Google LLC – Dismissed (Iceland, 2022)

The data subject's complaint concerned the display of search results in Google's search engine. The search results referred to articles which discussed the alleged bullying which took place at the complainant's workplace. Google LLC, the controller, denied the complainant's request to remove the search results on the basis that there was no indication that the press coverage were false. Moreover, Google LLC argued that the press coverage was still considered to serve the public interest since it was published a short time ago. Although the exact circumstances are not further elaborated in the decision, the DPA acknowledge that the data subject had a role in public life. The DPA first held that the controller processed the data legally on the basis of legitimate interest pursuant to Article 6 GDPR. Although the data subject had an interest in the protection of their personal data, Google LLC's financial interests and the interest of the public to access information on the Internet outweighed it. Moreover, in its second analysis, the DPA also held that the data subject could no rely on their right to be forgotten according to Article 17 GDPR to remove the search results in the Google search engine. The DPA noted that, according to Article 17(3)(a) GDPR, the right to be forgotten may not apply to the extent that it conflicts with exercising the right of freedom of expression and information. In the case at hand, it was of particular significance that the concerned data subject held a public role. The DPA elaborated that public figures may enjoy a lesser degree of privacy protection than private persons due to the importance of being able to freely discuss issues that may be relevant to the public. Moreover, the DPA considered that the press coverage was only about the data subject's job and the conditions at their workplace but not about their personal conduct in private life. Consequently, the public's right to freedom of information was considered set aside the