HDPA (Greece) - 38/2023
From GDPRhub
| HDPA - 38/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 2(1) GDPR Article 3(2) GDPR Article 17 GDPR Article 55(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 21.02.2022 |
| Decided: | 13.06.2023 |
| Published: | 28.12.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 38/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | Hellenic DPA (in EL) |
| Initial Contributor: | Nikolaos.Konstantis |
The Hellenic DPA accepted the complaint in which the data subject complained about Google's refusal to delete search results that appeared based on her name. The data subject claimed that because of the results of the search engine for several years she was unable to find a job, while she added that keeping them has a negative effect on her professional carrer.
English Summary
Facts
Google claimed that it would not grant the request to delete the links, as the disputed links relate to matters of substantial public interest regarding her professional life. Google added that the data subject is allegedly the beneficiary of a possible incident, as she was paid on her pervious position with public money derived from the taxation of citizens. Citizens have an interest in being informed about the manner of her appointment, especially in the event that there are suspicions that it was not carried out transparently. The data subject pointed the negative effects of the publicity due to the disputed links in relation to her attempt to find a job. She presented her resume, stating that the assistant position she held was offered to her because of her qualifications, while at the same time she submitted e-mails she had sent to prospective employers. According to the data subject, the deletion request should be granted, as she is not a person of public interest and she had never held a public office, while the information contained in the publications is already outdated and not updated and there is no public interest for their preservation . Due to the fact that it becomes impossible to find a job, her right to privacy and above all to free access to the labor market is unduly affected, resulting in her economic hardship with consequences for her psychological state as well.On her professional employment , Google claimed that they invited her to provide information about her current employment status or evidence that she has left the job to which the links in question refer, but the data subject did not provide any and, therefore, in the absence of evidence that demonstrate that the data subject has changed her line of work, the content at issue should not be removed from search engine results as it is still relevant to the public's interest in information. Regarding the data subject's claim of difficulty finding a job ,Google countered that the fact that controversial posts prove to be a deterrent to potential employers proves that the information is perfectly relevant to the public's interest and not at all out of date.
Holding
The Hellenic DPA, balancing the right to inform the public and the right to the protection of personal data as cited in the Article 17 GDPR, concluded that the protection of personal data prevails, as the information in question can no longer be characterized as current and of interest to public opinion. At the same time, the Hellenic DPA pointed out that there are disproportionately adverse effects on the data subject's private life and especially on her professional life, mainly due to the difficulty she faces in finding a job, and the general negative impact that is exacerbated due to the public's easy access to the aforementioned outdated and out-of-date information. For these reasons, the DPA ordered the removal-deletion of the links in question.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
DECISION 38/2023 The Personal Data Protection Authority (hereinafter "Authority") met at the invitation of its President in a meeting on Tuesday 13-06- 2023 and time 10.00, in order to examine the case mentioned in the history of the present. The President of the Authority, Konstantinos Menudakos, the regular members Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, Aikaterini Iliadou and Grigorios Tsolias were present, as rapporteur. Present, without the right to vote, were Stefania Plota, specialist scientist - lawyer, as assistant rapporteur and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into account the following: With complaint No. C/EIS/749/21-02-2022, A (hereinafter "complainant") appealed to the Authority against the company Google LLC (hereinafter "Google") or "company"), for failure to satisfy the right to deletion (right to be forgotten) of results appearing in the Google search engine based on the first name of the complainant. In particular, the complainant states that the application no. ... request to Google on ... to delete texts-articles referring to it, as the nature of the information in question is outdated, the information appears to be inappropriate and has ceased to be relevant, there are no reasons of public interest for its retention and the complainant as a citizen of an EU Member State 2 wishes to delete data from her digital past through the deletion of a specific reference to her name from the index results of an online search engine (see following links), as the right to be forgotten derives directly from the primary and secondary European law: 1. ... 2. ... 3. ... 4. ... 5. ... 6. ... 7. ... 8. ... 9. ... 10. ... 11 . … 12. … 13. … 14. … 15. … 16. … 17. … 18. … 19. … 20. … 21. … 3 22. … 23. … 24. … 25. ... 26. ... 27. ... 28. ... 29. ... 