HDPA (Greece) - 24/2024
From GDPRhub
| HDPA - 24/2024 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 2(1) GDPR Article 3(2) GDPR Article 17(1) GDPR Article 21(1) GDPR Article 55(1) GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 02.01.2018 |
| Decided: | 29.06.2023 |
| Published: | 30.08.2024 |
| Fine: | n/a |
| Parties: | n/a Google LLC |
| National Case Number/Name: | 24/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Vasiliki Kalantzi |
The DPA held that Google must delete nine specified links from its search results under Article 17 GDPR, as the data subject's “particular situation” outweighed public interest. Furthermore, the DPA confirmed its jurisdiction despite Google having no EU establishment.
English Summary
Facts
A data subject filed a complaint with the Greek DPA (HDPA) on the grounds that Google LLC (the controller) did not satisfy his right to erasure, namely had not erased, as requested, 309 links with results relating to him, appearing on the Google search engine when searched by his name.
Following subsequent communications of the HDPA and the parties involved, as well the HDPA’s own investigation, it was determined that the HDPA had yet to decide on 9 links for which the controller claimed that the data subject’s right to erasure was unfounded, and on further 4 links which were revealed after HDPA’s investigation.
Holding
The HDPA ruled that the controller must comply with the right to be forgotten under Article 17 GDPR unless it can prove compelling legal grounds to retain the data and ordered the controller (per Art. 58(2) GDPR) to delete 9 links mentioned in the complaint and to confirm that links 1, 3, and 6–9 do not appear in Google search results when the data subject’s full name is used.
The controller informed the HDPA that they are the respective controller for any data collected by the Google search engine. As the controller has no main EU establishment, the “one-stop-shop” mechanism under Articles 56 and 60 GDPR does not apply, making the HDPA competent under Articles 2(1), 3(2), and 55(1) GDPR.
The HDPA also held that while not a public figure, the data subject’s professional activity places them in a role of public interest, as executives of significant companies may attract public interest.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 30-08-2024 No. Prot.: 2273 DECISION 24/2024 The Personal Data Protection Authority (hereinafter referred to as the "Authority") met upon invitation of its President in a meeting on Tuesday 29-06- 2023 at 10.00, in order to examine the case referred to in the history of this case. The President of the Authority, Konstantinos Menuudakos, the regular members Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, Aikaterini Iliadou and Grigorios Tsolias, as rapporteur, were present. Present, without the right to vote, were Stefania Plota, a specialist scientist - lawyer, as assistant rapporteur and Irini Papageorgopoulou, an employee of the administrative affairs department, as secretary. The Authority took into account the following: With the complaint no. C/ΕΙΣ/33/02-01-2018, A (hereinafter the “complainant”) appealed to the Authority against the company Google Inc. (hereinafter “Google” or “company”), for failure to satisfy the right to deletion (right to be forgotten) of results displayed in the Google search engine with the complainant’s name as a criterion. Specifically, the complainant submitted his application from … to the controller Google Inc. with reference number...for the deletion from the search results of the Google Search engine of the links below (total 309), in accordance with article 13 par. 1 of Law 2472/1997, and the activation of procedures in order 1 1-3 Kifissias Ave., 11523 Athens T: 210 6475 600 • E: contact@dpa.gr • www.dpa.grto make future access to these data impossible. In particular, the complainant claims that after searching the Google Web Search engine based on his name and surname, “namely a) A , b) A , c) A , d) A , e) A , f) 1 2 3 4 5 A , g) A , h) A , i) A , and j) A ” the following list of results appears, 6 7 8 9 10 which contains links to websites published by third parties with information relating to his person, “which refer to sensitive data of my personal nature, and in particular: a) to very inaccurate information, relating to the No. … Resolution of the Athens Council of Appeals , by which it was decided to partially execute with case file elements “criminal file …” from … European Arrest Warrant of Authorities of [country] X, namely the Prosecutor's Office F of X-department …, in order to appear before the competent Judicial Authority of X (Prosecutor's Office F of X) and stand trial for the second only of the charges referred to in the above arrest warrant, namely the violation of Article … of the X Criminal Law, which constitutes the act of criminal … (Article 386, paragraph 3-1 of the Criminal Code) under Greek criminal law, and the non-execution of the above European Arrest Warrant, as regards the other acts (first and third), of forgery and the legal obligation to provide information to the bankruptcy trustee, at the time, however, that for all of the above acts (including that of the alleged violation of Articles … and … of the X Criminal Law Law - fraudulent bankruptcy), with the decision no. … of the …' Department of the Supreme Court it was decided that the aforementioned European arrest warrant should not be executed, and at the same time the restrictive conditions that had been imposed on me with the decision no. … of the Athens Board of Appeals were lifted, and the return of the guarantee of … euros, which had been deposited in execution of the above decision was ordered, being the said acceptance of my appeal no. … (…) against the decision no. … of the Athens Board of Appeals, and b) to inaccurate information, relating to the charges against me for the offenses