Korkein hallinto-oikeus (Finland) - KHO:2024:34

Korkein hallinto-oikeus - KHO:2024:34
Court:	Korkein hallinto-oikeus (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 17(1) GDPR Article 21(1) GDPR
Decided:	19.03.2024
Published:	19.03.2024
Parties:	Google LLC
National Case Number/Name:	KHO:2024:34
European Case Law Identifier:	ECLI:FI:KHO:2024:34
Appeal from:	Helsingin hallinto-oikeus (Finland) H6072/2021
Appeal to:
Original Language(s):	Finnish
Original Source:	Finlex (in Finnish)
Initial Contributor:	fred

The Supreme Administrative Court enforced the DPA's decision and ordered Google to remove outdated search result links from Google Search. The Court found that the public interest did not override the data subject's right to privacy.

English Summary

Facts

Pursuant to Article 17(1) GDPR, the data subject had requested Google LLC (the controller) to remove several search result links from Google Search that led to articles published by various news media in 2010, the subject of which was an arrest warrant against the data subject. After the controller refused to remove the links, the Finnish DPA had ordered the controller to comply with the data subject's request. The Administrative Court of Helsinki had overturned the DPA's decision following an appeal by the controller.

The DPA then appealed the Administrative Court's decision to the Supreme Administrative Court of Finland (the Court) requesting that the Administrative Court's decision be overturned and that the DPA's original decision be enforced.

The DPA stated that the search result links concerned news articles about an arrest warrant, the social significance of which was mainly fleeting compared to crime news. Accordingly, the DPA considered that the links concerned outdated information that had since lost its relevance.

The DPA also emphasised that the vast majority of the news articles also contained a photograph of the data subject and that the date indicated in the articles did not guarantee that the reader understood the information as describing past events.

Holding

The Court found that the news articles to which the search result links led were still available on the news websites that had published them. Consequently, the removal of such links could have a relatively limited impact on the public's access to information.

The Court noted that the information on the arrest warrant, which was almost ten years old and no longer valid, had expired. Therefore, the information no longer had much social relevance, even though it was indirectly related to the punishment and the crime of which the data subject had been convicted.

The Court stated that the information contained in the news articles about the nature of the offence and the length of the sentence could not be considered particularly sensitive. On the other hand, the Court considered that the publication of clear facial images contained in the articles significantly infringed the data subject's right to privacy.

The Court also noted that the data subject had not actively sought publicity themselves and that the crime in question was not related to their business activities. As a result of their crime and the arrest warrant, the data subject no longer had a particularly significant role in the public eye at the time of the DPA's decision.

On the basis of the information gathered, the Court held that the controller had not sufficiently demonstrated that the public interest in access to information concerning the data subject overrode the data subject's right to privacy and data protection.

As a result, the Court overturned the Administrative Court's decision and enforced the DPA's original decision, meaning that the controller had to remove the search result links in question.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

KHO:2024:34

Data protection - Processing of personal data - Search engine - Search by person's name - Wanted notice - Right to delete data - Right to be forgotten - Right to object - Deleting search results - Protection of private life - Protection of personal data - The public's interest in accessing information - Weighing of interests

Yearbook number: KHO:2024:34

Issue date: 19 March 2024

Volume number: 707

Diary number(s): 33/2022

ECLI identifier: ECLI:FI:KHO:2024:34

A had asked Google to remove several search result links found in his name, which led to articles published by various news media in 2010, the subject of which was a wanted notice concerning A. After Google refused to remove it, the deputy data protection commissioner had given Google an order to comply with the applicant's request. The administrative court had overturned the decision of the deputy data protection commissioner on Google's appeal.

In the case, the data protection commissioner's complaint had to decide whether the deputy data protection commissioner could have given Google the above-mentioned order to comply with the applicant's request. As a result, it was first necessary to assess whether Google, as the data controller, had demonstrated that it still had the right to process the data in question.

The Supreme Administrative Court stated that, with regard to search engines, the right to process data existed if the right of internet users to receive the data in question superseded the right of the person who requested the deletion of the data to the protection of their private and personal data. In order to evaluate this, a weighing between these interests had to be carried out, where the case law of the European Court of Justice and the European Court of Human Rights had to be taken into account when applying the General Data Protection Regulation.

Based on the weighing of the reasons for its decision, the Supreme Administrative Court assessed that Google had not presented sufficient grounds to be able to demonstrate that in this case the public's interest in obtaining the information in question when searching under the applicant's name would supersede the applicant's basic right to privacy and protection of his personal data. The decision of the administrative court was annulled and the decision of the deputy data protection commissioner was enforced in the parts under appeal.