30. ... 31. ... 32. ... 33. ... 34. ... 35. ... 36. ... 37. .. 38. ... 39. ... The complainant states that on ... the company replied that "the publications in question cannot be deleted from the search engine for reasons of public interest". The Authority, in the context of examining the above complaint, called the companies Google LLC, as the operator of the Google search engine, and Google Hellas with the no. prot. C/EXE/954/21-04-2022 document, to provide their opinions on the complaints, fully justifying their negative response for each link separately. The company Google LLC responded to the Authority with 4 no. prot. C/EIS/7005/13-05-2022 document that the complainant submitted to ... with reference number ... her request to Google, requesting the removal from the search results based on her name of the links mentioned there (URLs) invoking the right to be forgotten and the company responded to the complainant on … that it will not grant the request to delete the links, as the disputed links relate to matters of substantial public interest regarding her professional life. The company in its above document to the Authority, quoting some of the criteria mentioned in the Article 29 Working Group Guidelines, namely the criteria if the subject plays a role in public life and if the data is accurate and concerns professional life of the subject, came to the conclusion that the disputed information remains up-to-date, relates to the complainant's professional activity of public interest and that its inaccuracy was not proven. Finally, in the same document, the company states that the content of the following six (6) links does not refer to the complainant and will proceed to delete them from the list of search results in the search engine that appear on the basis of her name: 1. … 2 .… 3. … 4. … 5. … 6.… In view of the above, the Authority with the under no. prot. C/EX/608/08-03-2023 and C/EX/604/08-03-2023 documents invited the aforementioned companies and the complainant respectively, as legally represented, to attend, via video conference, the meeting of Plenary Session of the Authority on 14-03-2023, in order to discuss the complaint in question. The above meeting 5 was attended by A and the attorney-in-fact of Panagiota Dikaliotis with AMDS Kalamata ... and on behalf of Google LLC the attorneys-at-law Chariklia Daouti (AMDSA ...) and Evangelia Tsirigotis (AMDSA ...). Those present developed their opinions and were given a deadline for submitting memoranda, which they submitted on time. The complained company submitted the under no. prot. C/EIS/2362/30-03-2023 memorandum, in which he repeated what he had stated in the original memorandum and added that the complainant, according to the disputed information, is allegedly the beneficiary of the eventual incident ... that took place in ..., which, in the position she occupied, was paid with public money derived from the taxation of the citizens ..., who have an interest in being informed about the manner of her appointment, especially in the event that there are suspicions that it was not carried out transparently. Also, the company stated that in relation to the question posed by the OE Guidelines of article 29, if the data in question concern the subject's professional life, the company had called the complainant on ... during his evaluation with no. report ... request for deletion to provide information about her current professional status or evidence that she has left the job, to which the links in question refer, however the complainant did not provide any and, therefore, in the absence of evidence that the complainant has changed line of business, the disputed content should not be removed from search engine results as it is still relevant to the public's interest in information. The fact, invoked by the complainant, that while she is looking for work, the disputed publications prove to be discouraging to potential employers, proves that the disputed information is completely relevant to the public's interest and is in no way outdated. The company states on the one hand that with regard to the issue of whether the data has a disproportionately negative impact on the privacy of the complainant, the latter does not establish that the rejections of jobs are due to the publications and does not clarify what happened between ... when the employment contract was terminated and on ..., i.e. five (5) years later, which submitted the deletion request belatedly claiming that there is damage and 6 on the other hand that the nature of the disputed content as an object of journalistic research and processing, reinforces its position that the content in question should not be deleted from the search engine. The complainant submitted the under no. prot. C/EIS/2389/31-03-2023 memorandum, in which he stated that the ... of the former ... does not maintain any relationship with the said ... space. The complainant provided her curriculum vitae and stated that due to her qualifications, at the beginning of the period … in the year … she was offered and accepted the position of Assistant to … ….. and that the employment contract in question was terminated on … and not with end of the period. However, since ... there are publications on the internet with the complainant's details listed in a system ..., without mentioning the fulfillment of the substantive and formal conditions, which have caused damage to her professional career, as they prevented her from being hired due to of her connection with the specific ... who has been characterized ..., a fact about which some prospective employers informed her, and