of … and corresponding damage exceeding … drachmas, by profession and by continuation, of forgery and use of a forged document to a degree felony, and embezzlement to the extent of a felony, for which, however, I have been irrevocably acquitted by the No. …, …, … decision of the Three-Member Court of Appeal for Felonies Ps. The said sensitive 2 personal data of my nature have here and for a very long time (the 1st from … and the 2nd from …) become completely inaccurate, and in any case there is no longer any compelling reason to continue the said, harmful to my private, professional and social life, processing of the said data, and in particular in aggregate by Google, since this is a brutal attack on my personality, and my right to informational self-determination is violated, and even with completely inaccurate and inconsistent with the Principle of Proportionality sensitive personal data of mine character, attributing to my unfounded criminal prosecution and an invalid arrest warrant. In particular, the links in question, which contain illegal, inaccurate, and outdated information relating to my person, and of which I requested the deletion from Google Search search results, and the activation of procedures, in order to make future access to this data impossible, are […]” are the following three hundred and nine (309) links: … The company responded to the complainant on 21-11-2017 that it would “block”, without relevant justification, seven links, in four links it was unable to find the content under investigation or the relevant content or they did not appear as results in its search or have been removed, in one link it appears that the content refers to another person and it does not establish a violation of the rights of the complainant and for the others links, the company's conclusion is that the person's role in public life and the public interest, justifies their inclusion in the results of the Google search engine and has decided not to take any action on them. Following the company's response, the complainant submitted to the Authority the complaint under examination, in which, in addition to what is mentioned above in his request to the company, he claimed that Google in this way "on the one hand, violated the CJEU's decision of 13.05.2014 in Google Spain SL & Google Inc v. Agencia Espanola De Proteccion De Datos & Mario Costeja Gonzalez C- 3131/12, and on the other hand, did not properly assess my request, even with the documents submitted, and thus did not adequately justify its response", repeating the facts that he had also cited in his request to the company, adding that "moreover, its response in question is in complete contradiction with the partial satisfaction of my request, for the URLs,…, which, according to its response, it allegedly “blocked”, although they also concern the same information, which is processed with the other URLs, for which, without justification, it did not satisfy my request” and invokes article 13 of Law 2472/97, concluding that his objections are reasonable and there is undoubtedly a risk of serious, and in particular irreparable moral, financial and professional harm to him. The Authority, in the context of examining the above complaint, summoned the companies Google LLC (formerly Google Inc), as the operator of the Google search engine, and Google Hellas with the no. prot. G/EX/5232/26-07-2019 document, to provide their opinions on the complaints, justifying their negative response for each link separately. The company Google LLC responded to the Authority with the no. prot. C/EIS/6112/10-09-2019 document, in which he stated that the right to be forgotten has been defined by virtue of the judgment “Google Spain and Inc. v. Agencia Espanola De Proteccion de Datos (AEPD) and Mario Costeja Gonzales” C-131/12 (“Costeja judgment”) and the Guidelines of the Article 29 Working Party, as the right of an individual to cease to have information relating to him or her associated with his or her name through the list of results, which results from a search carried out on the basis of his or her name, when at that time the information “is inadequate, is not or has ceased to be relevant to the matter in question or is excessive in relation to the aforementioned purposes or to the time that has elapsed” and the decision accepts that the public interest prevails when the data subject plays a role in public life and the information in question is related to that role. The company points out the criteria that are posed as questions in the Guidelines, namely “what role does the data subject play in public life”, “do the data relate to the professional life of the data subject”, “are the data relating to the professional life of the data subject excessive. Is the data subject still active in the same profession”, “are the data accurate”, “are the data related to criminal offences”. The company claims in the present case that “the data subject - complainant is a well-known Greek …, who is also the owner of a large network … . The articles refer, among others: - To the arrest of the complainant following the issuance of a European Arrest Warrant by the Authorities for the offences of …, … and …. The complainant invokes decision no. … of the Supreme Court (criminal division), by virtue of which the execution of the said European Arrest Warrant was prohibited. The complainant also invokes decision no. …,…,…/…of the Three-member Criminal Appeal Court Ψ, by virtue of which he was acquitted of the offences of … and corresponding damage exceeding … drachmas, by profession and by continuation, of … and use of … to the extent of a felony and of … to the extent of a felony.