Charter of Fundamental Rights of the European Union Article 7, Article 8 paragraph 1 and Article 11

European Convention on Human Rights Article 8 paragraph 1 and Article 10 paragraph 1

Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons in the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation) Article 1, paragraph 2, Article 5, Article 6, paragraph 1, subparagraph f, Article 17(1)(a), (c) and (d), Article 17(3)(a), Article 21(1)

Judgments of the Grand Chamber of the Court of Justice in Google Spain and Google (C-131/12, ECLI:EU:C:2014:317), GC and others (C136/17, ECLI:EU:C:2019:773), TU and RE (C-460/20, ECLI:EU:C:2022:962) and Bundesrepublik Deutschland (C-60/22, ECLI:EU:C:2023:373)

Judgment of the European Court of Human Rights Eerikäinen et al. v. Finland (10.2.2009, ECLI:CE:ECHR:2009:0210JUD000351402), judgment Egeland and Hanseid v. Norway (16.4.2009, ECLI:CE:ECHR:2009:0416JUD003443804), Grand Chamber von Hannover v. Germany (no. 2) (7/2/2012, ECLI:CE:ECHR:2012:0207JUD004066008), Grand Chamber Axel Springer AG v. Germany (7/2/2012, ECLI:CE:ECHR:2012:0207JUD003995408 ), judgment of the Grand Chamber Bédat v. Switzerland (29.3.2016, ECLI:CE:ECHR:2016:0329JUD005692508), judgment of the Grand Chamber Satakunta Markkinapörssi Oy and Satamedia Oy v. Finland (27.6.2017, ECLI:CE:ECHR:2017: 0627JUD000093113), judgment Axel Springer SE and RTL Television GmbH v. Germany (September 21, 2017, ECLI:CE:ECHR:2017:0921JUD005140512), judgment M.L. and W.W. v. Germany (28.6.2018, ECLI:CE:ECHR:2018:0628JUD006079810) and the Grand Chamber judgment Hurbain v. Belgium (4.7.2023, ECLI:CE:ECHR:2023:0704JUD005729216)

See also KHO 2018:112
The decision to which the appeal applies

Helsinki Administrative Court 2 December 2021 No. H6072/2021
Decision of the Supreme Administrative Court

The Supreme Administrative Court grants permission to appeal and investigates the matter.

The data protection commissioner's complaint is accepted. The decision of the Helsinki Administrative Court is annulled and the decision of the Deputy Data Protection Commissioner is enforced in the parts under appeal.
Case description

(1) The matter concerns the right to be forgotten stipulated in the General Data Protection Regulation. What needs to be resolved is the search engine company's obligation to remove search result links leading to news media articles.

(2) The appeal in the Supreme Administrative Court concerns a total of nine search result links that have been found based on a search in the name of the applicant for the removal order on the Google Search search engine. The links lead to articles published by various news media in 2010, the topic of which is that the applicant is wanted and that he is being sought.
Background of the matter

(3) A (hereinafter the applicant) has asked Google LLC (hereinafter Google) to remove several search result links from the Google Search search engine.

(4) The Deputy Data Protection Commissioner has, after Google's refusal to delete, ordered the company to comply with the applicant's request to delete the search result links.

(5) In his decision, the Deputy Data Protection Commissioner has considered that the availability of outdated wanted notice information published about the applicant can no longer be considered justified.

(6) The Administrative Court of Helsinki has annulled the decision of the Deputy Data Protection Commissioner in its appealable decision on Google's appeal.

(7) In its conclusion, the Administrative Court has held that the applicant's right to the protection of privacy and personal data in this case does not supersede the general public's interest in obtaining information. Based on the reasons presented, the Deputy Data Protection Commissioner could not order Google to comply with the applicant's request to remove search result links.

The matter has been resolved by members of the administrative court, Liisa Selvenius-Hurme, Nina Tuominen and Lotta Haverinen, who has also presented the matter.
Requirements in the Supreme Administrative Court

(8) The data protection commissioner has requested permission to appeal the administrative court's decision and has demanded in his appeal that the administrative court's decision be annulled to the extent that the administrative court has annulled the deputy data protection commissioner's decision with regard to more precisely identified search result links and that the deputy data protection commissioner's decision be brought into force in the parts mentioned.
Reasons for the decision of the Supreme Administrative Court
1 Question formulation

(9) In the matter, it must be decided from the data protection commissioner's complaint whether the deputy data protection commissioner could have given Google an order to comply with the applicant's request to remove search result links. In order to evaluate this, it must first be decided whether Google, as the data controller, has demonstrated that it still has the right to process the data in question.

(10) The applicant's right to be forgotten or, from another point of view, Google's obligation to remove links must be interpreted on the basis of European Union law, the European Convention on Human Rights and the jurisprudence of the Court of Justice and the European Court of Human Rights. The legal grounds include, first of all, how the obligation to prove the legality of the processing is determined, as well as what criteria should be used when weighing different rights and interests against each other and what the weights of these criteria are.

(11) Based on these grounds and weighing the criteria, it must then be decided whether Google, as the data controller in this case, has demonstrated that it still has the right to process the data in question.
2 Key applicable legal guidelines
2.1 Charter of Fundamental Rights of the European Union and the European Convention on Human Rights

(12) According to Article 7 of the Charter of Fundamental Rights of the European Union, everyone has the right to have their private and family life, home and communications respected.

(13) According to Article 8, Paragraph 1 of the Charter of Fundamental Rights, everyone has the right to the protection of their personal data.

(14) According to Article 11, paragraph 1 of the Charter of Fundamental Rights, everyone has the right to freedom of expression. This right includes freedom of opinion and the freedom to receive and disseminate information or ideas without interference by the authorities and regardless of territorial boundaries. According to paragraph 2 of the article, the freedom and pluralism of the media is respected.

(15) According to Article 8(1) of the European Convention on Human Rights, everyone has the right to respect for their private and family life, home and correspondence.