she submits to the Authority electronic messages that she has sent to prospective employers with her CV attached. With reference to the deletion request he submitted to the company under consideration, he states that it should be granted, as he is not a person of public interest and relevance and has never held a public office, while the information contained in the publications in question from ... is already outdated and not updated, there are no reasons of public interest for their maintenance and due to the fact that it becomes impossible to find a job, her right to privacy and above all to free access to the labor market is excessively affected, resulting in her financial hardship with consequences for her psychological state, while lists thirty-five (35) of the original thirty-nine (39) links to be deleted. The Authority, after examining all the elements of the file and what emerged from the hearing before it, the memoranda and the statements of the parties, after hearing the rapporteur and the clarifications from the assistant rapporteur, who was present without the right to vote, after thorough discussion, CONSIDERED ACCORDING TO LAW 7 1. Because, from the provisions of Articles 51 and 55 of the General Data Protection Regulation 2016/679 (GDPR) and Article 9 of Law 4624/2019 (Government Gazette A΄ 137) it follows that the Authority has the authority to supervise the implementation of the provisions of the GDPR , of this law and other regulations concerning the protection of the individual from the processing of personal data. 2. Because Google LLC, based in the United States of America, with its document No. C/EIS/10060/14-12-2018 informed the Authority that, although Google Ireland will be the data controller for user data collected and processed when users interact with Google services - including data collected through the Google search engine where users choose to store activity or search history data in their accounts - Google LLC will continue to be the data controller of the classified content (index) of the Google search engine and manage the erasure process under the right to be forgotten. Therefore, in the case under consideration, the purpose and means of processing to satisfy the right to erasure (to be forgotten) according to Article 17 of the GDPR are fully determined by the company Google LLC, as it states, whose facility is located outside the European Union .Consequently, although the specific activity concerns data subjects located in the territory of the Union, since Google LLC does not have a main facility in the Union for the activity in question, the "one-stop mechanism" according to Articles 56 and 60 of the GDPR does not apply " established by the GDPR and, therefore, in accordance with the provisions of articles 55 par. 1, 2 par. 1 and 3 par. 2 GDPR and 13 par. 1 item g' Law 4624/2019, the Authority has the authority to deal with the complaint of A, for violation of the right to erasure. 3. Since the activity of Google Hellas/Athens (GOOGL HELLAS Internet Applications Sole Proprietorship Limited Liability Company) is the provision of marketing services to Google Ireland, the complaint for the rejection 8 of the request to delete links in the context of satisfying the right to be forgotten is considered only to the company Google LLC as data controller of the classified content (index) of the Google search engine. 4. Because according to Article 17 para. 1 of the GDPR, "the data subject has the right to request from the controller the deletion of personal data concerning him without undue delay and the controller is obliged to delete personal data without unjustified delay, if one of the following reasons applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, […], c) the data subject objects to the processing in accordance with Article 21(1) and there are no compelling and legitimate reasons for the processing or the data subject objects to the processing in accordance with Article 21(2), [...]'. In paragraph 3 of the same article it is defined that "paragraphs 1 and 2 do not apply to the extent that the processing is necessary: a) for the exercise of the right to freedom of expression and the right to information [...]" 5. Because according to above article 17 of the GDPR, as it has been interpreted according to the content of the Guidelines 5/2019 of the GDPR1, the data subject has the right to request from the data controller the deletion of personal data concerning him without undue delay and the data controller is obliged to delete personal data without undue delay if one of the reasons listed in Article 17 of the GDPR applies. The EDPS points out2 that, in case the deletion request is made for the first reason, i.e. the subject requests the deletion 1 Guidelines 5/2019 of the European Data Protection Board regarding "the criteria governing the right to be forgotten, according to the GDPR, in the cases of search engines" 2 See Guidelines 5/2019 para. 19 9 content from the search results, when the personal data of the subject is no longer necessary in relation to the purposes, the search engine must ensure the balance between the protection of privacy and the rights of Internet users when accessing information. In particular, it should be assessed whether, over time, the personal data has become obsolete or has not been updated. Also, the GDPR3 states that in case the deletion request is made for the third reason, i.e. the subject objects to the processing, then the GDPR provides stronger guarantees to data subjects than Directive 95/46, because the right to object to the GDPR does not limit the