- In the complainant’s professional life and his relationship with political figures and various other judicial disputes in which he was involved (e.g. …)”, concluding that: i) “the links (URLs) leading to articles referring to the case of the complainant’s arrest following the issuance of a European Arrest Warrant dated … in against him by the X Authorities, for the offences of…,… and… should be deleted in accordance with the supporting documents submitted by the complainant, as attached to your e-mail from … and your e-mail from …, which demonstrate that the execution of the European Arrest Warrant against him by the X Authorities was prohibited”, and ii) “articles which include updated information regarding the issuance of the acquittals decisions relied on by the complainant are accurate and up-to-date and, therefore, there is no legitimate reason for their deletion from the list of search results, […] there is no legitimate reason for the deletion of articles referring to events relating to the professional life of the complainant, his relations with political figures, or other judicial conflicts in which the complainant is involved, and for which the plaintiff does not rely or prove their inaccuracy with any evidence”. By virtue of the above, the company will, as stated, take all necessary actions to remove two hundred and nine (209) links, out of the total of three hundred and nine (309) that related to the complainant's deletion request, from the search results that appear following a search based on the complainant's name. The company also found that forty-nine (49) links from those included in the complainant's deletion request lead users to websites whose content either cannot be displayed or does not refer to the complainant, and the company will take all necessary actions to remove the said links from the list of search results that appear based on the complainant's name. In contrast, for fifty-one (51) links included in the complainant’s delisting request, the company claims that they “refer to articles, the content of which is accurate and, therefore, there is no legitimate reason for their deletion from the search results displayed on the basis of the complainant’s name. In particular, some of the articles refer to the legal cases in which the complainant is involved, however, they include updated information regarding the acquittals that the complainant invokes. Other articles refer to events concerning the complainant’s professional life, his relations with political figures, or other legal disputes in which the complainant is involved, that have not been dismissed or annulled by a court decision. For these reasons, and taking into account the role of the complainant in public life, which establishes the legitimate interest of the public to have access to the information referred to in the said articles, we consider the deletion of the following links (URLs) as not permissible, based on the “Guidelines of the Article 29 Working Group”. Subsequently, the complainant submitted to the Authority the email no. proc.C/EIS/1245/28- 01-2022, in which he provided the following list of one hundred and ten 110 links (of which five (5) links are repeated), stating that these links now concern him, of which he requests the deletion: 6… Also, the complainant submitted to the Authority the email no. prot. C/ΕΙΣ/7691/03-06-2022 supplementary email message, with an attached copy of the company's email message dated …, in which it responds to the complainant's request dated … no. … to it that the company will proceed to remove them from the search engine search results based on the complainant's name, for forty-four (44) links it states that the specific websites do not appear as a search result or have been removed, while, because the content of the remaining fifty-two (52) links appears to be related to criminal offenses, the company states that it cannot adequately evaluate the deletion request, as it does not have full information on the outcome of the cases. Following these documents, the Authority, with the document no. Γ/ΕΞ/350/09-02-2023, invited the company to reconsider the complainant's requests and to provide clarifications. The company responded with the document no. prot. C/ΕΙΣ/1922/15-03-2023 letter that the complainant in the request from … to the company for the deletion of links as a result in the search engine stated as a reason that “all the above links refer to sensitive personal data of my client, A, in violation of the provisions of the GDPR2016, and the right was violated, since my client has been declared innocent and no criminal proceedings are pending against him”, however, the complainant did not provide any relevant new supporting document, with which his acquittal is confirmed, nor did he invoke the no. … a decision of the Supreme Court that had been invoked in the past, by virtue of which the restrictive conditions against him were lifted and it was decided that the European Warrant issued against him should not be executed. In this document the company groups the links that now appeared as a result of a search into two categories (A, B), stating that the links in category A (1-22) “refer to websites that do not display content, or do not display the name and surname of the Complainant, therefore, the Company will 7proceed to delete them from the list of results of the search engine, which appear after a search for the name and surname of the Complainant”: … The links in category B are divided into two subcategories (B.i and B.ii). Specifically, the Company claimed that the links of subcategory B.i (1- 21) “must be deleted from the search engine list that appears after a search for the Complainant’s name, as they lead to articles that refer to the case of the arrest of the Complainant following the issuance of a European Arrest Warrant dated … against him by the X Authorities, for the offenses of …, … and …, the execution of which (Warrant) was proven, sixth no. … decision of the Areios Pagos, submitted by the Complainant and other supporting documents”: B.i. (1-21): … Furthermore, the