(16) According to Article 10, Paragraph 1 of the Human Rights Convention, everyone has freedom of expression. This right includes the freedom to hold opinions and to receive and disseminate information and ideas regardless of territorial boundaries and without interference by the authorities.
2.2 General Data Protection Regulation

(17) According to Article 1(2) of Regulation (EU) 2016/679 (General Data Protection Regulation) of the European Parliament and the Council on the protection of natural persons in the processing of personal data and on the free movement of this data and the repeal of Directive 95/46/EC, the aforementioned regulation protects the fundamental rights of natural persons and freedoms and especially their right to the protection of personal data.

(18) Article 5, paragraph 1 of the General Data Protection Regulation provides for principles regarding the processing of personal data. According to paragraph 2 of the article, the controller is responsible for it and must be able to demonstrate that paragraph 1 has been complied with ("obligation to demonstrate").

(19) According to Article 6, Paragraph 1 of the Regulation, the processing is lawful only if and only to the extent that at least one of the conditions stipulated in the subparagraphs of the paragraph is met: (---)

f) the processing is lawful if the processing is necessary to fulfill the legitimate interests of the controller or a third party, except when the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data override such interests, especially if the data subject is a child.

(20) Article 17 of the Regulation provides for the right to delete data ("the right to be forgotten"). According to paragraph 1 of the article, the data subject has the right to have the data controller delete the personal data concerning the data subject without undue delay, and the data controller has the obligation to delete the personal data without undue delay, provided that, among others, one of the following criteria is met: a) the personal data is no longer needed for the purposes for which it was collected or for which they were otherwise processed; c) the data subject objects to the processing pursuant to Article 21 paragraph 1 and there is no justified reason for the processing (---); d) personal data has been processed unlawfully.

(21) According to paragraph 3, subparagraph a of the mentioned article, paragraph 1 does not apply if the processing is necessary to exercise the right to freedom of expression and freedom of communication.

(22) According to Article 21, Paragraph 1 of the General Data Protection Regulation, the data subject has the right, on grounds related to his personal special situation, at any time to object to the processing of personal data concerning him, which is based on Article 6, Paragraph 1, subparagraph f, such as profiling based on these provisions. The controller may no longer process personal data, unless the controller can demonstrate that there is a significantly important and justified reason for the processing that overrides the interests, rights and freedoms of the data subject, or if it is necessary to prepare, present or defend a legal claim.

(23) According to paragraph 4 of the preamble of the General Data Protection Regulation, the processing of personal data should be planned so that it serves people. The right to protection of personal data is not absolute; it must be viewed in relation to its function in society and, in accordance with the principle of proportionality, it must be proportionate to other fundamental rights. The regulation respects all fundamental rights and takes into account the freedoms and principles recognized in the Charter of Fundamental Rights as they are confirmed in the fundamental treaties, in particular the right of everyone to have his private and family life (---) respected, the right to the protection of personal data (---), freedom of speech and freedom of communication (---).

(24) According to point 65 of the preamble, a natural person should have the right to have incorrect personal data concerning him corrected and the right to "be forgotten" if the retention of the data violates the said regulation or the Union law applicable to the data controller or the legislation of a member state. In particular, the data subject should have the right to have his personal data deleted and not processed after the personal data are no longer needed for the purposes for which they were collected or otherwise processed (---) or when he has objected to the processing of his personal data or when the processing of his personal data is otherwise not in accordance with the provisions of the aforementioned regulation. (---) However, the further storage of personal data should be in accordance with the law if it is necessary to exercise the right to freedom of speech and freedom of communication (---).

(25) According to point 69 of the preamble, in cases where personal data could be processed in accordance with the law, because the processing is necessary (---) due to the legitimate interests of the controller or a third party, the data subject should nevertheless have the right to object to the processing of personal data concerning his situation. The data controller should demonstrate that the data controller's significantly important legitimate interests can override the data subject's interests or fundamental rights and freedoms.

(26) According to point 74 of the preamble, the controller's responsibility for the processing of personal data carried out by him or on behalf of the controller should be confirmed. In particular, the controller should have the obligation to implement appropriate and effective measures, and it should be able to demonstrate that the processing operations are in accordance with the mentioned regulation, including the effectiveness of the measures. When implementing these measures, the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons should be taken into account.
3 case law of the Court of Justice
3.1 Case C-131/12, Google Spain and Google

(27) In its judgment on Directive 95/46, the predecessor of the General Data Protection Regulation, issued on 13 May 2014, the Court of Justice of the European Union (Grand Chamber) in case C131/12, Google Spain and Google, has for the first time taken a position on the obligation of the operator of a search engine to remove search results visible based on a search performed by a person's name.

(28) The Court of Justice of the European Union has emphasized that the processing of personal data carried out by the operator of the search engine differs from the processing of data carried out by the suppliers of websites and goes further than that, and therefore affects more the basic rights of the data subject. In connection with this difference, according to the court, it should be noted that the processing carried out by the editor of the website, which includes the publication of information about a natural person, can possibly only take place for journalistic purposes, while this is not the case when it comes to the processing carried out by the operator of the search engine. It may therefore be possible that the data subject may, under certain circumstances, invoke the rights provided by the directive against the operator of the search engine, but not against the provider of the website. The court has also stated that the result of the weighing of interests carried out in the case may be different depending on whether it is the processing carried out by the operator of the search engine or the processing carried out by the editor of the website, and that the processing carried out by the operator of the search engine may mean a greater interference with the fundamental right to respect the private life of the registered person than the fact that the editor publishes the relevant website (paragraphs 35, 83, 85–87 of the judgment).

