Google – Court Ruling (Norway, 2022)

This case is an appeal of a decision by the Norwegian DPA, in which they instructed Google to delete one search result, but denied the data subject's erasure request for the two other search results. The Privacy Appeals Board agreed with the DPA in that Article 6(1)(f) legitimate interest is the correct lawful basis and, in particular, their reasoning around the processing of personal data subject to Article 10 GDPR. Pursuant to Article 6(1)(f) GDPR, the Privacy Appeals Board conducted a balancing test, in which they weighed the interests of the controller and the data subject. When balancing these interests, the Board found several matters to support the data subject's erasure request. First, when a data subject actively requests erasure, cf. Article 21(1) GDPR, their interest should by default outweigh the search engine's interests. This is reinforced when Article 10 GDPR personal data is involved. Second, as the data subject was sentenced in 2011 and had served their prison time by 2016, the search results relate to old matters. Third, the personal data should be correct and up to date, cf. Article 5(1)(d), cf. the Article 29 Group's criteria number 4 and 7 in their [https://ec.europa.eu/newsroom/article29/items/667236/en WP225 guidelines]. The 2011 ruling included a ban on the right to run a business, however in 2019 a court removed this ban so that the data subject could become a general manager in the company where they had worked as a project coordinator and project leader for several years. This is the same company where they were currently working and which was planning to go public. One of the news articles where the search results were leading to, gave an imprecise description of this situation. The Board also pointed out that it is relevant whether a person is of public interest and found that the data subject is not, even though they have a leading role in a company due to go public. Finally, the Board emphasised the data subject's personal burden relating to the search results. On the other hand, the Board found there were several matters that supported the rejection of the erasure request. First, the information was of public interest, especially due to the serious nature of the data subject's crimes. Second, the information was published due to journalistic interests and its news value. Third, the information related to their work life and not their personal life. Due to the many conflicting factors in their legitimate interest assessment, the Board found the weighing of interests challenging and, as a result, four members found that there were sufficient reasons to deny the erasure request, whereas two members disagreed. As the majority decides, the Board held that the DPA's decision to not instruct deletion of two search results, was upheld.