services does not

                  justifies the breaches of privacy that the treatment entails. This against
                  given that the current discussion thread is extensive

                  survey of the complainant and reports fairly extensively and at most
                  private information about the complainant's ethnicity, religious beliefs, mental

                  health, sexual preferences, offenses (information on prosecution and
                  preliminary investigation), family and address. Google was thus ordered to cease

                  with the treatment. The company did not appeal the decision. Data Inspectorate DI-2018-9274 7 (31)







                   The Data Inspectorate stated in the reasons for the previous decision regarding complaints
                   8 that the Data Inspectorate limited its review to the search result that leads

                   to an article published on Sydsvenskan's website with information about crime
                   which the complainant is alleged to have committed (information on allegations of crime and

                   ongoing preliminary investigation). The Data Inspectorate judged that such information
                   may be considered particularly sensitive to privacy and instructed Google to cease

                   the treatment. The company appealed the decision to the administrative court as in the judgment
                   of 2 May 2018 agreed with the Data Inspectorate's assessment and confirmed
                            8
                   the decision.


                   1.2.2 Obligation to investigate the circumstances of a request
                   In the previous decision, the Data Inspectorate mainly stated the following (see

                   pp. 11–14). There are no formal requirements for a request for rectification under
                   the Data Protection Directive or the Personal Data Act. When it comes to handling

                   a request may, even if the provision in section 28 of the Personal Data Act is not
                   directly applicable in this case, the preparatory work for that provision serve as

                   guidance. According to these, it is sufficient that it appears from a request that
                   the data subject is dissatisfied with the processing in any particular respect and

                   wants correction to be taken. If such a request is made, it should
                   personal data controllers urgently investigate the allegations

                   the remarks are justified and, if so, make corrections as soon as possible.
                   The scope of the investigation may depend on the remarks made by it

                   registered have produced. It should in the first instance be the responsibility of the individual to state
                   sufficient information to enable Google to process his request.

                   Information on which search hit is meant by a request should preferably be made
                   is identified by entering the URL of the web page being searched

                   links to. In cases where the individual refers to the name of a website, a
                   blog or similar and it is possible to identify the website and it

                   information on the website in question, it should be the responsibility of Google to take action
                   to identify the search result to which the request relates. The same goes for it

                   individual has mistaken the top level domain in the web address for example .se i
                   instead of .com and it appears from, among other things, the search result which search result

                   to which the individual refers. About Google, despite investigative measures taken,

                   considers that it is not possible to identify the search hit as the individual
                   has requested that Google remove or if Google does not accept the individual




                   8 The Administrative Court in Stockholm's judgment of 2 May 2018 in case no. 16590-17, p. 12 para. 2.Datainspektionen DI-2018-9274 8 (31)







                   facts of the case, the individual should be informed of this and given

                   opportunity to complete their tasks.


                   Against this background, the Data Inspectorate recommended that Google take action
                   necessary measures to investigate a vague and incomplete request to:

                   search results should be deleted.


                   1.2.3 Communication to webmasters that removal has taken place

                   In the previous decision, the Swedish Data Inspectorate mainly stated the following (p.
                   19-20). When Google deletes a search result, the company sends another message

                   the webmaster whose web page is affected if he or she has signed up
                   Google's Webmaster Tools service. In the complaints examined occur

                   usually only one or a few names of the web pages that the search hits

                   links to. It should therefore be relatively easy for the webmaster to
                   determine who has requested removal. Google must therefore assume that

                   information about which web pages are affected by a deletion indirectly
                   involves a personal data processing.


                   Against this background, the Data Inspectorate recommended that Google only

                   send information to webmasters when it is clear that such information
                   does not infringe on the privacy of data subjects.




                   2 Grounds for the decision



                   2.1 Starting points for the assessment of follow-up complaints
                   A search engine provider must, within the framework of its responsibilities, its qualifications and

                   ensure that the processing of personal data in
                   the business meets the requirements of the data protection rules, since the business

                   can significantly affect fundamental rights regarding
                                                                                               9
                   privacy and the protection of personal data of the persons concerned.
                   The characteristics of a search engine's business do not mean that it is excluded

                   the prohibitions and restrictions on the processing of sensitive data and




                   Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 38

                   and 83.
                   Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 41.Data Inspectorate DI-2018-9274 9 (31)







                   criminal information, but these apply when the search engine has received a request
                   on removal. 11


                   The Data Inspectorate states that if a personal data controller has taken

                   receive a request for removal from a registrant, but does not remove
                   the information without undue delay or rejects the request on incorrect grounds;

                   the further processing takes place in violation of the Data Protection Regulation. When it
                   is the question of search engine services does this require prompt handling

                   particularly relevant as the dissemination of personal data risks becoming
                   very extensive and an alternative attitude would erode the individual

                   opportunities to exercise their rights and the protection of the personal
                   integrity.


                   The Data Inspectorate has already in the previous decision assessed the outcome of

                   the balance in complaints 2 and 8 and then found that the treatment took place in violation
                   with the Personal Data Act and the Data Protection Directive. Current legislation

                   (Data Protection Regulation) and the practices that have been added do not
                   there is reason to make a new assessment in this regard.


                   During previous inspections, the Data Inspectorate has found deficiencies in the handling of

                   complaints 2 and 8. Deficiencies have existed since the Data Inspectorate's decision won
                   legal force in each part, or when measures were to be implemented at the latest, which

                   was before the Data Protection Ordinance came into force on 25 May 2018.
                   The regulation entails enhanced rights for individuals and provides

                   The Data Inspectorate significantly more powerful powers. Starting point
                   for the Data Inspectorate's assessment regarding continued violations is taken

                   therefore on the date of implementation of the Regulation, ie 25 May
                   2018.



                   2.2 Follow-up of complaints 2


                   2.2.1 What has emerged during the proceedings
                   During a control search on 8 June 2018 of complaint 2, the Data Inspectorate found that

                   the search result specified in the decision ”is displayed as the first search result in the search result
                   in a search performed on October 10, 2016 ”(search result 2) was still displayed at

                   search on the complainant's name and therefore requested that Google comment.


                   Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, points 43-47.Data Inspectorate DI-2018-9274 1 0 (31)









                    Google stated in a response on June 15, 2018 that the company regarding complaint 2 per
                    on 18 May 2017 had fixed a specific web address (search result 1).


