Datatilsynet (Norway) - 20/02059: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Norway |DPA-BG-Color= |DPAlogo=LogoNO.png |DPA_Abbrevation=Datatilsynet (Norway) |DPA_With_Country=Datatilsynet (Norway) |Case_Number_Name=20/...")
 
No edit summary
 
(5 intermediate revisions by the same user not shown)
Line 10: Line 10:
|ECLI=
|ECLI=


|Original_Source_Name_1=Datatilsynet
|Original_Source_Name_1=n/a
|Original_Source_Link_1=https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/vedtak-om-sletting-av-soketreff/
|Original_Source_Link_1=
|Original_Source_Language_1=Norwegian
|Original_Source_Language_1=Norwegian
|Original_Source_Language__Code_1=NO
|Original_Source_Language__Code_1=NO
Line 48: Line 48:
|Party_Link_5=
|Party_Link_5=


|Appeal_To_Body=
|Appeal_To_Body=Personvernnemnda (Norway)
|Appeal_To_Case_Number_Name=
|Appeal_To_Case_Number_Name=2021-18 (20/02059)
|Appeal_To_Status=Appealed - Confirmed
|Appeal_To_Status=Appealed - Confirmed
|Appeal_To_Link=
|Appeal_To_Link=https://gdprhub.eu/index.php?title=Personvernnemnda_(Norway)_-_2021-18_(20/02059)


|Initial_Contributor=Rie Aleksandra Walle
|Initial_Contributor=[https://gdprhub.eu/index.php?title=User:Riealeksandra Rie Aleksandra Walle]
|
|
}}
}}


The Norwegian DPA instructed Google to delete a search result about a data subject's criminal past, but agreed with Google's decision to refuse erasure for two other search results. The DPA found that these were still relevant after 10 years, in part because the complainant was a CSO in a company planning to go public, and the information was deemed to be of public interest.
The Norwegian DPA instructed Google to delete a search result about a data subject's criminal past, but agreed with their decision to refuse erasure for two other search results. The DPA agreed these were still relevant after 10 years, in part because the data subject was a CSO in a company planning to go public, and the information was deemed to be of public interest. The Privacy Appeals Board later [[Personvernnemnda (Norway) - 2021-18 (20/02059)|upheld the DPA's decision]].


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
A complainant was in 2011 sentenced to four years in jail for a serious case of corruption and for concealing the output from his criminal acts. He was also sentenced to pay about €5,4 million in compensation and lost his right to run his own business, including acting as a general manager or another leading position in any company's board, indefinitely. The case was mentioned in several newspaper articles.
A data subject was in 2011 sentenced to four years in prison for a serious case of corruption and for concealing the output from their criminal acts. They were also sentenced to pay about €550,000 in compensation and lost their right to run a business, including acting as a general manager or another leading position in any company's board, indefinitely. The case was mentioned in several newspaper articles.


The complainant contacted Google and Bing in February 2020 to request deletion of four search results leading to articles mentioning the prior criminal case. Bing deleted the results, but Google refused, stating: "Having assessed the balance of relevant rights and interest relating to the content in question, including factors such as its relevance to your professional life, Google has decided not to block this content." Consequently, the complainant lodged a complaint against Google.
The data subject contacted Google and Bing in February 2020 to request deletion of four search results leading to articles mentioning the prior criminal case. Bing deleted the results, but Google refused, stating: "Having assessed the balance of relevant rights and interest relating to the content in question, including factors such as its relevance to your professional life, Google has decided not to block this content." Consequently, the data subject lodged a complaint against Google.


The DPA noted that the lawful basis was [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and referred to the Article 29 Group's guidelines WP225 relating to search engine results and the balancing between fundamental rights and interests vs. de-listing of information. They also took into account that the information the search results lead to, was convered by [[Article 10 GDPR|Article 10 GDPR]] that by default prohibits processing of such personal data (relating to criminal convictions and offences). Normally, this would support erasure in this situation, cf. G.C. & Others v. CNIL, section 67 (C-136/17 24 September 2019). However, on the other hand, two of the search results lead to articles with objective and factual information about what the complainant was sentenced for and to. The DPA found this to contradict the complainant's right to erasure. Further, the DPA emphasized that the search results was published for journalistic purposes and the context for which the articles was published, support the public interest and contradicts the right to erasure. Finally, the DPA notes that the information relates to the complainant's work life and is less of a private nature, which further supports their assessment to deny the erasure request.
The DPA noted that the lawful basis was [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and referred to the [https://ec.europa.eu/newsroom/article29/items/667236/en Article 29 Group's guidelines WP225] relating to search engine results and the balancing between fundamental rights and interests vs. de-listing of information. They also took into account that the information the search results lead to, was convered by [[Article 10 GDPR|Article 10 GDPR]] that by default prohibits processing of such personal data (relating to criminal convictions and offences). Normally, this would support erasure in this situation, cf. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:62017CJ0136 G.C. & Others v. CNIL], section 67 (C-136/17 24 September 2019).  


