Hoge Raad - 20/02950

Hoge Raad - 20/02950
Court:	Hoge Raad (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 10 GDPR Article 17 GDPR Article 17(3) GDPR Article 21 GDPR Article 79 GDPR
Decided:	25.02.2022
Published:	25.02.2022
Parties:	Google LLC
National Case Number/Name:	20/02950
European Case Law Identifier:	ECLI:NL:HR:2022:329
Appeal from:	GHAMS (Netherlands) 200.248.187/01
Appeal to:	Not appealed
Original Language(s):	Dutch
Original Source:	Rechtspraak.nl (in Dutch)
Initial Contributor:	Giel Ritzen

The Supreme Court of the Netherlands held that there was no reason to overturn the Court of Appeal’s decision regarding the data subject’s request to order Google to erase search results.

English Summary

Facts

Controller Google and data subject is a plastic surgeon who had been conditionally suspended in 2016 for a lack of aftercare after an operation. Because Google then displayed search results that linked to articles about the data subject and their conditional suspension, the data subject requested Google to delete the search results pursuant to Article 17 GDPR. After Google rejected this request, the data subject brought the issue before Court, which upheld data subject’s claim. After Google appealed to this judgement, however, the Court of Appeal annulled the Court of First Instance’s judgement (https://gdprhub.eu/index.php?title=Gerechtshof_Amsterdam_-_200.248.187/01). According to the Court of Appeal, the right to freedom of expression and freedom of information of Google and of third parties, namely information providers and the general public, outweighed the right to privacy and personal data protection of the data subject.

The data subject, however, argued that their request must be assessed on the basis of Article 10 GDPR. Moreover, the data subject also stated that they were wrongly ordered to pay the costs of the proceedings in both instances. According to the data subject, it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay those costs if their challenge is unsuccessful. Hence, the data subject then appealed in cassation to the Supreme Court of the Netherlands.

Holding

The Supreme Court rejected the appeal.

First, it considered the data subject’s argument that their request should have been assessed on the basis of Article 10 GDPR. The Supreme Court found that it was irrelevant to discuss whether the Court of Appeal should have done this. According to the Supreme Court, the Court of Appeal already assessed whether it was strictly necessary to process the sensitive data pursuant to Article 10 GDPR. Now, the Court of Appeal decided that this was the case, to protect the right to information and freedom of expression. Hence, the Supreme Court considered that the Court of Appeal already considered the applicable standard (that would follow from Article 10 GDPR), and nevertheless decided that the data subject’s rights and interests did not outweigh Google and third parties’ interests.

Second, the Supreme Court considered whether it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay the costs of both proceedings, because this would limit their right to effective remedy. The Supreme Court noted that the assessment of such costs is left to national procedural law (Article 289 Rv. in the Netherlands). However, because the data subject did not argue why this national provision prevents them from effective legal remedy, the Supreme Court did not discuss this matter further.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

SUPREME COURT OF THE NETHERLANDS

CIVIL CHAMBER

Number 20/02950

Date February 25, 2022

ORDER

In the case of

[person involved],
residing at [residence],

APPLICANT for cassation,

hereinafter: [person involved],

lawyer: H.J.W. alto,

against

GOOGLE LLC,
based in Mountain View, California, United States of America,

DEFENDANT in cassation,

hereafter: Google,

lawyer: H.J. Pot.

1. Process

For the course of the proceedings in factual instances, the Supreme Court refers to:

the orders in case C/13/636885/HA RK 17-301 of the Amsterdam District Court of 25 January 2018 and 19 July 2018;

the decisions in case 200.248.187/01 of the Amsterdam Court of Appeal of 7 April 2020 and 23 June 2020.

[the person concerned] lodged an appeal in cassation against the decision of the Court of Appeal of 23 June 2020. The application is attached to this decision and forms part thereof.

Google has requested that the appeal be dismissed.

The conclusion of the Advocate General B.J. Drijber seeks to dismiss the appeal in cassation.

The lawyer of [the person concerned] responded in writing to that conclusion.

2 Principles and facts

2.1

The following can be assumed in cassation.

(i) [person concerned] is a plastic surgeon.