                    The Data Inspectorate stated in a letter dated 9 July 2018 to Google in

                    essentially the following. The documents in the previous case show that it
                    search result described in the reasons for the previous decision was search result 2.

                    The URLs in search results 1 and 2 are identical except that the latter has two
                    extra character at the end ("p2") which is an abbreviation for "page two" in one

                    discussion thread on a forum. The URL in search result 1 identifies both
                    the whole discussion thread and its first page. The Data Inspectorate pointed out that

                    there may be reason to consider a request identifying one

                    URL, which thus both identifies the entire discussion thread and constitutes
                    its first page, not only includes search results leading to the first page but

                    also to subsequent pages, such as search hit 2. This is especially true if
                    individuals provide information that points in this direction, such as the complainant

                    can be considered to have done by in addition to what is stated in
                    the form clarifies that "the whole thread specified" violates the complainant's

                    privacy (the original request). If Google nevertheless did not consider itself
                    obliged to remedy search result 2, the Data Inspectorate reminded of the company

                    duty of investigation and information in the event of an unclear or incomplete

                    request.


                    Google stated the following in its response on 30 August 2018 to the Swedish Data Inspectorate
                    request to state whether action would be taken in relation to search results 2

                    and how similar situations are handled. Google took action regarding two
                    other pages in the current thread in 2014 and another page in August 2018

                    in connection with the Data Inspectorate's request. Google will not take
                    action concerning search hit 2, as the appellant did not specifically request it. One

                    such request "is a personal right" which "can only be exercised by it
                    registered "and Google" therefore respects the extent to which it

                    registrants have given their request '. According to Google, this has support in WP225-

                    the guidelines stating that data subjects must “identify the specifics
                    the URLs ”. The obligation to investigate or inform has not arisen.





                    12The previous case, file appendix 1 appendix 2 p. 2.
                    13WP225 guidelines, p. 14 (Data Inspectorate's translation). Data Inspectorate DI-2018-9274 1 1 (31)







                   The complainant contacted the Data Inspectorate on 9 October 2018 regarding
                   search hit 2 and then received information about the company's attitude and opportunity

                   to make a new request in addition to the current examination of it
                   original request, which the complainant made on 12 October 2018 (the new one)

                   request).


                   Google stated the following in its response on October 25, 2018 to the Swedish Data Inspectorate

                   request to state its assessment of the new request. Google
                   remedied application meeting 2 on 12 October 2018 due to the appellant

                   made the new request. Google deleted the search result because the content on
                   the web page is basically the same as on the web pages that have been taken before

                   away and especially when the website does not contain information about the complainant
                   has been released.


                   2.2.2 The Data Inspectorate's assessment

                   The Data Inspectorate notes that the original request in complaint 2
                   included search hit 2. This is because the appellant in a sufficient manner

                   identified it by entering the URL that both identifies
                   the entire discussion thread and its first page (search result 1) in the web form, partly

                   refer to the whole thread in its supplement.


                   In addition, a discussion thread must be judged as a whole and can not
                   as Google has done is solely assessed on the basis of the information provided

                   appears on the page that a search result links to. As the Svea Court of Appeal

                   established, this follows from the fact that for an Internet user linked to one
                   page in a discussion thread it is obvious that it does not only include posts

                   on that page and that it is not possible based on the posts on just one page
                   overview the content of the discussion. 14


                   Because Google has not processed the request, but the search hit continued

                   has been shown until 12 October 2018, when the complainant made a new request
                   on removal, Google has not addressed the request without undue delay in

                   the meaning of Article 17 (1) of the Data Protection Regulation. Google has
                   processed personal data in breach of Article 17 of the

                   the Data Protection Regulation.



                   14Svea Court of Appeal judgment of 6 October 2017 in case no. FT 494-17, p. 4 with agreement in
                   the assessment of the lower instance (p. 16 f.). Datainspektionen DI-2018-9274 1 2 (31)









                    As stated in the previous decision is processed at the web address provided
                    the search results lead to sensitive personal data and criminal data about

                    the appellant within the meaning of Articles 9 and 10 of
                    the Data Protection Regulation. During the current period, ie the 25th

                    May to October 12, 2018, Google is responsible for the referral to
                    the URL and in particular because the link appears in the search results as
                                                                                             15
                    presented to Internet users searching for the complainant's name. Something
                    support for processing such data under the Data Protection Regulation

                    not existed. Google has thus processed personal data in violation of
                    Articles 9 and 10 of the Data Protection Regulation.



                    Furthermore, the Data Inspectorate states that the injunction in the previous decision
                    regarding complaint 2 included search result 2. What Google has stated about that

                    the injunction shall be interpreted in the light of the reasons for the decision does not change it
                    assessment. It is not clear from the wording of the decision that the injunction

                    was limited to certain search results in complaint 2, which it did, however
                    for example, complaints 8 and 9 (see section 1.2.1 above). It further appears from

                    the reasons for the decision that search result 2 was the search result that was displayed when
                    the search result was checked during the processing and thus what

                    The Data Inspectorate assessed in the decision. Google could easily have detected

                    this by checking the scope of the request and the search results provided
                    was shown when the company took measures to comply with the injunction in May 2017.

                    Because Google took action on search hit 2 only on October 12th
                    2018, ie after the date specified in the injunction in the previous

                    decision, Google has failed to comply with an injunction that
                    The Data Inspectorate announced on the basis of section 45 of the Personal Data Act and

                    the Data Protection Directive.


                    2.3 Follow-up of complaints 8


                    2.3.1 What has emerged during the proceedings

                    During a control search on 8 June 2018, the Data Inspectorate found that the search match
                    from complaint no. 8 (search result 1) was still shown. The Data Inspectorate

                    pointed this out in a letter to Google and referred to the Administrative Court



                    Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, paragraph 46.
                    16See previous decision, p. 23.Data Inspectorate DI-2018-9274 1 3 (31)







                   judgment of 2 May 2018 which upheld the injunction. It was further pointed out that
                   According to the court, the verdict had been served on Google on the same day as it

                   was announced and thus gained legal force on 24 May 2018.


