Google LLC – Court Ruling (Netherlands, 2020)

The applicant asked Google to remove search results for his name, under the "right to be forgotten". Google decided not to take action on certain URLs. Two months later, the applicant submitted a new (repeated) request, which was rejected by Google for the same reasons. The applicant then lodged a complaint in front of the Dutch civil courts. In Netherlands, the instigation of legal proceedings against a data controller on the basis of the GDPR has been further regulated by the "GDPR Implementation Act". According to Article 35(2) of this local law, data subjects who wish to challenge a data controller' decision on a request made on the basis of Articles 15 to 22 of the GDPR, shall lodge their petition in front of the civil courts within six weeks of receipt of the decision. According to the Dutch case law, exceeding this six-week period leads, in principle, to inadmissibility. Consequently, Google was of the opinion that the applicant's petition was inadmissible as it was submitted later than six weeks after Google's first reply, and therefore not within the period prescribed by Article 35(2) of the GDPR Implementation Act. On the contrary, the applicant was of the opinion that his second (repeated) request started a new time-limit. According to the applicant, neither the GDPR nor its Implementation Act limits the number of applications which may be submitted. In that regard, the applicant refers to the text of Article 21(1) of the GDPR, which states that requets for removal can be made "at any time". Should the applicant's complaint be declared inadmissible for not respecting the time limits as set out to in Article 12(5) of the GDPR and Article 35(2) of the Dutch GDPR Implementation Act? According to the court, the exercise of the rights granted to the data subjects by the GDPR is not unlimited. In order to protect the legitimate interests of the data controller (not to have to decide continuously on repeated requests and be subjected to lengthy litigation,