company claims that the following links of subcategory B.ii (1-9) should not be deleted, “as they contain accurate and up-to-date information, either regarding the issuance of the judicial decisions that the Complainant has invoked in the past, or regarding activities in the context of the Complainant’s professional life, for which he neither invokes nor proves any inaccuracy, and, as therefore, there is no legitimate reason for deleting them from the list of search results. That is, there is a legitimate interest of the public to continue to be informed about this content, which is up-to-date and accurate and, therefore, the Complainant’s right to be forgotten cannot be established.”: B.ii. (1-9) … 8 In view of the above, the Authority, with the documents no. Γ/ΕΞ/1232/15-05-2023 and Γ/ΕΞ/1233/15-05-2023, invited the aforementioned companies and the complainant respectively, as legally represented, to attend, via teleconference, at the Plenary Session of the Authority on Tuesday, 23-05-2023, in order to discuss the complaint in question. The above session was attended by the complainant's attorney Ioannis Apatsides (AMDSA …) and on behalf of the company Google LLC, Chariklia Daouti (AMDSA …) and Evangelia Tsirigoti (AMDSA …). During this meeting, the participants developed their views and the complainant and the company Google LLC submitted the memoranda with the documents no. Γ/ΕΙΣ/4322/09-06- 2023 and Γ/ΕΙΣ/4341/09-06- 2023 respectively, within the prescribed deadline. The complainant stated in the post-hearing memorandum that most of the posts concerning him have indeed been deleted, however, the remaining posts should also be deleted, as “the argument that, for example, The publication should remain posted, based on which the readership is informed that the rejection of the European arrest warrant, which was irregularly issued against him, was proposed or decided, since in this way the readership is informed of the major fact, namely that such a warrant had been issued against him. Given that I was vindicated by the Supreme Court, such information should be deleted completely, or at least anonymized, since it is not connected in any way to the exercise of his public authority in Greece, and almost eight (8) years have already passed, since 2016. Moreover, the preservation of these posts is absolutely contradictory, since GOOGLE deleted completely similar posts", concluding that his role in public life does not allow the publication of his sensitive personal data, and even information on the issuance of a European arrest warrant, which was ultimately overturned, since, among other things, this information does not relate to the exercise of any of his activities in Greece. The company, in its post-hearing memorandum, in addition to what it has already analyzed in the documents it has submitted to the Authority, states that the new allegations 9 raised by the complainant during the oral proceedings before the Authority do not overturn the company's already formulated positions on the subjects examining links, for which the right to be forgotten is not fulfilled, noting that the fact that the information concerning a person is up-to-date, and therefore accurate, argues, in combination with the other criteria of the Article 29 Working Party, in favour of the interest of Internet users to be informed of facts, over the interest of a person, who, by virtue of his professional activity, plays a role in public life, to impose on the search engine to remain silent regarding these facts. The company adds that if the search engine were to delete updated, and therefore accurate 1 information about persons with a role in public life, who are professionally involved in activities that have an impact on a larger group of persons, the blow would be twofold: on the one hand, the right to information of the public regarding information that may concern them would be undermined and, on the other hand, the quality of the services provided by the search engine to its consumers, that is, to internet users who expect to have accurate and up-to-date information, would be undermined, adding that updating the list of results concerning the person, on the basis of recent and true facts and by recording the latest developments regarding his/her disputed cases, constitutes a guarantee also for the data subject himself/herself, that he/she is not exposed to the public for acts and facts that have subsequently been overturned. The company points out, finally, that with regard to different links that appear in the list of results of the Google search engine, following a search for the complainant's name, which are not included in the complaint, the company has no obligation to take action, unless there is a request from the subject to the company and, although the complainant's attorney was called upon, during the hearing, to submit to the company any new 1 see Guidelines, Part II, question 2 10links, which he considers should be deleted from the search results, he has not done so until the day of the submission of the memorandum. The Authority, after examining all the elements of the file and those that emerged from the hearing before it, the memoranda and the statements of the parties, after hearing the rapporteur and the clarifications from the assistant rapporteur, who attended without the right to vote, following a thorough discussion, HAS DECIDED IN ACCORDANCE WITH THE LAW 1. Since, from the provisions of articles 51 and 55 of the General Data Protection Regulation 2016/679 (GDPR) and article 9 of law 4624/2019 (Government Gazette 137) it follows that the Authority has the competence to supervise the implementation of the provisions of the GDPR, this law and other regulations concerning the protection of individuals from the processing of personal data personal data. 2. Because Google LLC, based in the United States of America, with