                   Google contacted the Data Inspectorate on 11 June 2018. Google then stated that
                   the company was not notified of the judgment until 23 may 2018 and that it would therefore win

                   entered into force on 14 June 2018 and that Google was still considering the ruling
                   would be appealed. The Data Inspectorate then clarified that the Data Inspectorate had

                   checked specifically with the administrative court that the task of the court
                   provided on the day of service was not a misunderstanding, but reminded Google
                                                                                                17
                   on the possibility of obtaining judicial review of whether the judgment has become final.


                   Google stated in a letter dated June 15, 2018 that the company on June 11, 2018
                   decided not to appeal the judgment and therefore that day had remedied

                   application date 1. In support of the fact that service must have taken place on 23 May 2018
                   Google submits a service receipt signed and dated by the company

                   agent.


                   In addition, correspondence has taken place regarding a search match with identical content
                   and leading to the same article as search hit 1 on the same site but

                   with a different URL (search result 2). According to Google, there was that search hit
                   not when the request to delete search hit 1 was made. Google has, however

                   granted a request for deletion of search hit 2 on February 13, 2019 after
                   a new request was received from the complainant on February 11, 2019. Google considered that

                   that request could be granted without the need for a new balancing of interests
                   done because the content of the web page was identical to the web page for

                   search result 1.


                   2.3.2 The Data Inspectorate's assessment
                   The Data Inspectorate finds that Google has not processed the request in

                   complaint 8 in the previous decision so that search result 1 is not displayed during the period
                   from 25 May 2018 to 11 June 2018. With regard to the Swedish Data Inspectorate

                   had previously clarified in its decision that the request would be granted, which

                   also had been confirmed by the administrative court in a judgment that Google according to its own
                   information had in any case been served on May 23, 2018, Google can not be considered to have

                   processed the request without undue delay within the meaning of Article 17 (1) (i)


                   17Acts Appendix 7 and 10–12.Data Inspectorate DI-2018-9274 1 4 (31)







                   the Data Protection Regulation. Google has thus processed personal data in
                   in breach of Article 17 of the Data Protection Regulation.


                   As stated in the previous decision is processed at the web address provided

                   the search leads to criminal information about the appellant within the meaning of
                   Article 10 of the Data Protection Regulation. During the current period, it wants

                   say May 25 to June 11, 2018, Google is responsible for the referral to
                   the web page and in particular because the link appears in the search results as
                                                                                         18
                   presented to Internet users searching for the complainant's name. Something
                   support for processing such data under the Data Protection Regulation

                   not existed. Google has thus processed personal data in violation of
                   Article 10 of the Data Protection Regulation.


                   Furthermore, the Data Inspectorate finds that Google has not shown that the company has followed

                   the injunction in the previous decision concerning complaint 8 within that time limit
                   which was stated in the decision, which through the company's appeal may be considered to have been

                   when the injunction became final. The Data Inspectorate states that this was
                   on May 24, 2018, which is not changed by the circumstances and the evidence

                   as invoked by Google. Google has thereby failed to comply
                   an injunction issued by the Swedish Data Inspectorate on the basis of section 45

                   the Personal Data Act and the Data Protection Directive.


                   Regarding search result 2, the Data Inspectorate finds that it was not covered by
                   the original request or the Data Inspectorate's injunction because it

                   according to Google, did not exist when the request was made.


                   2.4 Communication to webmasters that search results have been deleted

                   and information about this to individuals

                   2.4.1 What has emerged during the proceedings

                   If Google grants a removal request, Google has a routine to

                   notify webmasters (that is, anyone who subscribes to Google)
                   service "Search Console" formerly "Webmaster Tools") about which URL

                   which has been removed and that this was done as a result of a request for
                   removing.




                   Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, point 46. Data Inspectorate DI-2018-9274 1 5 (31)







                   Google's removal request webpage contains the text '[o] m

                   URLs are removed from our search results as a result of your request we may provide
                   information to the webmasters of the deleted URLs ”. IN

                   connection to the text, the individual is encouraged to read the information
                   and check a box that they approve such treatment. 19



                   Google has reported that 5,690 URLs have been removed upon request
                   from Sweden during the period May 25, 2018 to February 11, 2019.

                   The Data Inspectorate can thereby establish that information has been provided
                   webmasters in a large number of cases.


                   Google has further stated in essence the following. First is

                   The Data Inspectorate is not the competent supervisory authority regarding Google's routine to

                   send such messages. Secondly, such messages are not
                   Processing of personal data. Third, such treatment is not included

                   in violation of the Data Protection Regulation. This is because the messages are in
                   compliance with the purpose limitation principle set out in Article

                   5.1.b, as the purpose is to facilitate the right to be forgotten. Furthermore,
                   processing a legal basis, as Google has a legitimate interest

                   to process the data in order to increase the impact of the right to be forgotten

                   as well as to inform the webmaster in its capacity as concerned
                   interested. Fourth, Google complies with the principle of proportionality

                   obliged to balance the right to be forgotten against opinion and
                   freedom of information. Fifth, the routine is an appropriate and

                   proportionate action and industry practice.


                   2.4.2 The Data Inspectorate's assessment


                   2.4.2.1 The Data Inspectorate is authorized to exercise supervision in the matter
                   The Data Inspectorate's competence follows from the main rule that each

                   supervisory authority is competent in the territory of its own Member State
                   (Article 55 (1) of the Data Protection Regulation). The current treatment is a step
                                                                      20
                   in Google's search engine business and is affiliated with it
                   obligation arising from such activities to ensure that the activities




                   19 Appendix 27.2, pp. 2-3.
                   20
                      See the judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12,
                   paragraph 41 and the judgment of 24 September 2019, G.C. and others, C-136/17 point 35.Datainspektionen DI-2018-9274 1 6 (31)







                                                                     21
                    meets the requirements of the Data Protection Regulation. Google has in letter of the 12th
                    December 2018 to the data protection authorities stated that it is Google (it

                    that is, Google LLC based in the United States) which determines the purposes

                    and the means of that treatment and that this is not affected by them
                    organizational changes that the company made on January 22, 2019. The 22

                    organizational changes referred to is that Google from this

                    date has a principal place of business in Ireland regarding parts of
                    their business. A principal place of business shall have the authority to:

                    make decisions regarding the purposes and means of the treatment in question

                    (Article 4.16 and recital 36). Google has not shown that Google Ireland has such
                    powers in the field of search engine business. The Data Inspectorate considers

                    because the single point of contact mechanism (Articles 56 and 60) does not

                    is applicable and that the Data Inspectorate is thus the competent supervisory authority in
                    the case.