(29) The Court of Justice of the European Union has stated that due to the potential seriousness of the interference with the rights of the registered person, the processing cannot be justified solely by the financial interest of the search engine operator. To the extent that the removal of links from the list of search results could have consequences for the legitimate interest of internet users who may be interested in receiving that information, however, efforts must be made to find a fair balance between, among other things, the interest in question and the fundamental rights of the registered person under Articles 7 and 8 of the Charter of Fundamental Rights. Even though the rights of the data subject protected by the articles in question also supersede the aforementioned interest of internet users, that balance may nevertheless depend in special cases on the nature of the data in question and their sensitivity in terms of the data subject's private life, as well as the public's interest in having access to the data in question. The latter interest may be different if it appears that interference with the data subject's fundamental rights for special reasons such as the data subject's position in the public eye can be justified by the primary interest that the general public has in obtaining that information (paragraphs 81 and 97 of the judgment).

(30) The European Court of Justice has also pointed out that all processing of personal data must be legitimate throughout the time it is carried out. Even the initially legal processing of accurate data may become incompatible with the Directive over time if the data in question is no longer necessary for the purpose for which it was collected and processed. This is especially the case when they are not appropriate, when they are not or are no longer relevant or when they are too broad for these purposes or have been kept for too long. Regarding the removal of information from the list of search results, the court has also emphasized that establishing the right of the data subject does not require that the inclusion of the data in question in the list of search results causes damage to the data subject (paragraphs 93–96 of the judgment).
3.2 Case C-136/17, GC et al.

(31) The judgment of the European Court of Justice (Grand Chamber) on 24 September 2019 in case C136/17, GC et al. is a continuation of the aforementioned judgment. The issue has been the removal of sensitive information, including information related to criminal convictions and violations, from the list of search results. The questions have been examined both in terms of the repealed Directive 95/46 and the General Data Protection Regulation.

(32) The Court of Justice of the European Union has stated that the special requirements related to the processing of the data in question also apply to data processing performed during the operation of the search engine. The processing of the information in question can be legal, for example, when the authorities have disclosed the information in question to the public in compliance with applicable national law (paragraphs 48 and 73 of the judgment).

(33) The court has stated that in Article 17, paragraph 3, letter a of the General Data Protection Regulation, it is expressly stipulated that the data subject does not have the right to erasure when the processing is necessary, for example, to exercise the right to freedom of communication guaranteed in Article 11 of the Charter of Fundamental Rights. This expresses the fact that the right to the protection of personal data is not an absolute right, but must – as emphasized in the fourth recital of the preamble of the relevant regulation – be considered in relation to its function in society, and in accordance with the principle of proportionality, it must be proportionate to other fundamental rights. In the aforementioned regulation, and especially in Article 17, paragraph 3, letter a, the requirement for weighing the fundamental rights to respect for private life and the protection of personal data established in Articles 7 and 8 of the Charter of Fundamental Rights and the fundamental right to freedom of communication guaranteed in Article 11 of the Charter of Fundamental Rights, on the other hand, is expressly confirmed. The conditions under which the operator of the search engine is obliged to accept the request to remove the search results from the list and therefore to remove from the list of search results visible as a result of a search performed under the registered name the link to an internet page with sensitive personal data must be examined precisely on the basis of these facts (paragraphs 57 and 59–60 of the judgment).

(34) According to the court, in a situation where the processing concerns the data in question, interfering with the basic rights of the data subject regarding respect for private life and protection of personal data can be particularly serious due to the sensitive nature of this data. The operator of the search engine must check whether the inclusion of the link in question in the list of search results displayed as a result of a search performed under this person's name proves to be absolutely necessary, based on all the facts relevant to the case under consideration and taking into account how serious the interference with the data subject's basic rights to respect for private life and protection of personal data established in Articles 7 and 8 of the Charter of Fundamental Rights is in order to protect the freedom of communication of Internet users who are potentially interested in accessing the website in question through such a search, as confirmed in Article 11 of the Charter of Fundamental Rights (paragraphs 67-68 of the judgment).

(35) After explaining the jurisprudence of the European Court of Human Rights, the Court of Justice of the European Union has stated that the operator of the search engine must, with regard to links leading to websites where information about the court proceedings initiated in a criminal case related to the registered person has been published, which are related to an earlier stage of the said proceedings and no longer correspond to the current situation, assess whether by the data subject on the basis of all the circumstances related to the case being processed, which include, among other things, the nature and seriousness of the crime in question, the course and outcome of the said procedure, the elapsed time, the data subject's position in the public eye and his behavior in the past, the interest of the public at the time of the request, the content and form of the publication, and the publication consequences for the data subject, the right that the information in question is no longer attached to his name at the time of the assessment in question in the list of search results that is visible due to a search performed in his name (paragraphs 75-77 of the judgment).
3.3 Case C-460/20, TU and RE

(36) In its judgment of 8 December 2022 in case C460/20, TU and RE, the Court of Justice of the European Union (Grand Chamber) has taken a position on the deletion of search results, among other things, with regard to allegedly incorrect information.