its document no. proto. Γ/ΕΙΣ/10060/14-12-2018 informed the Authority that, although Google Ireland will be the controller for user data collected and processed when users interact with Google services - including data that has been collected through the Google search engine, where users choose to store activity data or search history in their accounts - Google LLC will continue to be the controller for the data of the classified content (index) of the Google search engine and to manage the deletion process in the context of the right to be forgotten. Therefore, in the case under consideration, the purpose and the means of processing for the satisfaction of the right to erasure (to be forgotten), under Article 17 of the GDPR, are fully determined by the company Google LLC, as itself states, whose establishment is located outside the European Union. Consequently, although the specific activity concerns data subjects located in the territory of the Union, since the company Google LLC does not have a main establishment in the Union for the activity under consideration, the “one-stop shop” established by the GDPR under Articles 56 and 60 does not apply and, therefore, in accordance with the provisions of Articles 55 11 para. 1, 2 para. 1 and 3 para. 2 GDPR and 13 para. 1 lit. g. Law 4624/2019, the Authority has competence to handle A's complaint for violation of the right to deletion. 3. Since the activity of Google Hellas/Athens (GOOGLE HELLAS Internet Applications Single-member Limited Liability Company) is the provision of marketing services to Google Ireland, the complaint for the rejection of the request to delete links in the context of satisfying the right to be forgotten, is examined only with regard to the company Google LLC as the controller of the data of the classified content (index) of the Google search engine. 4. Because according to Article 17(1) of the GDPR, “the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall be obliged to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, […], c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing or the data subject objects to the processing pursuant to Article 21(2), […]”. In par. 3 of the same article it is stated that “paragraphs 1 and 2 shall not apply to the extent that the processing is necessary: a) for the exercise of the right to freedom of expression and the right to information […]” 5. Since, in accordance with the above Article 17 of the GDPR, as interpreted in accordance with the content of the Guidelines 5/2019 of the EDPB, the data subject has the right to request from the controller 2Guidelines 5/2019 of the European Data Protection Board on “the criteria governing the right to be forgotten, under the GDPR, in the case of search engines” 12the deletion of personal data concerning him without undue delay and the controller is obliged to delete personal data without undue delay delay, if one of the grounds referred to in Article 17 of the GDPR applies. The EDPB notes that, in the event that the request for erasure is made for the first ground, i.e. the subject requests the deletion of content from the search results, when the personal data of the subject are no longer necessary in relation to the purposes, the search engine must ensure a balance between the protection of privacy and the rights of Internet users when accessing information. In particular, it should be assessed whether, over time, the personal data have become outdated or have not been updated. The EDPB also states that in case the request for erasure is made for the third reason, namely the subject objects to the processing, then the GDPR provides stronger guarantees to data subjects than Directive 95/46, because the right to object under the GDPR does not limit the grounds on which data subjects may request erasure under Article 17(1) of the GDPR. The data subject may object to the processing “on grounds relating to his or her particular situation”, without having to demonstrate “compelling and legitimate grounds”, as provided for in Directive 95/46. The GDPR shifts the burden of proof and provides a presumption in favour of the data subject, obliging the data controller (in this case Google) to demonstrate compelling and legitimate grounds for processing (Article 21 paragraph 1 GDPR). Consequently, when a search engine provider receives today a request for erasure based on the particular situation of the data subject, it is now obliged to erase the personal data, in accordance with Article 17, paragraph 1, point c of the GDPR, taking into account the 3See Guidelines 5/2019, op. cit., paragraph 19 4See Guidelines 5/2019, ibid., para. 27 13 deletion criteria developed by the Article 29 Working Party, in the 5 measure appropriate to the present case, unless it is in a position to demonstrate that there are “compelling and legitimate reasons” for the inclusion of the specific search result, which in conjunction with Article 21 paragraph 1 constitute “compelling and legitimate reasons (...) which override the interests, rights and freedoms of the data subject”. 6. Whereas, according to the case law of the Court of Justice of the European Union, the data subject has the right to have information relating to him or her cease to be linked to his or her name in the list of results, which results from a search carried out on the basis of the name of a natural person, and furthermore, the search in question may result in users being able to obtain, through the list of results, a systematic overview of the information available on the internet concerning the person in question and which enables users to form a more or less detailed profile of the data subject, which concerns his or her private life. 9 7. Furthermore, according to the case-law of the Court of Justice of the European Union, it is for the person requesting the de-linking, in the event of an alleged inaccuracy of the classified content, to prove the manifest inaccuracy of the information contained in the content in question by providing the evidence which he can reasonably be expected to be able to find, in the light of the circumstances of the particular case. 5 See Guidelines on the application of the judgment of the Court of Justice of the European Union in Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, C-131/12 6See Guidelines 5/2019, ibid., para. 30 7C-136/17 para. 52. 