                    2.4.2.2 The messages constitute personal data processing
                    The Data Inspectorate finds that the messages in question are personal data

                    and that the fact that Google sends the messages means that Google
                    processes personal data for the following reasons. As can be seen from the expression “each

                    information "in the definition of the concept of personal data (Article 4 (1)) shall:

                    the term is given a broad meaning. It includes both objective and
                    subjective information if they "refer" to a specific person, which is the case

                    they, because of their content, purpose or effect, are attached to a person. 23

                    The information that Google has granted a search hit to a particular URL
                    to be deleted refers to a person, especially since the use of the data

                    affects the person's rights and interests, for example by being able to
                                                                         24
                    be used to counter the purpose of the request. For that to be the case
                    a personal data is not required that the information itself makes it possible to

                    identify the person or that all information necessary for

                    identification is held by a person. The question of whether someone is identifiable should
                    assessed on the basis of the aids that can reasonably be used by

                    someone to identify the person. A person is not considered identifiable if
                    the risk of it in practice is negligible. In the present case, the risk is not



                    21EU Court Judgment of 24 September 2019, G.C. and others, C-136/17 paragraph 43.
                    22
                      Appendix 50 50 appendices 1 and 2.
                    Judgment of the European Court of Justice of the European Communities of 20 December 2017, Nowak, C-434/16, paragraphs 34-35.
                    24See by analogy the judgment of the European Court of Justice of 20 December 2017, Nowak, C-434/16, paragraph 39.
                    25
                      Judgment of the European Court of Justice of 19 October 2016, Breyer, C-582/14, paragraphs 41, 43 and 46. Data Inspectorate DI-2018-9274 1 7 (31)







                    negligible, since a granted request for removal is by definition

                    linked to a person's name. Identification can thus be done directly about it
                    there is only one name on the web page that the search results lead to. If it exists

                    several names on the website, you can instead take one name at a time and search
                    the name of the search engine. In one of these searches, the search result does not appear

                    appear and thereby indirectly reveal that it is the person who requested and

                    granted removal.


                    2.4.2.3 There is no legal support for sending the messages
                    The Data Inspectorate finds that Google has no legal basis for

                    the treatment and that it is also not permitted on the basis that it would
                    be consistent with the original purposes for which the data were collected

                    in. Google thus processes personal data without having a valid legal basis

                    grounds for processing in breach of Articles 5 and 6 of the Data Protection Regulation.
                    The reasons for the assessment are set out below.


                    The notices are not supported by a legal obligation

                    Google claims that the processing is based on a legal obligation (Article
                    6.1 (c) in accordance with Article 17 (2) of the Data Protection Regulation or, as may be understood,

                    in accordance with Article 5 (4) of the EU Platforms Regulation, and that it is also to be considered

                    as industry practice according to proposals and recommendations from the Commission.


                    The Data Inspectorate finds that the processing is not supported by Article 17 (2)
                    the Data Protection Regulation for the following reasons. The wording states that

                    the provision imposes personal data controllers who have published
                    personal data an obligation to take reasonable steps to inform

                    personal data controllers who then reuse this personal data via

                    links, copies or reproductions. Such an obligation to provide information does not apply
                    search engine providers when engaging in the activity that the right to

                    removal applies in relation to, namely to locate information such as
                    contains personal data that has been published or posted on the internet by

                    third men, index it automatically, store it temporarily and finally
                    make it available to internet users according to a certain

                    priority scheme. In addition, search engine providers,

                    who has received a request to delete a search hit, informs it

                    26 Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019.
                    27
                      Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 41
                    and the judgment of September 24, 2019, G.C. et al., C-136/17 point 33 and 35.Datainspektionen DI-2018-9274 1 8 (31)







                   third party who published the information on the internet as the search hit
                   refers to. The purpose of the obligation under Article 17 (2) is to add greater

                   responsibility for the personal data controller for the original publication
                   which the search hit refers to and that individuals should not be forced to produce

                   several requests for deletion. The requirements are higher for the one who originally
                   has published the data shall grant a request for deletion than to a

                   a search engine provider shall grant a request for deletion of a search result

                   which refers to the original publication of the data. It can
                   notes that the opinion of the Article 29 Working Party in the WP225 Guidelines,

                   that messages such as those in the case current from search engine providers to
                   webmasters do not have a legal basis under the data protection rules,
                                          28
                   is still valid.


                   The Data Inspectorate finds that the processing is not supported by Article 5 (4) i
                   the Platform Regulation for the following reasons. First, note

                   The Data Inspectorate that the regulation was adopted on 20 June 2019 and will be applied
                   only from 12 July 2020 (Article 19) and thus not yet valid. For it

                   others, it is clear from the purpose and scope of that regulation that
                   it shall be without prejudice to Union law applicable to, inter alia

                   in the field of data protection (Article 1.5). It is further stated that the requirements in
                   the Platforms Regulation should not be seen as an obligation for

                   a search engine provider to disseminate personal information to its business users
                   and that any processing of personal data should take place in accordance with

                   the legal framework of the Union for the protection of individuals with regard to

                   processing of personal data and respect for privacy and protection of
                   personal data, in particular the Data Protection Regulation (recital 35).


                   As noted in the previous paragraph and developed in the following two sections (on

                   legitimate interest and purpose limitation) speaks the circumstances of it
                   the present case against the treatment being allowed or justified

                   because the display of a search hit may be illegal without the original
                   the publication is. A webmaster's interest in knowing that a search hit

                   does not appear when searching on a person's name is weak compared to those
                   interests that apply in the cases covered by the Platforms Regulation

                   protect (recitals 1-5). Against the same background, the treatment can not, such as


                   28Se EDPB, Guidelines 5/2019 “on the Criteria of the Right to be Forgotten in the search
                   engine cases under the GDPR ”(part 1), adopted on 2 December 2019 for the public
                   consultation, pp. 4-5, with reference to the WP225 guidelines, item 23.Data Inspectorate DI-2018-9274 1 9 (31)







                    Google alleged, is considered compatible with established and prevalent

                    industry practice.