grounds on which data subjects may request erasure pursuant to Article 17 para. 1 of the GDPR. The data subject can object to processing "for reasons related to his particular situation", without having to demonstrate "compelling and legitimate reasons", as foreseen by Directive 95/46. The GDPR shifts the burden of proof and provides a presumption in favor of the data subject, obliging instead (the subject) the controller (in this case Google) to prove the compelling and legitimate reasons that make the processing absolutely necessary (Article 21 para. 1 GDPR). Consequently, when a search engine provider today receives a deletion request based on the particular situation of the data subject, it must now delete the personal data, in accordance with Article 17 para. 1 item. c) of the GDPR, unless it is able to demonstrate that there are "compelling and legitimate reasons" for the inclusion of the specific search result, which in combination with Article 21 paragraph 1 constitute "compelling and legitimate reasons (...) which override the interests, rights and freedoms of the data subject". 3 See Guidelines 5/2019 para. 27 10 6. In the case under consideration, the company stated in the memoranda it submitted to the Authority before and after the discussion of the case that it will remove the following links from the list of search results that appear on the basis of the name of the complainant, as the content of the first six (6) does not refer to the complainant, while the last two (2) links refer to websites that do not display content or display content, which does not include the name of the complainant: 1. ... 2. … 3. … 4. … 5. … 6.… 7. … 8. … However, following a search by the Authority on 08-06-2023 of the publications in the above points 1 to 4 links, it emerged that they had the same content with the other links in question with reference to the complainant and that the publications contained in the links under points 3 and 4 mistakenly refer to "B" instead of the correct "A". Also, it is noted that the above under point 8 link mentioned by the company was not included in the complaint file submitted to the Authority. In any case, however, following a search by the Authority on the same day, the above links under points 1 to 8 did not appear as results in the Google search engine, based on the first and last name of the complainant. 7. For the other thirty-two (32) links, the company refuses to delete them from the list of results of the Google search engine that appear with the complainant's name as a search criterion, 11 as it maintains that the disputed information remains up-to-date, concerns the professional public interesting activity of the complainant and no inaccuracy of these was proven: 1. ... 2. ... 3. ... 4. ... 5. ... 6. ... 7. ... 8. ... 9. ... 10. ... 11. ... 12. ... 13. ... 14. ... 15. ... 16. ... 17. ... 18. ... 19. ... 20. ... 21. ... 22. ... 12 23. ... 24. ... 25. ... 26. ... 27. ... 28. ... 29. ... 30. ... 31. ... 32. ... 8. According to the data in the case file, the links in question contain publications of ... -except for the one under no. 29 of a link that leads to a publication by ... but with the same content - concerning the professional life of the complainant in relation to her employment contract as Assistant to ... which was valid from ... to ..., at which point it was terminated without having completed the ... period, which ended in the year ..., while there is no renewal or continuation of this professional course in any way. Although the complainant held a paid position in ... from ... to ... and transparency regarding the recruitment of persons in said positions is of public interest, it does not appear that she has in any way continued the same or similar employment in any public position or organization after January of …. Taking into account that the complainant - as the person who is the reason for the publication of the said information - completed his ... term in the year ... and has since become independent from the ... place ..., the said information can no longer be characterized as current which are now of public interest. After weighing up the right to inform the public and the protection of personal data, it follows that on the one hand the right to the protection of personal data prevails in view of the aforementioned 13 findings of the Authority. On the other hand, there are disproportionately adverse effects on the private and especially on the professional life of the complainant, mainly due to the difficulty she faces in finding work, and the more general negative impact that is aggravated by the easy access of the public to the aforementioned outdated and out-of-date information. Therefore, the Authority considers that the complainant's request to the company Google LLC, as data controller, for the deletion of data no. 1 to 32 (see paragraph 7 above) links from the list of results in the Google search engine that appear with the complainant's name as a search criterion. Based on the above, the Authority unanimously decides that the complainant, as data controller, should be given the order referred to in the executive order to comply with the complainant's deletion request. FOR THESE REASONS The Authority: Orders, in accordance with the provisions of Article 58 para. 2 c of Regulation (EU) 2016/679, the company Google LLC, as controller, to immediately proceed with the abolition-deletion of the links mentioned above in paragraph 7 as search results with the name of the complainant in the Google search engine. The President The Secretary Konstantinos Menudakos Irini Papageorgopoulou