8C-460/20 para. 50, C-131/12 paras. 36, 37 and C-136/17 para. 36. 9 10-460/20 paras. 52, 62. C-460/20 paras. 68, 72. 148. Furthermore, according to the case-law of the Court of Justice of the European Union “[…] although the protected by Articles 7 and 8 of The rights of the data subject generally outweigh the legitimate interest of potentially interested internet users in accessing the information in question, but that balancing may depend on the relevant circumstances of each case, in particular the nature of the information in question and its sensitivity for the private life of the data subject, as well as the public interest in having that information, which may vary according to, inter alia, the role played by the data subject in public life (judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 81, and of 24 September 2019, GC and Others). (Removal of links to sensitive data), C-136/17, EU:C:2019:773, paragraph 66]. 63. In particular, where the data subject plays a role in public life, he or she must show a greater degree of tolerance, given that he or she is inevitably and knowingly exposed to public scrutiny (cf. judgment of the ECtHR of 6 October 2022, Khural and Zeynalov v. Azerbaijan, CE:ECHR:2022:1006JUD005506911, § 41 and the case-law cited)”. Also, in judgment C-136/17, paragraphs 67 and 68, the Court held that “the operator of a search engine, when it is requested to remove a link to a website on which such sensitive data is published, must, on the basis of all the relevant elements of the specific case and taking into account the seriousness of the interference with the fundamental rights of the data subject to respect for private life and to the protection of personal data, which are enshrined in Articles 7 and 8 of the Charter, verify, on the basis of the substantial public interest grounds referred to in Article 8, paragraph 4, of Directive 95/46 or Article 9, paragraph 2, point (g) of Regulation 2016/679 and in compliance with the conditions of those provisions, whether the appearance of this link in the list of results resulting from a search based on the name of the data subject is 11 C-460 paras. 62, 63. 15absolutely necessary for the protection of the information protected by Article 11 of the Charter of freedom of information of internet users who may be interested in gaining access to this information through such search”. 9. Because according to the case law of the Authority, the reasons for submitting a request for the deletion of a link to a search engine service provider, such as Google, must be documented. 10. Since in the case under consideration, the complainant submitted to the company a request dated … for the deletion of three hundred and nine (309) links as results from the Google search engine based on the brand name and our company the response dated … (under no. prot. C/ΕΙΣ/6112/10-09-2019) to the Authority stated that two hundred and nine (209) of them should be deleted, according to the supporting documents submitted by the complainant, for fifty-one (51) links the deletion from the engine results is considered as not permissible by virtue of the right to be sent and the other forty-nine (49) links will be deleted from the results because they lead users to websites whose content either cannot appears or is not reported to the complainant. Subsequently, the complainant, with the supplementary document dated … submitted to the Authority (under no. prot. C/ΕΙΣ/1245/28-01- 2022), stated that a total of one hundred and five (105) links now concerned him, as mentioned above. The complainant, with the email dated … sent to the Authority the company's response on the same day to the request dated … for deletion, in which the company stated that for six (6) links it would proceed to remove them from the search results of the search engine based on the complainant's name, as the complainant's name does not appear in them, the forty-four (44) links do not appear as search results or have been removed for fifty-two (52) links, because the content appears to be related to criminal offenses, the company cannot adequately assess the request for deletion, as it does not have full information about the outcome of the cases. In 12 ÁDPΧ 25/2019 sec. 5. 16 of … document submitted by the company to the Authority (under prot. no. C/ΕΙΣ/1922/15-03- 2023), stated, with regard to the fifty-two (52) links, that it will proceed to delete twenty-two (22) of them, as they refer to websites that do not display content, or display content that does not include the complainant’s name, while as for the remaining thirty (30) links, it will proceed to delete twenty-one (21) of them, concluding that for the remaining following nine (9) links, the complainant’s right to delete is not established: 1. … The link contains an article by … entitled “…” and concerns business decisions of complainant regarding … . 2. … The link contains an article by … entitled “…” and concerns an approach to the complainant … by the multinational … regarding … . 3. … The link contains a publication by … entitled “…”, however, the indication “error 404” appears. 4. … The link contains an article by … entitled “…” and concerns a description of the complainant’s business activities in … and in …, as …, … and … . 5. … The link contains an article by … entitled “…” and concerns an interview with, among other things, the complainant regarding his marriage in Russia and his relations with Panos Kammenos and the Russian crusader Konstantin Malofeev. 