                    The messages are not supported by a legitimate interest

                    Google claims that the treatment is based on Google's legitimate interest
                    (Article 6 (1) (f)) of 'informing the webmaster, as a key stakeholder,

                    that a URL that links to the webmaster's webpage has been removed
                    having regard to the [Data Protection Regulation] '. Google states that consideration should

                    ensure that the individual is informed of and can expect treatment,

                    which can have a positive effect on him by removing the data from
                    the original web page. Furthermore, Google believes that the information does not constitute

                    specific categories of personal data, minimized as far as possible and
                    only shared with a recipient who already has access to them.



                    The Data Inspectorate finds that Google's processing is not permitted
                    reference to any of the interests expressed by Google. None of

                    the conditions of Article 6 (1) (f) are met, namely the existence of a
                    legitimate interest of the controller or third party, that

                    the treatment is necessary for the legitimate interest sought and
                    that the interests of the individual or fundamental freedoms and rights do not weigh

                    heavier and requires protection of personal data. 30


                    Google has first stated that the treatment may lead to it

                    webmaster deletes the original data, i.e. what gets
                    perceived as the webmaster's interest in trying their own possible

                    obligation to delete the information from the website. The Data Inspectorate

                    notes, however, that the interest relied on by Google is hypothetical
                    the time of processing, because Google does not know about it

                    webmasters have an interest in making any such assessment. It is
                    thus not a legitimate interest within the meaning of the Data Protection Regulation. 31

                    The treatment can then also not be considered necessary. The webmaster

                    interests can, in a balance of interests, also not be considered to outweigh those
                    registered fundamental rights and freedoms.





                    29Act Annex 45, p. 14.
                    30
                      See the judgment of the European Court of Justice of 4 May 2017, Rīgas satiksme, C ‑ 13/16, paragraph 28.
                    Judgment of the European Court of Justice of the European Communities of 11 December 2019, TK, C ‑ 708/18, paragraph 44.Datainspektionen DI-2018-9274 2 0 (31)







                    In addition, Google has invoked the public's legitimate interest in Google

                    does not make erroneous removal decisions. The Data Inspectorate finds that
                    Google only sends the messages after Google has already deleted one

                    search hit, ie after Google has already made the required balance
                    in order not to make wrong decisions. It is thus not an actual interest in

                    the time of treatment. It is thus not a legitimate interest in
                                                         32
                    meaning of the Data Protection Regulation.


                    If what Google has stated regarding incorrect decisions should instead be perceived as
                    that the legitimate interest is the public interest in making wrong decisions

                    whether deleting search results afterwards can be corrected to is
                    The Data Inspectorate's assessment is that the processing is not necessary.

                    The information that Google has removed a URL is not sufficient to

                    the webmaster should be able to assess whether the decision is incorrect, then it
                    webmasters lack knowledge of what the individual has stated in their request.


                    The Data Inspectorate also assesses that the individual's interests weigh

                    heavier based on the following circumstances.


                    The fact that the data protection authorities in the WP225 guidelines (paragraph 23)

                    explicitly advised against search engine providers from submitting such
                    messages argue that it would be permissible in a balance of interests.

                    Only Google and the individual know that Google has granted one
                    request for removal. By Google disclosing the information to third parties

                    this is a more serious violation than if the data had been
                    publicly available.33


                    The disclosure of the information to the webmaster also takes place without

                    adequate safeguards, as Google has not shown that the company can guarantee

                    or have any opportunity to influence that the webmaster does not use
                    the information in an improper manner or that the information is not disclosed to

                    third-party webmasters who are not subject to adequate safeguards.


                    As for the legitimate expectations of the individual, Google certainly has
                    informed in its web form that the treatment may take place, but


                    Judgment of the Court of Justice of the European Communities of 11 December 2019, TK, C ‑ 708/18, paragraph 44.
                    33
                      Judgment of the European Court of Justice of 24 November 2011, Asociación Nacional de Establecimientos
                    Financieros de Crédito, C ‑ 468/10 and C ‑ 469/10, paragraph 45. Data Inspectorate DI-2018-9274 2 1 (31)






                   has done this in a misleading way that gives the impression that the treatment

                   must be approved by the individual for the removal request to
                   is handled, or that the processing follows from Google's legal obligation to

                   handle request. It must be borne in mind that Google has not informed them
                   registered that the legal basis for the processing is justified

                   interest pursuant to Article 6 (1) (f) (Article 13 (1) (c)), the company or third parties
                   legitimate interests which make the treatment necessary (Article 13 (1) (d)) or

                   the company's intention to transfer the data to third countries (Article 13 (1) (f)). It has
                   nor has it emerged that Google has expressly notified the individual

                   on the right of the individual under Article 21 (1) to object at any time
                   treatment based on a legitimate interest and clearly stated,

                   clear and distinct from other information (Article 21 (4)).

                   Against this background, the treatment is not allowed on the basis of a justified

                   interest.


                   The messages are not compatible with the original purpose
                   Finally, Google claims that the sending of the message is compatible with

                   the original purpose for which the data was collected, ie Google
                   obligation to remove search results in certain cases on request (Article 17 (1) and (3)).

                   According to Google, the purpose of the treatment is to “give the webmaster one
                   possibility to delete the actual content of the web page, as this increases

                   impact on the right to be forgotten ”. Google thus claims that the company
                   sends these messages in accordance with Article 6 (4) of the Data Protection Regulation.


                   The Data Protection Regulation contains criteria for determining whether a processing

                   for other purposes is consistent with the purposes for which the data
                   originally collected or if the treatment violates the principle of

                   purpose limitation in Article 5 (1) (b) of the Data Protection Regulation (points (a) to (e) (i)
                   Article 6 (4) and recital 50). Several of the circumstances that are relevant according to

                   these criteria have already been described in the previous section and will
                   therefore only summarized here.