(ii) A patient who was operated on by [person concerned] in 2014 filed a complaint against her for lack of organization and aftercare after the operation. This complaint has led to disciplinary proceedings as referred to in the Individual Health Care Professions Act. In 2016, the Central Disciplinary Court for Healthcare imposed a conditional suspension of her registration on [person concerned] for a period of four months with a probationary period of two years.

(iii) Google is the operator of the search engine Google Search. Users can enter one or more search terms and the search engine will display a page of search results. The search results page shows hyperlinks that refer, among other things, to web pages (source pages) with a so-called snippet, a short summary of the page under the title. The hyperlink and the snippet are collectively referred to as a link.

(iv) If the name of [data subject] is entered in the Google search engine, a number of search results are displayed. At the time the petition in first instance was filed, those search results contained a link to www.zwartelijstartsen.nl, stating the name of [person involved], her BIG number, her specialism, a photo of her, the full text of the said decision of the Central Disciplinary Court and a summary thereof, as well as a link to an article on https://drimble.nl. The source page of this link contained the title and the first five lines of an article about the conditional suspension of [person involved], which was published in 2016 on the website of a regional newspaper.

(v) The websites Zwartelijstartsen.nl and sin-nl.org have been drawn up and are used by SIN-NL. The website Zwartelijstartsen.nl lists, among other things, the names of healthcare providers for whom an imposed disciplinary measure has been listed in the BIG register.

(vi) In 2017, [the person concerned] submitted a written request to Google for the removal of four links (hereinafter: the links). Google rejected this request.

2.2

In these proceedings, [the person concerned] has requested that Google be instructed to remove the links and to keep them removed from the search results, in such a way that they are no longer shown to users who enter this search query from the Netherlands, and also to remove them from Google.com, Google.nl and all local EU versions of Google Search. The court granted the request.1

2.3

In its final decision the Court of Appeal rejected the request.2 Insofar as it is relevant in cassation, the Court of Appeal has ruled as follows.

[the person concerned] has primarily argued that her request must be assessed on the basis of art. 10 of the General Data Protection Regulation (hereinafter: AVG).3 In the alternative, [the person concerned] invoked art. 17 GDPR. The court will first assess the subsidiary basis. (para. 2.10 and 2.12)

In the context of [the person concerned]'s alternative appeal to art. 17 in connection with art. 21 para. 1 GDPR, it must be assessed whether its right to privacy and protection of its personal data should outweigh the right to freedom of expression and freedom of information of Google and of third parties, namely information providers and the general public. (para. 2.12)

Considering these interests, the Court of Appeal concludes that the right to freedom of expression and freedom of information of Google and of third parties outweighs the right to privacy and protection of personal data of [the person concerned]. (para. 2.13-2.17)

It is in itself incorrect that, as [the person concerned] has primarily argued, her request should be assessed on the basis of art. 10 GDPR because in this case there is no processing of personal data relating to criminal convictions and offences. In so far as that would be the case, the court considers that it should then be tested against art. 17 paragraph 3 of the GDPR in the manner considered in the CJEU GC ea/CNIL judgment, paragraphs 66-69, and that the balancing of interests to be made in that context, whereby the sensitive nature of criminal personal data and the importance of keeping them secret are recognized, would not have led to a different outcome than stated above. (para. 2.18)

[the person concerned], as the party to be found in the wrong, will be ordered to pay the costs of the proceedings in both instances. (para. 2.20)

3 Assessment of the product

3.1.1

Part 2 of the plea complains, among other things, that the Court of Appeal misunderstood that Art. 10 GDPR also applies to the processing of disciplinary personal data and that the Court of Appeal in the context of Art. 10 GDPR has wrongly failed to check whether the inclusion of the links about [data subject] is strictly necessary to protect the right to freedom of information.

3.1.2

It remains to be seen whether art. 10 GDPR, as interpreted by the Court of Justice of the European Union (hereinafter: CJEU)4, applies to the processing of disciplinary personal data because, if that were the case, the Court of Appeal in para. 2.18 has faced the then-current standard. According to that standard, in the case of sensitive data as referred to in Art. 9 para. 1 and 10 GDPR, on the basis of all relevant elements of the case and taking into account the seriousness of the infringement of the rights referred to in Art. 7 and 8 of the Charter of Fundamental Rights of the European Union (hereinafter: Charter)5 enshrined fundamental rights of the data subject to respect for private life and to the protection of personal data, for reasons of important public interest as referred to in Art. 9(2)(g) GDPR, and subject to the conditions referred to in this provision, it will be examined whether the inclusion of the links in the list of results proves to be strictly necessary to protect the right to freedom of information.6 In the recitals of the The Court of Appeal has decided that in its opinion this was the case now that it is stated in para. 2.18, with reference to the criterion just cited, has considered that its application would not have led to a different outcome. So the complaints fail.