(37) With regard to the requirement for the weighing of fundamental rights established in Article 17(3)(a) of the General Data Protection Regulation, the European Court of Justice has stated that Article 7 of the Charter of Fundamental Rights must be given the same meaning and scope as Article 8(1) of the European Convention on Human Rights, as interpreted by the European Court of Human Rights, and that the same applies to Article 11 of the Charter of Fundamental Rights and Article 10 of the European Convention on Human Rights. The Court of Justice of the European Union has also stated that it is clear from the jurisprudence of the European Court of Human Rights that with regard to the publication of information, in order to reconcile the rights to privacy protection, freedom of speech and freedom of communication, a number of relevant criteria must be taken into account, such as the promotion of a discussion in the public interest, the reputation of the person concerned, the subject of the news, the previous behavior of the person concerned , the content, form and consequences of publication of the material to be published, the method and circumstances of obtaining the information and the veracity of the information. According to the Court of Justice of the European Union, under which conditions the operator of the search engine is obliged to accept the request to remove the search results from the list and therefore to remove from the list of search results visible as a result of a search performed under the registered name a link to an internet page with personal data, on the basis that the content entered in the list of search results contains statements that the said person considers incorrect, must be examined precisely on the basis of these facts (paragraphs 58–61 of the judgment).

(38) In connection with this and referring to the above-mentioned judgments of the European Court of Justice C131/12 and C-136/17, the court has stated that the rights of the data subject protected by Articles 7 and 8 of the Charter of Fundamental Rights generally supersede the justified right of internet users who may be interested in gaining access to the information in question interest, but this balance may however depend on the relevant circumstances of each case, in particular the nature of the information in question and its sensitivity in terms of the data subject's private life, as well as the interest of the public in having access to the information in question, and the latter interest may be different based on, among other things, the position of the person in question in the public domain. The Court has also added, referring to the practice of the European Court of Human Rights, that especially when the data subject has a prominent position in public life, greater tolerance can be expected from him, because he is inevitably and consciously the object of public surveillance. According to the court, the accuracy of the content in the list of search results is also a key factor when evaluating the conditions of application according to Article 17(3)(a) of the General Data Protection Regulation in order to determine whether the right of access to information of internet users and the freedom of expression of the content provider can be prioritized over the rights of the requester to remove the search results from the list (paragraphs 62-64 of the judgment ).
4 case law of the European Court of Human Rights

(39) In several cases concerning Articles 8 and 10 of the European Convention on Human Rights, the European Court of Human Rights has taken a position on the reconciliation of freedom of speech and privacy protection of the press and has developed related weighing criteria in cases where the original publications of different news media have been in question. These criteria are the promotion of discussion in accordance with the general interest of the subject, the degree of recognition of the person concerned, the subject of the publication, the previous behavior of the person concerned in relation to the media, the content and form of the publication, as well as the consequences of publication for the person concerned and the circumstances in which the possible picture was taken, as well as the method of obtaining the information and the veracity of the information. The Court has stated that these criteria may be more or less relevant, taking into account the particularities of the case in question (e.g. Grand Chamber judgment von Hannover v. Germany (no. 2), 7 February 2012, paragraphs 108-113, Grand Chamber judgment Axel Springer AG v. Germany, February 7, 2012, paragraphs 89–95, judgment of the Grand Chamber Satakunta Markkinapörssi Oy and Satamedia Oy v. Finland, June 27, 2017, paragraphs 165–166 and judgment Axel Springer SE and RTL Television GmbH v. Germany, September 21. 2017, paragraph 42).

(40) The Human Rights Court has considered that crimes and criminal trials are topics of general interest and that promote public debate. Regarding the effect of a person's reputation on the protection of a person's privacy, the court has stated that while a private person unknown to the public can claim special protection for his private life, the same does not apply to a person appearing in public. Article 8 of the Human Rights Convention also protects a person's reputation, but the loss of reputation cannot be invoked if this is a foreseeable consequence of the person's own actions, such as committing a crime. A person who has committed even a serious crime or has been convicted of such a crime is not, however, comparable to a person who voluntarily exposes himself to the public, for example as a politician or public figure (e.g. judgment Eerikäinen et al. v. Finland, 10 February 2009, paragraph 66, judgment Egeland and Hanseid v. Norway, 16.4.2009, paragraphs 58 and 62, Grand Chamber judgment von Hannover v. Germany (no. 2), 7.2.2012, paragraph 110, Grand Chamber judgment Axel Springer AG v. Germany, 7.2.2012, para. 83 and 91 and the judgment of the Grand Chamber Bédat v. Switzerland, 29 March 2016, paragraph 76).

(41) The Court of Human Rights has stated in its jurisprudence that a photograph depicting a person constitutes one of the central characteristics of that personality, as it expresses the person's individual characteristics and distinguishes him from other persons. The publication of a photograph must generally be considered to mean a greater interference with the protection of privacy than the mere publication of a name (e.g. the judgment of the Grand Chamber von Hannover v. Germany (no. 2), 7 February 2012, paragraph 96 and the judgment Eerikäinen et al. v. Finland, 10 February 2009, section 70).

(42) In the judgment of the Court of Human Rights, M.L. and W.W. v. Germany (June 28, 2018) was a matter of two people's requests to anonymize older articles that are mainly available in a limited way on the websites of various news media. The articles concerned the murder of a famous actor and the related trial and subsequent stages, and mentioned the names of those who had been sentenced to life in prison for the murder and who had made the pleas in question.