                   The Data Inspectorate states that the current processing is unfounded
                   with the consent of the data subject or Union law or that of the Member States

                   national law. Furthermore, the Data Inspectorate states in accordance with
                   the criteria in Article 6 (4) that the link between the objectives (point (a)) is weak;

                   as stated in the previous section, the possibilities of the data subjects and
                   rights regarding requests to search engine suppliers and the Swedish Data Inspectorate DI-2018-9274 2 2 (31)







                   website owners are not equivalent. The context is not like that either
                   that the latter treatment is what the individual can typically expect

                   (point (b)), which is not altered by the information provided by Google
                   the treatment in its web form as that information is misleading. To

                   a request for removal made and granted may in itself be considered as
                   personal data of a privacy-sensitive nature (point c). In addition, it speaks for itself

                   that a request for removal has been granted to the underlying

                   the information on the website is often such particularly sensitive information or
                   criminal offenses referred to in Articles 9 and 10 of the Data Protection Regulation.


                   The consequences of the subsequent treatment (point d) can generally be considered

                   negative for the individual and can even be used to counteract the purpose of
                   request. The individual is also not obliged to turn first or at the same time

                   to the webmaster where the data was published and request that it be deleted
                   and can also be assumed to have a worse chance of success with one

                   request due to the fact that the original publication may have a stronger
                   freedom of expression protection. In addition, knowledge of the search engine

                   granted a request is assumed to entail the risk that some webmasters will try
                   circumvent the deletion decision by republishing the information on a

                   other address or otherwise disseminate them. As stated above, Google has
                   has not shown that the company has set up any guarantees or protective measures to

                   counteract this (point e).


                   Google does not test the suitability of sending the messages in

                   the individual case and also does not offer the individual any opportunity to
                   object. Google's routine in general to deal with deletion, namely only

                   based on specific URLs, with requirements for new requests even when the same
                   content is republished, entails a risk that individuals are exposed to unnecessary

                   suffering as a result of the treatment. An example of this is search result 2 i
                   complaint 8, where the company had blocked the search hit as the Data Inspectorate

                   resubmitted, but where the same content reappeared in the search results then
                   the webmaster republished the content on the same site, but on

                   a new URL. The individuals themselves must monitor and react to any
                   republishing in the company's search services. This erodes the effectiveness of

                   their rights and is therefore not in their interest.


                   Judgment of the European Court of Justice of 13 May 2014, Google Spain and Google, C-131/12, paragraph 83
                   and 85 and the judgment of September 24, 2019, G.C. and others, C-136/17, paragraph 52 and
                   Opinion of the Advocate General at the sitting, Item 81.Data Inspectorate DI-2018-9274 2 3 (31)









                   The Data Inspectorate finds that Google does not support Article 6 (4) and that
                   the procedure infringes the principle of purpose limitation in

                   Article 5 (1) (b) of the Data Protection Regulation.


                   2.4.2.4 The information to individuals violates the principle of transparency

                   Google has stated that the purpose of the information to the individuals in
                   the web form that messages are sent to webmasters is that

                   meet the requirements of the right to information and the principle of legality,
                   accuracy and transparency and that this follows from practice. 35


                   The Data Inspectorate does not question that Google is obliged to inform them

                   registered which recipients will have access to their information

                   pursuant to Article 13 (1) (e), but notes that the obligation to provide information is intended to:
                   protect the data subjects. As stated in the previous section, it is

                   current transfer is illegal and to the detriment of the individual. Like there too
                   Google has provided misleading information to individuals about it

                   legal basis on which the treatment is based. In addition,
                   the data protection authorities jointly, and the Data Inspectorate in particular,

                   previously alerted Google to the shortcomings of the routine of submitting such

                   messages without Google fixing it. In addition, Google requires that they
                   individuals approve the procedure for submitting a request for

                   removing. Against this background, the information provided by Google appears
                   leaves to individuals about the treatment as misleading in a way that may

                   considered to be conducive to persuading individuals to refrain from exercising their right to request
                   removing. By doing so, Google is processing personal data in violation of

                   the principle of transparency in Article 5 (1) (a) of the Data Protection Regulation.




                   3 Choice of intervention


                   3.1 Possible intervention measures

                   The Data Inspectorate has a number of corrective powers available according to
                   Article 58 (2) (a) to (j) of the Data Protection Regulation, inter alia to impose it



                   Judgment of the European Court of Justice of 16 January 2019, Deutche Post AG, C-496/17, paragraph 59 and

                   Judgment of 1 October 2015, Bara and Others, C-201/14, paragraph 34.
                   Judgment of the European Court of Justice of 7 May 2009, Rijkeboer, C-553/07, paragraphs 34-35. Data Inspectorate DI-2018-9274 2 4 (31)






                   personal data controller to ensure that the processing takes place in accordance with

                   Regulation and, if necessary, in a specific way and within a specific
                   period.


                   Of point (i) of Article 58 (2) and Article 83 (2) of the Data Protection Regulation

                   it appears that the Data Inspectorate has the authority to impose administrative
                   penalty fees in accordance with Article 83. Depending on the circumstances of

                   in the individual case, administrative penalty fees shall be imposed in addition to or in
                   instead of the other measures referred to in Article 58 (2). Furthermore, it appears from the article

                   83.2 which factors are to be taken into account when deciding on administrative
                   penalty fees shall be imposed and in determining the size of the fee.


                   If it is a question of a minor violation, the Data Inspectorate receives according to what
                   set out in recital 148 of the Data Protection Regulation instead of imposing a

                   issue a reprimand in accordance with Article 58 (2) (c)
                   aggravating and mitigating circumstances in the case, such as the infringement

                   nature, severity and duration as well as previous violations of
                   relevance.


                   3.2 Order

                   The Data Inspectorate has found that Google by regularly submitting

                   notification to webmasters that search results have been removed processing
                   personal data in breach of Articles 5 (1) (b) and 6 of the Data Protection Regulation.


                   Furthermore, it has been found that Google provides misleading information about
                   the transmission of such messages in a manner contrary to Article 5 (1) (a) (i)

                   the Data Protection Regulation.


                   Google should therefore be instructed to ensure that the processing of these parts takes place in
                   in accordance with the Data Protection Regulation as follows.


                   The Data Inspectorate submits pursuant to Article 58 (2) (d) i

                   Google's Data Protection Regulation that, as far as removal requests are concerned
                   of displaying search results when searching for individuals' names using

                   Google search services that can be done from Sweden,
                        stop informing webmasters of URLs when Google

                           has granted a request except in cases where the individual has requested
                           det.Datainspektionen DI-2018-9274 2 5 (31)






                        cease to display the text “If URLs are removed from ours

                           search results as a result of your request, we can provide information to them
                           webmasters for the deleted URLs ”in their web form

                           for request for removal or provide similar information to
                           individuals if it is not clear that webmasters are only informed about

                           that a request has been granted if the individual has requested it.