3.2.1

Part 2.12 complains that [the person concerned] was wrongly ordered to pay the costs of the proceedings in both factual instances. According to the section, a natural person in proceedings in which he exercises his rights under the GDPR may not be ordered to pay the costs of the proceedings of the processor of his personal data addressed by him if he is unsuccessful. The part invokes art. 47 Charter and art. 79 GDPR, from which it follows that anyone who believes that rights have been violated has the right to an effective remedy. The part also relies on the judgment of the CJEU of 27 September 2017 in case C-73/167, in which it was held that the Member States are free to determine an appropriate fee for lodging an appeal before an administrative authority, but that that compensation may not be at a level that would prevent the exercise of the rights referred to in art. 47 Charter guaranteed right to an effective remedy. The part further complains that, if the court did not misunderstand the foregoing, it did not properly substantiate its judgment on the costs of the proceedings.

3.2.2

art. 79(1) GDPR provides that any data subject has the right to an effective remedy if they consider that their rights under the GDPR have been infringed as a result of processing of their personal data that does not comply with the GDPR. The sharing of the costs of legal proceedings before national courts falls within the procedural autonomy of the Member States, provided that the principles of equivalence and effectiveness are respected. The question whether a national procedural provision makes it impossible or excessively difficult to apply EU law must be examined in the light of the place of that provision in the whole procedure before the various national authorities and of the course and particularities of those provisions. procedure.8

3.2.3

Pursuant to art. 289 Rv, in an application procedure it is left to the discretion of the judge whether he finds reason in the given case to order the costs of the proceedings. In principle, he is not required to substantiate his opinion on this, but the circumstances of the case and the arguments of the parties may make this different.9 If the court orders an order for costs of the proceedings, it will, barring exceptional cases, be limited to a relatively limited lump sum. . Application of art. 289 DCC therefore does not stand in the way of an effective remedy for the person concerned.

3.2.4

Since [the person concerned] has not argued anything on this point in the first instance and on appeal, the Court of Appeal was not required to comment on this. The complaint fails.

3.3

The other complaints of the agent cannot lead to cassation either. The Supreme Court is not required to substantiate why it has reached this decision. When assessing these complaints, it is not necessary to answer questions that are important for the unity or development of the law (see art. 81 paragraph 1 RO).

4 Decision

The Supreme Court: - rejects the appeal; - orders [the person concerned] to pay the costs of the proceedings in cassation, until this judgment is submitted to the

side of Google estimated at € 899.07 in disbursements and € 1,800 for salary.

This decision was given by the president G. de Groot as chairman, the vice president M.J. Kroeze and Councilors A.E.B. ter Heide, S.J. Schaafsma and F.R. Salomons, and pronounced in public by Counsel H.M. Wattendorff on February 25, 2022.

1 Amsterdam District Court 19 July 2018, ECLI:NL:RBAMS:2018:8606.

2 Amsterdam Court of Appeal 23 June 2020, ECLI:NL:GHAMS:2020:1802.

3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC , OJ 2016, L 119/1.

4 Cf. CJEU 22 June 2021, C-439/19, ECLI:EU:C:2021:504 (Saeima).

5 PbEU 2000, C 364/1.

6 CJEU 24 September 2019, C-136/17, ECLI:EU:C:2019:773 (GC/CNIL), paragraph 68.

7 CJEU 27 September 2017, C-73/16, ECLI:EU:C:2017:725 (Puškár), paragraph 75.

8 Cf. CJEU 6 December 2001, case C-472/99, ECLI:EU:C:2001:663, paragraphs 27-29; CJEU 16 July 2020, Joined Cases C224/19 and C259/19, ECLI:EU:C:2020:578, paragraphs 85 and 95.

9 HR 6 October 2006, ECLI:NL:HR:2006:AV9444, para. 3.4.2.