Persónuvernd (Iceland) - Case no. 2021101926
| Persónuvernd - Case no. 2021101926 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 17 GDPR Article 17(3)(a) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 09.11.2022 |
| Published: | 29.11.2022 |
| Fine: | n/a |
| Parties: | Google LLC |
| National Case Number/Name: | Case no. 2021101926 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (in IS) |
| Initial Contributor: | n/a |
The Icelandic DPA rejected the complaint of a data subject based on Article 17 GDPR against Google LLC to remove search results containing their personal data, because their interests were outweighed the right of freedom of expression and information pursuant to Article 17(3)(a) GDPR.
English Summary
Facts
The data subject's complaint concerned the display of search results in Google's search engine. The search results referred to articles which discussed the alleged bullying which took place at the complainant's workplace. Google LLC, the controller, denied the complainant's request to remove the search results on the basis that there was no indication that the press coverage were false. Moreover, Google LLC argued that the press coverage was still considered to serve the public interest since it was published a short time ago.
Although the exact circumstances are not further elaborated in the decision, the DPA acknowledge that the data subject had a role in public life.
Holding
The DPA first held that the controller processed the data legally on the basis of legitimate interest pursuant to Article 6 GDPR. Although the data subject had an interest in the protection of their personal data, Google LLC's financial interests and the interest of the public to access information on the Internet outweighed it.
Moreover, in its second analysis, the DPA also held that the data subject could no rely on their right to be forgotten according to Article 17 GDPR to remove the search results in the Google search engine. The DPA noted that, according to Article 17(3)(a) GDPR, the right to be forgotten may not apply to the extent that it conflicts with exercising the right of freedom of expression and information. In the case at hand, it was of particular significance that the concerned data subject held a public role. The DPA elaborated that public figures may enjoy a lesser degree of privacy protection than private persons due to the importance of being able to freely discuss issues that may be relevant to the public. Moreover, the DPA considered that the press coverage was only about the data subject's job and the conditions at their workplace but not about their personal conduct in private life.
Consequently, the public's right to freedom of information was considered set aside the complainant's right to be forgotten.
Comment
Only an abridged version of the decision was published.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
In general, individuals may in certain cases have the right to have information displayed in search engines, e.g. Google, will be removed. Although results are removed from search engines, the content will still be online but can be removed in some cases. In this case, it was considered that the interests of the public outweighed the private interests of the complainant due to his employment and role in public life. ------ Personal protection ruled in a case that dealt with the right of a person to have information about him deleted that was published in the search results of the Google search engine, when searching for the person's name. The conclusion of the Personal Protection Agency was that, taking into account the complainant's employment and his role in public life, the public's interests in having access to the information in question outweighed the complainant's private life interests. The public's right to freedom of information was therefore deemed to override the complainant's right to be forgotten. Given that the decision contains detailed information about the complainant, even if personal identifiers were erased, the Personal Protection Agency has decided not to publish the decision in its entirety. However, Personal Protection has compiled an extract from the ruling, which follows. Extract from the ruling A complaint was made about the publication of search results in the Google search engine, which referred to articles where the complainant was discussed. The articles dealt with the alleged bullying that the complainant allegedly experienced at his workplace. Google LLC rejected the complainant's request to remove the aforementioned search results on the basis that the available data did not indicate that the allegations made in the news coverage were false, and that the news coverage was still considered to serve the public interest since the news coverage was published shortly and where the discussion was related to the complainant's work. Personal protection considered that when assessing whether the complainant has the right to delete certain search results that appear when the complainant's name is entered into the Google search engine, it is first necessary to examine whether the processing of personal information that takes place during the use of the search engine is supported with authorization according to law no. 90/2018 on personal protection and processing of personal information. Secondly, it would have to be assessed whether the complainant has the right to receive the personal information, i.e. the links and the information that would be published with the search results, deleted on the basis of Article 20 of the same law, cf. also Article 17 of regulation (EU) 2016/679. The conclusion of the Personal Protection Authority states that it will not be seen that the said processing of personal information can rely on other sources in Article 9. Act no. 90/2018 but No. 6 of the provision. It stipulates that the processing of personal data is permitted if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, in particular when the data subject is a child. In the case, on the one hand, the financial interests of Google LLC were tested. connected to the search engine, as well as the public's interest in being able to access information on the Internet. On the other hand, the complainant's privacy protection interests were tested, but Personal Protection considered that the goal of Act no. 90/2018 to promote the handling of personal data in accordance with the basic principles and rules on personal protection and privacy, cf. Paragraph 1 Article 1 of the law. In the decision of the Personal Protection Authority, it is stated that when assessing whether the right to be forgotten according to Article 20. Act no. 90/2018, cf. Article 17 of Regulation (EU) 2016/679, is available, can determine whether processing is necessary to exercise the right to freedom of expression and information according to point a, paragraph 3. Article 17, cf. also Article 6 Act no. 90/2018, which stipulates that the provisions of the law and the regulation may be deviated from in favor of the media, art or literature to the extent that it is necessary to harmonize views on the right to privacy on the one hand and freedom of expression and information on the other. It would therefore also have to be considered whether the aforementioned processing by Google LLC was necessary for the public to enforce the right to freedom of information and it could thus set aside the complainant's right to be forgotten according to Article 20. Act no. 90/2018 and Article 17 of regulation (EU) 2016/679, cf. point a, paragraph 3 of the article. It is stated in the ruling of the Personal Protection Authority that the conclusion on whether the processing of Google LLC is supported by authorization in Act no. 90/2018, on the one hand, and on the other hand, whether the complainant's right to be forgotten should be set aside, turns on an assessment of the different interests weighed in the case. In both cases, the public's interest in being able to access information about the complainant on the Internet, and thus in being able to exercise their right to freedom of information, must be assessed against the complainant's privacy interests. In such an interest assessment, it is particularly relevant whether the registered person is a public figure, e.g. a politician, or has held a public role. This can lead to the fact that the registered person, due to his position, does not enjoy the same privacy protection as unknown persons due to the importance of discussions on issues that may be relevant to the public. The ruling also states that it is relevant to such an interest assessment that the press coverage is about the complainant's main job and the situation at his workplace and not about the complainant's personal affairs in his private life. The conclusion of the Personal Protection Agency was that, taking into account the complainant's employment and role in public life, the public's interests in having access to the relevant information would be considered to outweigh the complainant's private life interests. Was the processing by Google LLC of personal information about the complainant that was under review therefore considered to be based on authorization in section 6. Article 9 Act no. 90/2018. Then the public's right to freedom of information was considered to override the complainant's right to be forgotten according to Article 20. Act no. 90/2018, cf. point a, paragraph 3 Article 17 of regulation (EU) 2016/679. The processing of the complainant's personal information, which involved publishing said search results in the Google search engine, was therefore not considered to be in violation of Act no. 90/2018.