(43) The court has stated that the information in question was easy to find above all with the help of search engines and paid attention to the differences between the original publisher and the search engine. It has also stated, referring to the judgment of the European Court of Justice in case C-131/12, that the weighing of the interests in question can lead to different results depending on whether it is the original publisher, whose activity is at the core of freedom of expression, or the search engine (paragraph 97 of the judgment).

(44) In reconciling freedom of speech and privacy protection, the court has applied established criteria and has stated, among other things, that the public has an interest in being informed and receiving information about criminal proceedings, especially when it is a question of a particularly serious matter that has received a lot of attention. Regarding the notoriety of the persons convicted of murder, the court in this case considered that, although it had not appeared that they had been known to the public before their crime, they had become known during the trial, which received a lot of attention due to the nature and circumstances of the crime and the celebrity of the victim. In addition, they themselves had been actively in contact with the media. The court has also drawn attention to the limited availability of articles. Article 8 of the agreement was not considered violated in the case (paragraphs 98, 100, 105–109 and 112–113 of the judgment).

(45) The Human Rights Court has clarified the right to be forgotten online in the Grand Chamber judgment Hurbain v. Belgium (July 4, 2023) in a case where the publisher of a newspaper was ordered to anonymize the name of a person from an article that was freely and freely available and searchable by name in the electronic archive on the newspaper's website. The article concerned, among other things, a doctor who had caused the death of two people while driving under the influence of alcohol.

(46) The court has emphasized that what was to be evaluated was the continuous online availability of the article in question, originally published in the printed magazine and later on the archive pages of the magazine, and not the original publication as such. The Court has considered that the assessment should take into account the different context in question and that the criteria developed by the Court for the reconciliation of Articles 8 and 10, which concerned the original publications of the media, had to be adapted accordingly (paragraphs 172-174, 202 and 205 of the judgment).

(47) These criteria are the nature of the archived information, the time that has passed since the events and the original and online publication, the current interest of the information, the recognition of the person concerned and his behavior after the events, the harmful consequences of the continued availability of the information, the degree of availability of the information and the effect of the measure on freedom of expression and especially on the freedom of the press. The court has also stated that in most cases several criteria must be taken into account at the same time and that not all criteria have the same weight (paragraphs 205–206 and 211 of the judgment).

(48) Also in this context, the Human Rights Court has paid attention to the operation of search engines and considered, among other things, that the original website and the search engine have a different effect on a person's rights and interests. The distinction between search engine operators and news publishers retains its significance when the court, when deciding on a request to be forgotten, examines interference with freedom of expression, including the public's right to receive information (paragraph 208 of the judgment).

(49) When applying the mentioned criteria to the case in question, the court has paid attention, among other things, to the fact that the crime was not of such a seriousness that the passage of time would not matter and that the events were not reported in the media other than in the article in question, and the case had not received wider publicity at the time of the events or later. The doctor in question was unknown to the public both at the time of the events and at the time when he asked for the article to be anonymized, and at no point had he himself been in contact with the media. The court has also drawn attention to the harm caused by the continued availability of the article, the wide availability of the article and the fact that the original article was still available in a non-anonymized version. The article could have been ordered to be anonymized, and Article 10 of the agreement was not considered violated in the case (paragraphs 219, 229–230, 234, 239 and 252 of the judgment).
5 Legal evaluation and final result
5.1 Assessment starting points
Allocation of the burden of proof

(50) According to Article 17(1) of the General Data Protection Regulation, the data subject has the right to have the data controller delete the personal data concerning the data subject without undue delay, and the data controller has the obligation to delete the personal data without undue delay, provided that one of the criteria mentioned in the said provision is met.

(51) In the case of search engines, the obligation to delete personal data according to Article 17, paragraph 1 of the regulation on the controller may arise especially if the processing of the data can no longer be considered necessary for various reasons (subsection a), if the processing has not been shown to be of considerable importance as referred to in Article 21, paragraph 1 of the regulation and a justified reason to process the data despite the data subject's objection (subsection c) or in general, if the processing of the data is no longer lawful pursuant to Article 6 paragraph 1 subsection f of the regulation or for another reason (subsection d).

(52) According to Article 5, Paragraph 2 of the Regulation, the controller is responsible for it, and must be able to demonstrate that Article 5, Paragraph 1 of the Regulation, which sets the requirement for the legality of personal data processing, has been complied with. The controller thus has the burden of proof of the legality of the processing of personal data (case C-60/22, Bundesrepublik Deutschland, paragraph 53 and the case law referred to therein). If the data subject objects to the processing of his/her personal data, the controller must also demonstrate that there is, despite this, a significant and justified reason for processing the data that overrides the data subject's rights.

(53) The registrant's right to have his/her personal data deleted is not absolute, but regardless of the basis, this right does not exist based on Article 17, paragraph 3, subparagraph a of the regulation, if the processing is necessary to exercise the right to freedom of communication. With regard to search engines, such processing can be considered necessary and must also be considered to be a significantly important and justified reason referred to in Article 21, paragraph 1 of the regulation, if the controller demonstrates that the right of the general public, i.e. in this case internet users, to access the data in question supersedes the person who requested the deletion of the data the right to the protection of their private and personal data.
Interest weighing

(54) In order to assess whether the said right of the public supersedes the rights of the data subject, a weighing between the interests in question must be carried out. When applying the general data protection regulation, the jurisprudence of the European Court of Justice and the jurisprudence of the European Court of Human Rights must be taken into account in the weighing. However, with regard to the criteria developed by the Human Rights Court in cases concerning press freedom, the difference between the core content of press freedom and the protection enjoyed by the publication of search links provided by a search engine company must be taken into account (see paragraphs 43 and 46 above).