                   3.3 Circumstances of significance for whether a penalty fee is to be imposed


                   3.3.1 What Google has stated
                   Google has stated that in the case of complaints 2 and 8, these are isolated cases

                   events concerning two individual data subjects and are consequences of
                   acceptable and well-founded interpretations of applicable law. It can not

                   be consistent with the intent or overall purpose of
                   the Data Protection Regulation to impose excessive penalties for

                   infringements relating to individual material interpretations of existing
                   right with little or no impact on data subjects. In the present case has

                   no damage was shown at all with respect to the alleged
                   the infringements. If high levels of sanctions were to be applied for relatively small
                   infringements and isolated events and with little or no impact on

                   registered, they would risk as a tool to ensure compliance
                   lose its effect because data controllers would have nothing

                   incentives to strive for compliance at a systematic level.


                   In summary, Google claims that the following circumstances should
                   considered mitigating. It is a matter of isolated events, which have been going on

                   for a limited time and concerns a limited number of registered who have not
                   suffered any damage as a result of the alleged infringements. Google has

                   notified the data subjects that they can complain to the Data Inspectorate. Google has
                   has not been intentional or has been negligent and cannot be considered as principal

                   or solely responsible. Google complies with the Data Protection Regulation on a
                   systematic level and act in accordance with a code of conduct by following

                   WP225 guidelines. Google has cooperated with the Data Inspectorate. Google
                   have not gained any financial benefits or avoided losses.


                   3.3.2 Assessment of the infringement concerning complaints 2
                   In the mitigating direction, the circumstance speaks that the infringement only concerns one

                   person.Datainspektionen DI-2018-9274 2 6 (31)







                   The following circumstances point in an aggravating direction. The violation is a step

                   in a systematic procedure because it follows the procedures of Google. Further
                   are the current categories of data, such as sensitive data and

                   criminal offenses, particularly worthy of protection. If a search result leads to a web page
                   with such personal information about a person, it can have a significant

                   impact on his fundamental rights with respect to
                   privacy and the protection of personal data and constitute an exceptional
                                       37
                   serious intervention. It should typically result in damaged reputation,
                   unauthorized disclosure and significant financial disadvantage for individuals, whereby

                   it should be mentioned that the appellant in the present case has likened the effect of
                   the violation that a professional ban would have been issued against him. 38

                   Google has not taken sufficient measures to alleviate the damage, but let

                   the search meeting remains despite the Data Inspectorate's previous decision. The infringement
                   has lasted for about 4.5 months during the time that the Data Protection Ordinance has been

                   applicable. Because the procedure followed Google's procedures, this is not the case
                   an individual mistake without the action has been done intentionally. It can too

                   finds that Google has failed to comply with the order
                   The Data Inspectorate announced in the previous decision on the basis of section 45

                   the Personal Data Act and the Data Protection Directive to cease
                   the treatment. Because Google requires individuals to enter an exact

                   URL in Google's web form and does not investigate requests

                   covers more than that, the company at least indirectly avoids costs.


                   3.3.3 Assessment of the infringement concerning complaints 8
                   In the mitigating direction, the circumstances indicate that the infringement only concerns

                   one person and that the time the infringement has been going on while
                   data protection ordinance has been applicable, about two weeks, is a relative

                   short time.


                   The following circumstances speak in an aggravating direction. The Data Inspectorate has
                   found that Google had failed to comply with the order

                   the supervisory authority announced in the previous decision on the basis of § 45

                   the Personal Data Act and the Data Protection Directive to cease
                   processing and which became final on May 24, 2018. Google has done

                   regarding that the company intended to comply with a legally binding agreement



                   37 European Court of Justice judgment of 24 September 2019, G.C. and others, C-136/17, paragraphs 44 and 46.
                   38 See file appendix 31, p. 2.Data Inspectorate DI-2018-9274 2 7 (31)







                   injunction, but on the other hand has not shown due diligence by correcting itself

                   at the discretion of the regulatory authority by temporarily restricting
                   the display of the search results pending court review or even when Google

                   according to own information on 23 May 2018 was served the judgment that upheld
                   Data Inspectorate assessment. Regarding the current categories of

                   information has been about criminal information, which is particularly sensitive to privacy.
                   If a search result leads to a web page with such personal information about one

                   person, it can have a significant impact on their fundamentals
                   rights regarding respect for privacy and the protection of

                   personal data and constitute a particularly serious interference. It dared
                   typically result in damaged reputation, unauthorized disclosure and significant

                   financial disadvantage for individuals, whereby it should be mentioned that the appellant in it

                   The present case has been likened to the effect of the infringement by a professional ban
                   should have been communicated to him. Google has not taken enough

                   measures to alleviate the damage, but left the search hit in spite
                   The Data Inspectorate's decision and the court's judgment. Because the procedure followed

                   Google's routines have been intentional.


                   Assessment of the infringement regarding notification to webmasters and
                   information to individuals

                   The following circumstances are aggravating. The infringement intended to send
                   message is such that it erodes the effectiveness of the right to

                   removal and affects anyone who has been granted a removal request.

                   For the current period, potentially 5,690 people can be covered by
                   procedure. The infringement regarding misleading information affects

                   anyone who may have an interest in making such a request. The current category
                   of information, ie that someone has requested and been granted removal, may

                   typically considered to be a task for which the individual does not want to be disclosed
                   the webmaster or someone else, as the task can be used for

                   to counteract the purpose of the request. The infringements thus cause damage in
                   form of lost opportunity for the individual to exercise their rights, lack of

                   control over their personal data and unauthorized disclosure. The infringements

                   has been going on since May 25, 2018 and is still going on. It appears from
                   the investigation into the case that Google has been aware of the treatment and

                   so that it was done intentionally. Since the procedure can be assumed to entail that



                   Judgment of the European Court of Justice of 24 September 2019, G.C. and others, C-136/17, paragraphs 44 and 46.
                   40The previous decision, p. 31.Data Inspectorate DI-2018-9274 2 8 (31)






                   Individuals refrain from requesting removal Google avoids in any case

                   indirect costs.