6. … The link contains an article by … entitled «…» and concerns the decision of the Supreme Court not to extradite the complainant to X. 7. … The link contains an article by … entitled «…» and concerns the issue of a decision by the Criminal Division of the Supreme Court not to extradite the complainant to X. 8. … The link contains an article by … entitled «…» and concerns the issue of a decision by the Criminal Division of the Supreme Court not to extradite the 17th complainant to X and lifting the restrictive conditions that had been imposed on him. 9. … The link contains an article by … entitled «…» and concerns the issue of a decision by the Criminal Division of the Supreme Court not to extradite the complainant to X and lifting the restrictive conditions that had been imposed on him. From the search conducted by the Authority on 09-05-2023 and 26-06-2023 in the Google search engine with criteria of the different spelling of the complainant's name "a) A , b1 A , 2) A 3 d) A4, e) 5 , f6 A , 7) A , h) A8, i)A 9 and i)A "10 of the above nine (9) links resulted only the link under point 4. Furthermore, from the Authority's searches, the following four (4) links emerged. In view of this, the Authority will formulate its judgment on the above nine (9) links and the following four (4) links, for which the company states that the complainant's right to deletion is not established: i. … which is one of the twenty-one (21) links that the company had stated that it had already deleted (see paragraph 10 above). The link in question contains an article by … entitled “…” which states that …, who had been arrested …, was released on the basis of an arrest warrant issued by the X Authorities and related to the offenses of …, … and … . ii. … which is one of the forty-four (44) links contained in the company’s response to the complainant, as links that did not result in a result or have been removed (see above paragraph 10). The link in question contains an article by … entitled “…” which states that the complainant was released after his arrest by the Greek police. iii. … which is one of the forty-four (44) links contained in the company’s response to the complainant dated …, 18 as links that did not result in a result or have been removed (see above). The link in question contains an article by … entitled “…” which states that the Greek Court of Appeal released A on bail of … euros, … after his detention by the police on a warrant issued by the X authorities in relation to … and that media reports indicate that he faces charges of …, … and … . iv. … which is one of the fifty-two (52) links contained in the company’s response to the complainant dated …, as links that did not result in a result or have been removed (see above paragraph 10). The link in question contains an article by … entitled “…” which states that the complainant was arrested at the request of X authorities, accused of … and … and the Prosecutor of Appeals ordered his pre-trial detention. 11. Because a data subject, although not a public figure,13 can be considered, due to his professional activity, to have a role in public life, since this criterion is broader than that of “public figure”, and this category usually also includes executives of organizations that play a significant role in the business life of the country, in the sense that there is an interest for the public in seeking information regarding their activities. For example, politicians, senior public officials, businessmen and those exercising statutory (regulated) professions are usually considered to have a role in public life. In particular, the fact that the complainant is engaged in professional activity relating to… entails an increased public interest in his information, taking into account Article 14, paragraph 9 of the Constitution on transparency in relation to… (cf. ECtHR Fuchsmann v. Germany, case no. 71233/13, judgment of 19.10.17, paragraph 41). Therefore, there is first of all an interest of the public in the complainant’s identity in relation to his professional activities. 13 See Decision 25/2019 AP, para. 6 1912. Whereas, the link under point 1 referred to in point 10 contains a publication from the year 2001, i.e. a period of twenty-two (22) years has passed, and, consequently, the said information becomes obsolete and outdated. The other links referred to in point 10 contain publications from the year 2015 and 2016, i.e. a period of at least eight (8) years has passed, a fact that should be taken into account in combination with the other criteria, as set out below. 13. Whereas, the complainant brought to the attention of the Authority the no. … (ed. …) decision of the …’ Criminal Division of the Supreme Court, by which the request for the execution of … European Arrest Warrant (EAW) issued by the authorities of X against him was rejected, the restrictive conditions that had been ordered in replacement of his temporary detention with the No. … Decision of the Athens Board of Appeals and ordered the return of the financial guarantee of… euros deposited by the complainant in execution of the above decision of the Athens Board of Appeals. 14. Since the information contained in points 2 and 4 of the links referred to in paragraph 10 concerns the complainant’s business activities and those contained in the link under point 5 also concern his social contacts and relations with other public figures and due to his status as …, … and …, they justify the public’s interest in gaining access to them, while the inaccuracy of these does not arise from the information submitted to the Authority. 