(55) Due to the special features of the processing performed by search engines, the link data of the search results must in principle be deleted with a lower threshold than the article data of the original publisher of the articles. The rights of the data subject protected by Articles 7 and 8 of the Charter of Fundamental Rights generally supersede the justified interest of internet users. However, this balance may depend on the relevant circumstances of each case, including in particular the nature of the information in question and its sensitivity to the private life of the data subject, as well as the interest of the public in having access to the information in question. The latter interest may be different based on, among other things, the position of the person in question in the public eye (see point 40 above).

(56) When evaluating the matter, the effect of deleting data on the public's right to access information must be taken into account. If the deletion could have an effect on this, a weighing between the interests in question must be carried out. According to the jurisprudence of the Court of Justice of the European Union (see paragraphs 29–30 above), the weighing of interests is particularly influenced by the public's interest in obtaining the information in question and the public status of the person concerned, as well as the nature of the information. The Court of Justice of the European Union has also paid attention to the necessity of the information and especially to whether the information is no longer appropriate and essential or perhaps too extensive or stored for too long, as well as to the sensitivity of the information and its accuracy.

(57) The most important criteria in the practice of the European Court of Human Rights (see sections 39 and 47) have been the promotion of a discussion of the subject in accordance with the public interest and the degree of recognition of the person concerned and the person's own behavior in relation to the media and the public, as well as the subject of the publication, the accuracy of the information and, if necessary, the circumstances, where a possible photo was taken. In its jurisprudence, the human rights court has also paid particular attention to the nature of the information, the passage of time and the current interest in the subject and the person, as well as the person's behavior after the publication of the article, with regard to articles freely available online.

(58) Based on Article 5(1)(e) of the General Data Protection Regulation, personal data must be kept only for as long as it is necessary to fulfill the purposes of the data processing. If the weighing of interests concludes that the right of the data subject supersedes the right of the public, and there are no longer grounds for processing the data, the data must be deleted.
5.2 The facts and the arguments presented in the case, their assessment and conclusion
Content of links and obligation to remove

(59) In the articles about the wanted notice found through the links, it is mentioned that the applicant has been convicted of a serious drug crime. Most articles also mention that he has been sentenced to more than nine years in prison for that crime. All but one of the articles have clear photos of the applicant's face, some mention his age and height, and together with the color of his eyes and hair. One article shows that the police did not consider the applicant dangerous to the public. Based on one article, it can be concluded that the judgment of the Court of Appeal was given in February 2010.

(60) As stated in point 52 above, it is Google's duty to demonstrate that it has the right to process the data in question. Fulfilling this display obligation is a prerequisite for the company not having an obligation to remove said links.
The company's reasons for its right to process data

(61) In support of the denial of the deletion request, Google has submitted that, taking into account all the known facts, the information about the applicant is still relevant and their processing is justified for the public interest. The website in question deals with the fact that the applicant has been wanted because he had fled to avoid a nine-year prison sentence for serious drug offences. There is a strong legitimate interest in keeping the information available to ensure the safety of those dealing with the applicant. The company has justified the data processing with the fact that the search results are necessary to exercise the right to freedom of expression and freedom of communication under Article 17, paragraph 3, subparagraph a of the General Data Protection Regulation. There is a remarkably important and justified reason for keeping them available in Article 21, Paragraph 1 of the General Data Protection Regulation.

(62) According to Google, the factors taken into account in the weighing of interests are in favor of making the search results available. The applicant has committed a serious crime that is still the subject of legitimate public interest and discussion; the legitimate interest also covers the escape from serving the sentence and the related search warrant. Considering the seriousness of the crime and the applicant's current business, he has a "public position". The public must be able to trust the applicant in connection with the current business. Escaping the execution of the sentence supports the availability of search results. The information is correct and is not offensive or slanderous to the applicant. Images included in news articles do not change the assessment. All the news are clearly dated, and no evidence has been presented in the case that these were misunderstood. The applicant has not actually claimed that people would have often reported him to the police, thinking he was still running away from his punishment, but the disadvantages presented by the applicant in support of his application are related to his business. Google has also considered that the passage of time has not substantially changed the assessment.
Reasons presented by the applicant and the data protection officer

(63) The applicant has justified his deletion request by the fact that the information is related to a search warrant that has not been valid since 2011. The information affects his business. The articles referenced in the links continue to request that all information about his movements be reported to the police. This significantly hampers the applicant's business, and his competitors have used the information against him.

(64) According to the Deputy Data Protection Commissioner's decision, the applicant has, as a result of his crime, a public or public-like status as referred to in the judgment of the European Court of Justice C-131/12, which basically gives the general public a legitimate interest in obtaining personal information about the applicant from the Google Search search engine. In the case, however, it has been necessary to assess how long this public status exists in relation to the processing of personal data. The main subject of the online content has been the wanted notice published for the applicant, and they do not provide more details about the applicant's crime. The search warrant has ended in 2011, and the public no longer has a reason to report their findings about the applicant to the police. The availability of information could no longer be considered justified.

