Google Inc. – Complaint Upheld (Greece, 2024)

The data subject submitted an erasure request to [https://google.com Google Inc.] (the controller) requesting the removal of 55 search results from the controller's search engine that were produced with a search for his full name. The results linked to pages where the data subject's name had been linked to sensitive data, specifically information linked to a criminal case that the data subject claimed was inaccurate. The data subject believed this information was no longer necessary and it impacted heavily on his private and professional life. The controller responded to the request citing a legitimate public interest in having access to the information that concerned criminal offences, and argued that deletion of the relevant links were therefore not permissible. The data subject complained to the Hellenic DPA (HDPA) on 21 May 2018 that the controller’s argumentation is contrary to the jurisprudence of the CJEU (C‑131/12 - Google Spain) and failed to properly assess his request and supporting documents. The controller responded that it had removed 11 URLs, but that the removal of the remaining 44 URLs the complainant wanted deleted was not justified. The controller concluded that the information was still relevant and pertained to the complainant's role in public life, meaning the public's right to access this information outweighed the complainant's right to have it removed. The HDPA noted that a search engine provider that receives a deletion request based on the particular situation of the data subject must delete the personal data without unnecessary delays in accordance with Article 17(1)(c) GDPR unless it is able to demonstrate that there are "compelling and legitimate reasons" overriding the interests, rights and freedoms of the data subject for the inclusion of the specific search result, pursuant to Article 21(1) GDPR. Additionally, the HDPA noted CJEU - C-460/20 - TU, RE v Google paras. 52-62, stating that individuals have the right to have personal in