Google LLC – Complaint Upheld (Finland, 2020)

Pursuant to Article 17(1) GDPR, the data subject had requested Google LLC (the controller) to remove several search result links from Google Search because they led to outdated information about the data subject. The controller had only removed some of the links, rather than implementing the request in its entirety. The controller stated that the search result links led to online content, the main subject of which was the arrest warrant issued against the data subject. The controller argued that it had a substantial legitimate interest in keeping the information available to ensure the safety of those dealing with the data subject. The data subject claimed that they had already served their prison sentence in full and that the arrest warrant had ceased to be valid since April 2011. Consequently, the information was no longer necessary for the purposes for which it was originally processed. The data subject emphasised that the information about the warrant caused them harm, as it was both inaccurate and outdated. The DPA considered that since the arrest warrant was no longer valid, the public no longer had a reason to inform the police of their sightings of the data subject. Therefore, due to the passage of time, the availability of the information could no longer be considered justified. The DPA also emphasised the importance of the statutory retention period for the arrest warrant. According to [https://www.finlex.fi/fi/laki/ajantasa/2019/20190616#L5P34 Section 34(2)(4) of the Finnish Act on the Processing of Personal Data by the Police], data concerning an arrest warrant processed for the purpose of finding, monitoring, surveillance or protection of individuals are erased three years after the cancellation or expiry of the warrant or prohibition. On the basis of the information gathered, the DPA concluded that the information on the arrest warrant against the data subject was no longer of importance to society. As a result, and in accordance with Article 58(2)(c) GDPR, the DPA ordered the controller to comply with the data subject's request to remove the search result links in question.