The DPA noted that the complainant, who today acts as a Chief Security Officer, still has a role in the Norwegian business landscape. The search results are therefore still relevant, despite the articles dating back nine and ten years, and especially because the company he works at plans to go public. The public therefore has a particular interest regarding his work-related past.
However, on the other hand, two of the search results lead to articles with objective and factual information the data subject's criminal past. The DPA found this to contradict the data subject's right to erasure. Further, the DPA emphasized that the search results was published for journalistic purposes and the context for which the articles was published, support the public interest and contradicts the right to erasure. Finally, the DPA notes that the information relates to the data subject's work life and is less of a private nature, which further supports their assessment to deny the erasure request.
 
The DPA noted that the data subject, who today acts as a Chief Security Officer, still has a role in the Norwegian business landscape. The search results are therefore still relevant, despite the articles dating back nine and ten years, and especially because the company they work at plans to go public. The public therefore has a particular interest regarding their work-related past.


=== Holding ===
=== Holding ===
The DPA investigated four search results in total. They instructed Google to delete one search result and requested more information for another one. However, the DPA denied the erasure request from the complainant for the two other search results.
The DPA investigated four search results in total. They instructed Google to delete one search result and requested more information for another one. However, the DPA denied the erasure request from the data subject for the two other search results.


== Comment ==
== Comment ==
Line 80: Line 82:


== English Machine Translation of the Decision ==
== English Machine Translation of the Decision ==
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
''This decision was not made publicly available.''
 
<pre>
Decision to delete search results
 
The Data Inspectorate orders Google to delete one search match, but keep two others.
 
The background to the case is a complaint from a private person who wanted certain search results deleted from Google.
 
The specific circumstances of the case are exempt from publicity in order to protect the complainant's identity.
</pre>

Latest revision as of 06:53, 6 March 2022

Datatilsynet (Norway) - 20/02059
LogoNO.png
Authority: Datatilsynet (Norway)
Jurisdiction: Norway
Relevant Law: Article 5(1)(d) GDPR
Article 6(1)(f) GDPR
Article 10 GDPR
Article 17(1)(c) GDPR
Article 21(1) GDPR
Type: Investigation
Outcome: No Violation Found
Started: 28.03.2020
Decided: 17.08.2021
Published:
Fine: None
Parties: Google
National Case Number/Name: 20/02059
European Case Law Identifier: n/a
Appeal: Appealed - Confirmed
Personvernnemnda (Norway)
2021-18 (20/02059)
Original Language(s): Norwegian
Original Source: [ n/a (in NO)]
Initial Contributor: Rie Aleksandra Walle

The Norwegian DPA instructed Google to delete a search result about a data subject's criminal past, but agreed with their decision to refuse erasure for two other search results. The DPA agreed these were still relevant after 10 years, in part because the data subject was a CSO in a company planning to go public, and the information was deemed to be of public interest. The Privacy Appeals Board later upheld the DPA's decision.

English Summary

Facts

A data subject was in 2011 sentenced to four years in prison for a serious case of corruption and for concealing the output from their criminal acts. They were also sentenced to pay about €550,000 in compensation and lost their right to run a business, including acting as a general manager or another leading position in any company's board, indefinitely. The case was mentioned in several newspaper articles.

The data subject contacted Google and Bing in February 2020 to request deletion of four search results leading to articles mentioning the prior criminal case. Bing deleted the results, but Google refused, stating: "Having assessed the balance of relevant rights and interest relating to the content in question, including factors such as its relevance to your professional life, Google has decided not to block this content." Consequently, the data subject lodged a complaint against Google.

The DPA noted that the lawful basis was Article 6(1)(f) GDPR and referred to the Article 29 Group's guidelines WP225 relating to search engine results and the balancing between fundamental rights and interests vs. de-listing of information. They also took into account that the information the search results lead to, was convered by Article 10 GDPR that by default prohibits processing of such personal data (relating to criminal convictions and offences). Normally, this would support erasure in this situation, cf. G.C. & Others v. CNIL, section 67 (C-136/17 24 September 2019).

However, on the other hand, two of the search results lead to articles with objective and factual information the data subject's criminal past. The DPA found this to contradict the data subject's right to erasure. Further, the DPA emphasized that the search results was published for journalistic purposes and the context for which the articles was published, support the public interest and contradicts the right to erasure. Finally, the DPA notes that the information relates to the data subject's work life and is less of a private nature, which further supports their assessment to deny the erasure request.

The DPA noted that the data subject, who today acts as a Chief Security Officer, still has a role in the Norwegian business landscape. The search results are therefore still relevant, despite the articles dating back nine and ten years, and especially because the company they work at plans to go public. The public therefore has a particular interest regarding their work-related past.

Holding

The DPA investigated four search results in total. They instructed Google to delete one search result and requested more information for another one. However, the DPA denied the erasure request from the data subject for the two other search results.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

This decision was not made publicly available.