(65) In the Supreme Administrative Court, the Data Protection Commissioner has submitted, among other things, that the online content concerns the reporting of a wanted notice, the social significance of which compared to crime reporting is mainly momentary. The content of the crime or the facts that led to the sentence have not been explained at all. Most of the articles also contain a photo of the applicant. It is a matter of outdated information based on the police's official release and which has since lost its meaning. The date stated in news articles does not guarantee that the reader understands that the information describes past events.

(66) The cases that are the basis of the decisions of the European Court of Human Rights regarding the press are not directly comparable to the case in question now, where the second party involved is the operator of an internet search engine instead of the original publisher. There is no special legislation that specifically outlines the permissibility of keeping certain information available in internet search engines.

(67) When search result links that have been requested to be removed have been about crime news, the effect of the passage of time has basically been reflected in the retention time provisions of the Criminal Records Act. In the evaluation of the case at hand, the starting point is instead the provision of the law on the processing of personal data issued by the police regarding the retention period of the search warrant.

(68) No significant and justified reason for obtaining the information in question has been presented. In the case at hand, the applicant's rights supersede both the search engine company's financial interest and the general public's interest in finding the outdated search warrant information in question through an internet search under the applicant's name.
Reasons for administrative law

(69) The administrative court has considered that the applicant has the public status referred to in the judgment C-131/12 of the European Court of Justice due to the commission of a serious crime. The applicant can be considered to have a public position also as a professional, company CEO and board member. 10 years had passed since the verdict when the appealed decision was issued. The general public's interest in information regarding the applicant's crime cannot be considered completely lost due to the passage of time, given the seriousness of the crime. The information regarding the wanted notice is not, in itself, information to be kept secret or information falling under the protection of the applicant's private life. However, finding such information when searching under the applicant's name can be embarrassing for the applicant and affect his business.

(70) The case cannot be resolved by paying attention exclusively to the retention period provision of the law on the processing of personal data in police operations, but the applicant's case must be evaluated as a whole. The interest of the general public in obtaining information regarding the serious crime committed by the applicant must also be considered to extend to the fact that the applicant has avoided the execution of his sentence for months and has therefore been the subject of an international wanted notice. In the weighing of interests, it must be taken into account that the search warrant issued for the applicant has no longer been valid and that the news has asked to inform the police of findings made about the applicant. However, the search results in question now show the time when the news was written. Only four news items ask to inform the police about the observations made about the applicant. In light of the above, the fact that the general public may be mistaken in thinking that the applicant's wanted notice is still valid cannot be given decisive importance in the weighing of interests.
Weighing and conclusion of the Supreme Administrative Court

(71) The Supreme Administrative Court evaluated the arguments presented by Google to oppose the deletion claim as presented in section 5.1 of this decision and paying particular attention to the weighing criteria adopted in the jurisprudence described in sections 3 and 4.

(72) The Supreme Administrative Court first states that, as the data protection commissioner has presented in his appeal, the articles in question are also available on the Google Search search engine by searches other than the applicant's name. A search using the applicant's name will find other similar content in addition to the articles in question. The articles are also available on the websites of the news media that published them. The effect of removing the search result links in question on the public's right to access information must therefore be considered relatively minor.

(73) In 2010, the applicant was sentenced to more than nine years in prison for a serious drug crime. He has since been wanted for evading the execution of the sentence. According to the report received, the wanted notice has not been valid since 2011.

(74) As such, the statutory retention periods for register data held by the authorities do not have direct legal significance in the weighing. However, the relatively short retention period can also partly reflect the reduction of the public's interest in accessing information from the public's point of view.

(75) The Supreme Administrative Court considers that the information about the search warrant from about ten years ago, which is no longer valid, has expired. This kind of information as such has no longer had much social significance, even though it has been indirectly connected to the sentenced punishment and crime.

(76) The case has also not shown that the applicant was guilty of crimes or actively sought publicity after these events. The applicant's business activities have not been such that there would have been reason to evaluate the matter differently. The crime in question has also not been related to the applicant's business activities, and it has not been stated in the case that the crime had an effect on it. As a result of his crime or search warrant, the applicant no longer had a particularly significant position in the public eye at the time of the Deputy Data Protection Commissioner's decision.

(77) The Supreme Administrative Court also considers that the information regarding the type of crime and the length of the punishment included in the articles in question cannot be considered particularly sensitive. On the other hand, the publication of clear facial images included in the articles must be considered in this context as a significant interference with the applicant's privacy protection. A face picture is typically published in news about wanted notices, but not usually in crime news.

(78) Considering the jurisprudence of the European Court of Justice, the applicant has not been obliged to show that he is harmed by the availability of the information. However, he has put forward reasonable arguments to support his claim. The Supreme Administrative Court considers that in weighing the interests in different directions, it is necessary to take into account in particular the fact that the articles concerning the search notice were outdated and the pictures of the applicant's face that were included in them significantly lacked the protection of his privacy.

(79) Referring to the above, the Supreme Administrative Court considers that Google has not presented sufficient grounds required in the jurisprudence of the European Court of Justice and the European Court of Human Rights referred to above in this decision to be able to demonstrate that in this case the public's interest in obtaining the information in question in connection with a search under the name of the applicant would supersede the applicant's initial the right to the protection of their privacy and personal data.

(80) For this reason, the decision of the administrative court must be annulled and the decision of the Deputy Data Protection Commissioner must be enforced in the parts under appeal.