KamR Göteborg - 2232-21

KamR Göteborg - 2232-21
Court:	KamR Göteborg (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 17 GDPR
Decided:	30.11.2021
Published:	30.11.2021
Parties:	Swedish Authority for Privacy Protection (IMY) Google LLC
National Case Number/Name:	2232-21
European Case Law Identifier:
Appeal from:	FiS (Sweden)
Appeal to:	Unknown
Original Language(s):	Swedish
Original Source:	Pressrelease of the The Gothenburg Court of Appeal (in Swedish)
Initial Contributor:	Kave Noori

The Court of Appeal in Gothenburg ruled that Google must pay a fine of € 4.8 million (SEK 50 million) on the ground that Google's practice of informing webmasters when search results are being erased is contrary to the GDPR. It was also found that Google had ignored the Article 29 Working Group guidelines on the right to erasure over a long period of time.

English Summary

Facts

In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google € 7.2 million (SEK 75 million) for violating Article 17 GDPR (the right to erasure). In particular, IMY considered that Google had violated the right to erasure in connection with two complaints from data subjects (Complaint No. 2 and Complaint No. 8 in the supervisory case), as well as because of its general practice of regularly informing webmasters when search results are being removed.

Google appealed that decision before the Stockholm Administrative Court (FiS). In December 2020, FiS upheld that Google had breached the right to erasure with respect to Complaint No. 2, but found no such breach with respect to Complaint No. 8. In both cases, however, the FiS concluded that Google had acted contrary to data protection law because of its practice of notifying webmasters of deleted search results. The FiS further justified a reduction of the overall fine calculated by IMY for the breaches that were upheld.

Google appealed the FiS decision before the Court of Appeal in Gothenburg. In the context of these appeal proceedings, IMY argued that Google had breached the right to erasure with respect to both Complaint No. 2 and Complaint No. 8, and had also acted contrary to data protection law because of its practice of notifying webmasters of removed search results. IMY wanted the overall fine to be set at €6.3 million (SEK 66 million). In particular, the proposed fine of €6.3 million included:

• a fine of €96 639 (SEK 1 million) for not respecting the right to erasure with respect to Complaint No. 2;
• a fine of €1.448.547 (SEK 15 million) for not respecting the right to erasure with respect to Complaint No. 8; and
• a fine of € 4.8 million (SEK 50 million) for the practice of regularly informing webmasters of deleted search results.

Holding

The right to erasure

The Gothenburg Court of Appeals partly reversed the findings of the the FiS and found that Google had complied with Article 17 GDPR on the right to erasure with respect to both Complaint No. 2 and Complaint No. 8. In particular:

With respect to Complaint No. 2, the Gothenburg Court of Appeals found that the data subject had first only provided the main web address (URL) of the discussion thread where his/her name was mentioned, but had failed to provide the specific URLs where his/her name was mentioned each time. The Gothenburg Court of Appeal noted in this respect that Google's instructions on erasure requests clearly require the data subject to provide each and every URL that is part of the erasure request, as even small changes to the URL can lead to a different website. The Gothenburg Court of Appeal further noted that Google has set up a help page explaining the importance of providing each URLs in details. Finally, the Court of Appeals noted that, once the data subject had completed his/her erasure request by providing the specific URLs where his/her name was mentioned, Google had proceeded to the erasure of these pages without undue delay. Based on these considerations, the Court of Appeals concluded that Google had complied with Article 17 GDPR.

With respect to Complaint No. 8, the Court of Appeals agreed with FiS that Google had complied with Article 17 GDPR by removing the concerned search result three days before IMY had ordered Google to do so. Hence, the Court of Appeals concluded that Google had deleted the requested search results without undue delay, in accordance with Article 17 GDPR.

Google's practice of informing webmasters

The Gothenburg Court of Appeal upheld the FiS decision that Google's practice to regularly inform webmasters of the removal of search results was contrary to Article 5(1)(a) GDPR (principle of lawfulness), Article 5(1)(b) GDPR (principle of purpose limitation) and Article 6 GDPR (absence of valid legal basis for the processing). The Gothenburg Court of Appeals found in this respect that Google had systematically ignored the Article 29 Working Party's guidelines over an extended period of time. Although the guidelines are not strictly binding, the Gothenburg Court of Appeal pointed out that the Article 29 Working Party's mandate is to ensure that the European Union's data protection rules are applied consistently in all Member States. Therefore, the Gothenburg Court of Appeal upheld the fine of € 4.8 million (SEK 50 million) imposed by FiS.

Comment

The entire decision is unfortunately not published on the the website of the The Gothenburg Court of Appeal. To get a summary of the decision, one has read the press release: https://www.domstol.se/nyheter/2021/11/googles-rutin-strider-mot-gdpr/ and then use a webform (Swedish) to request a copy of the judgement.

Another way might be to email the court: forvaltningsrattenigoteborg@dom.se and supply this case number: 2232-21.

(Comment by initial contributor)

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

& # 13;
& # 13;
Google has a routine of informing webmasters when a search result has been removed from the list of search results in accordance with the "right to be forgotten". The Court of Appeal considers that this is not permitted under the Data Protection Regulation (GDPR). & # 13;
                The right to be forgotten means that an individual has the right to have one or more links to web pages with personal data deleted from the list of search results displayed during a search on the person's name.
The Court of Appeal considers that Google's routine of regularly informing webmasters that search results have been deleted constitutes a processing of personal data that is not in accordance with the Data Protection Regulation.
- The Court of Appeal has made the same assessment as the Administrative Court, that Google's routines regarding requests to remove search results are contrary to the Data Protection Ordinance, says the Court of Appeal's lawyer Petter Classon.
However, the Court of Appeal finds that Google has removed individual search results without undue delay. The Court of Appeal therefore reduces the sanction fee by an additional SEK 2 million, in relation to the Administrative Court's ruling, to a total of SEK 50 million. & # 13;
                & # 13;