15. Since the information contained in points 6 to 9 the links referred to in point 10 relate to the aforementioned criminal case of the complainant which was irrevocably terminated by the rejecting decision of the Supreme Court in favour of the complainant, it is up-to-date and accurate. However, maintaining the links to an issue which had arisen eight years ago and for which the Supreme Court ruled in essence that the complainant should not have been arrested and subjected to the procedure of provisional detention and extradition based on the EAW, creates a false and negative impression and impact on the public about the complainant in relation to the specific issue, which may affect both his personal and professional life and, moreover, the in question information does not concern a contemporary issue of public interest that contributes to public debate or to informing the public (cf. ECtHR in Grand Chamber, Hurbain v. Belgium, no. pr. 57292/16, decision of 04.7.2023, paras. 192, 222, 225, 231, 233), taking into account that, due to the nature of the data, their appearance as results in the search engine should only be made when it is absolutely necessary for informing the public (see above, paragraph 8). 16. Whereas, the information contained in points i. to iv. links referred to in paragraph 10, concerning the arrest of the complainant on the basis of an EAW by X, his temporary detention, its replacement with the payment of a financial guarantee for his release and finally the rejection of the request for the execution of the EAW, have not been updated based on the decision of the …’ Department of the Supreme Court (see paragraph 13) submitted by the complainant, have now become inaccurate and create an incorrect, inaccurate and misleading impression for the complainant. Based on the above, the Authority considers that: i. with regard to the remaining links as results in the Google search engine according to the Authority's search on 09-05-2023 and on 26-06-2023 based on the complainant's name under points i to iv referred to in paragraph 10, the complainant's request to Google LLC, as controller, to delete these links from the list of results in the said search engine must be accepted and, based on paragraph 16 , the respondent, as controller, must be ordered to delete the said links under points i. up to and including iv., and to confirm that they do not appear as a result in the search engine Google based on the complainant's name and the other links with the same content mentioned in the complaint under examination for which the company states that they either do not appear as a 21 result in the search engine, or have been removed, otherwise to proceed with the deletion of these from the search engine results. On the contrary, with regard to the link under point 4 in paragraph 10, the Authority considers in accordance with paragraph 14 that the conditions for satisfying the right to deletion exercised by the complainant are not met. ii. with regard to the eight (8) links referred to in paragraph 10, which do not appear as results in the Authority's searches but the company states that the satisfaction of the complainant's right to deletion is not established: - for the link under point 1, which contains information about the complainant's business life that was posted twenty-two (22) years ago and has therefore become outdated and out of date, in accordance with paragraph 12, the conditions for the satisfaction of the complainant's right to deletion are met, - for the links under points 2, 4 and 5, in accordance with what is mentioned in paragraph 14, the conditions for the satisfaction of the complainant's right to deletion are not met - for the link under point 3, because, in accordance with what is mentioned in paragraph 10, it does not appear to have content, the company should confirm that the link in question does not appear as a result in the search engine, otherwise proceed to delete it from the search engine results - for the links under points 6 to 9, in accordance with what is mentioned in paragraph 15, the accused, as the controller, must be given the order to confirm that the said links do not appear as results in the Google search engine based on the complainant's name, as well as the other links with the same content mentioned in the complaint under examination for which the company states that either do not appear as a result in the search engine, or have been removed, otherwise proceed to delete them from the search engine results 22Based on the above, the Authority unanimously decides that the accused company, as the controller, must be given the order referred to in the operative part order of its compliance in relation to the accepted part of the complainant's request for deletion of the links resulting from the search engine. FOR THESE REASONS The Authority: Orders, pursuant to the provision of Article 58, paragraph 2, point c’ of Regulation (EU) 2016/679, the company Google LLC, as controller: a. to proceed immediately to the removal-deletion of the links referred to above in paragraph 10 under points i. up to and including iv., as search results for the complainant's name in the Google search engine, to confirm that they do not appear as a result in the Google search engine for the complainant's name and the other links with the same content mentioned in the complaint under consideration, for which the company states that they either do not appear as a result in the search engine, or have been removed, otherwise to proceed with the deletion of these from the search engine results. b. to confirm that the links referred to in paragraph 10 under points 1, 3, 6 to 9, as well as the other links with the same content as the links under points 6 to 9 mentioned in the complaint under consideration, for which the company states that they either do not appear as a result in the search engine, either have been removed, otherwise to proceed with their deletion from the results of the search engine. 23 The President The Secretary Konstantinos Menudakos Irini Papageorgopoulou 24
