11 March 2020. Datainspektionen, the Swedish Data Protection Authority (DPA hereinafter) it had issued a €7m monetary penalty against Google.
The background to the case concerns a serious violation by Google LLC of the wording of the GDPR. Although, Google had recently won a landmark decision assessing when the right of individuals to have their personal data removed from the searching engine was overridden by Google´s right to share information, regarding an individual, of public interest, it seems that for Google there is still a lot of to catch up to do when granting users rights.
In the mentioned resolution the court stated the criteria, and the thresholds, to take into account when striking a fair balance between the induvial right to be forgotten and Googles right to share an individual’s personal data, in its search engine, due to the existence of general interest in the publicity of the information.
In this particular case, in the curse of its investigations the Swedish DPA was satisfied that Google did not accomplish its data processors liabilities. Google was ordered by the DPA to remove from its search engine the name of the interested parties when these data was no longer accurate, relevant or was considered superfluous, the Swedish DPA stated in its communicate. Nevertheless, Google did not accomplish the given orders.
The GDPR sets a high bar for organizations to grant individuals privacy rights. One of those rights is the possibility for individuals to have their search result delisted.
“When Google removes a search result listing, it notifies the website to which the link is directed in a way that gives the site-owner knowledge of which webpage link was removed and who was behind the delisting request. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. This in practice puts the right to delisting out of effect.”
Facts about the right to have search result listings removed
In May 2014 the Court of Justice of the EU ruled that an individual may request a search engine provider such as Google to remove a search result listing that contains the name of an individual in case the listing is incorrect, irrelevant or superfluous. This right was strengthened with the GDPR entering into force 25th May 2018. The right is however not absolute, you cannot demand that all search results are to be removed. Individuals who wish to exercise their right to request delisting should contact the search engine provider directly.
For more information here
If you want to gain access to the resolution, please click here