                   3.3.5 Penalty fees shall be imposed
                   The proceedings covered by this supervision concerning complaints 2 and 8 thereof

                   previous decision has meant that Google processes data such as
                   The Data Inspectorate in previous decisions found that Google treated in violation of

                   the Personal Data Act and the Data Protection Directive and instructed Google to
                   cease. It can thus not be considered an excuse, material

                   misinterpretations. It also shows a lack of respect for the rights of individuals
                   and are thus not minor infringements within the meaning of recital 148 in the preamble

                   the Data Protection Regulation. There is thus no reason to replace one
                   penalty fee with a reprimand. There is no other corrective action
                   current. Google will therefore be subject to administrative penalty fees for

                   the infringements.


                   The procedure to send message to webmasters and the information
                   provided to the individual in the web form is done systematically and at risk

                   to put the right to removal out of play. It's not about less
                   infringements. There is no reason to replace a penalty fee with one

                   reprimand. Nor is it enough that Google is ordered to cease
                   with the procedure. Google will therefore be subject to administrative penalty fees

                   also for these violations.


                   3.4 Determination of the amount of the penalty fee


                   3.4.1 General provisions
                   According to Article 83 (1) of the Data Protection Regulation, each supervisory authority shall:

                   ensure that the imposition of administrative penalty fees in each individual
                   cases are effective, proportionate and dissuasive.


                   The Data Inspectorate has found that Google has violated Articles 5, 6, 9,

                   10 and 17 of the Data Protection Regulation. These Articles are covered by Article 83 (5),
                   which means that a higher penalty amount can be imposed.


                   According to ch. 6 Section 3 of the Data Protection Act, the Data Inspectorate may also levy one
                   penalty for infringements of Article 10 of the Data Protection Regulation and

                   shall then apply Article 83 (1), (2) and (3) and determine the amount of the fee
                   pursuant to Article 83 (5). Data Inspectorate DI-2018-9274 29 (31)









                    According to Article 83 (3), the administrative penalty fee may not exceed

                    the amount of the most serious infringement in the case of one or the same

                    data processing or interconnected data processing.


                    As regards the calculation of the amount, Article 83 (5) (i)

                    the Data Protection Regulation that companies that commit infringements are the ones in question
                    may be subject to penalty fees of up to EUR 20 million or four

                    percent of total global annual sales in the previous financial year,

                    depending on which value is highest.



                    3.4.2 The amount at which penalty fees can be determined

                    When determining the maximum amount for a penalty fee to be imposed on one

                    companies, the definition of the term company must be used as the European Court of Justice
                    apply in application of Articles 101 and 102 of the TFEU (see recital)

                    150 of the Data Protection Regulation). It is clear from the case - law of the Court that this

                    includes any entity engaged in economic activities, regardless of the entity's
                    legal form and method of financing and whether the entity in

                    legal meaning consists of several natural or legal persons. 41


                    The Data Inspectorate assesses that the company's turnover is to be added

                    basis for calculating the administrative penalty fees that Google can

                    imposed is Google's parent company Alphabet Inc (Alphabet). Of collected
                    data, Alphabet's global annual sales in 2018 were approximately 136,819,000,000

                    US dollars (USD), which is equivalent to approximately 119,500,000,000 euros
                           43 44
                    (EUR). This corresponds to approximately SEK 1,280,000,000,000. The highest
                    the amount of the sanction that can be determined in the case is four percent of this amount,

                    that is to say about 51 200 000 000 (fifty-one billion two hundred million)
                    kronor.





                    41Article 29 Working Group, Guidelines for the application and determination of administrative

                    penalty fees in accordance with Regulation 2016/679 (WP253 Guidelines), p. 6.
                    42A ktbilaga 40, s. 47.
                    43
                      Based on the exchange rate USD to EUR as of March 9, 2020 according to European
                    central banks, 0.8729.
                    44Due to the exchange rate EUR to SEK as of March 9, 2020 according to European

                    central bank, 10.7203.Data Inspectorate DI-2018-9274 3 0 (31)






                   3.4.3 Determining the size of the penalty fee

                   In order for penalty fees to be effective and dissuasive, according to
                   The Data Inspectorate's opinion on the turnover of the data controller

                   be taken into account in determining the size of the penalty fees. One
                   proportionality assessment must also be made in each individual case.


                   In a proportionality assessment, one must ensure that the penalty fee

                   does not become too high in relation to the current infringements. Thereby shall
                   take into account that the complaints concern two people and that the routine to regularly

                   notify webmasters of deletion and information to individual refers
                   Sweden and in the current case can amount to 5,690 registered. At the same time

                   penalty fees must be effective and dissuasive.

                   Overall, the Data Inspectorate finds that an efficient, proportionate and

                   dissuasive penalty for the infringements found
                   Complaints 2 and 8 are SEK 25,000,000 (twenty-five million)

                   message to webmasters and misleading information to individuals is
                   50,000,000 (fifty million) kronor.


                   Against this background, the Data Inspectorate decides with the support of ch. § 3

                   the Data Protection Act and Articles 58 (2) and 83 of the Data Protection Regulation that
                   Google will pay an administrative penalty fee of 75,000,000 (seventy-five)

                   million).





                   This decision was made by Director General Lena Lindgren Schelin after
                   presentation by the lawyer Olle Pettersson. At the final processing

                   also has General Counsel Hans-Olof Lindblom, Unit Manager Catharina
                   Fernquist and lawyer Nidia Nordenström participated.


                   Lena Lindgren Schelin, 2020-03-10 (This is an electronic signature)


                   3.5 Appendices

                   Appendix 1 - How to pay a penalty feeData Inspectorate DI-2018-9274 3 1 (31)







                  4 How to appeal

                  If you want to appeal the decision, you must write to the Data Inspectorate. Enter i
                  the letter which decision is being appealed and the change you are requesting.

                  The appeal must have been received by the Data Inspectorate no later than three weeks from
                  the day you received the decision. The Data Inspectorate sends the appeal

                  on to the Administrative Court in Stockholm for review if the inspection does not
                  yourself change the decision in the way you have requested.


                  You can e-mail the appeal to the Data Inspectorate if it does not contain

                  any privacy-sensitive personal information or information that may be covered by
                  secrecy. The authority's contact information can be found on the first page of the decision.