Court case 2020/AR/1111 – Court Ruling (Belgium, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian Data Protection Authority ordered Google Belgium to remove certain search results and fined them EUR 600,000. This case involved a request to de-reference URLs linked to a company executive. It highlights the complexities of jurisdiction and responsibilities within Google's entities under GDPR.
What happened
Google Belgium was ordered to remove specific URLs from search results and fined EUR 600,000.
Who was affected
The case affected a company executive who requested the removal of URLs from Google's search results.
What the authority found
The Belgian DPA ruled that Google Belgium must de-reference the search results and pay a fine, asserting jurisdiction despite Google's internal structure.
Why this matters
This decision emphasizes the importance of clear roles and responsibilities among international companies under GDPR, particularly regarding jurisdiction and data processing activities.
GDPR Articles Cited
The complainant, an executive at an unnamed large company, had requested the removal of 12 URLs. As Google had refused to remove several of the concerned links, the complainant referred the case to the Belgian DPA. Building on the principles developed by the CJEU in the Google Spain and Google/CNIL cases, the Belgian DPA decided that Google Belgium is an establishment of Google LLC , triggering the applicability of the GDPR under article 3.1. Moreover, the DPA referred to a latter sent on 23 June 2020 by Google LLC to the Irish DPC stating it would no longer object to local (non-lead) supervisory authorities exercising local data protection jurisdiction when it comes to the scope of Google LLC's responsibilities. As a result, despite the designation of the Irish DPC as lead supervisory authority, the Belgian DPA considered it had jurisdiction because the case did not relate to Google Ireland Ltd's processing activities, but to Google LLC. Therefore, the one-stop-shop procedure did not apply. On these grounds, the Belgian DPA: * ordered Google Belgium to de-reference the concerned search results; * imposed an administrative fines of EUR600,000, based on Alphabet's (Google's mother company) annual turnover in the three previous years; and * ordered Google to clarify the ambiguity concerning the roles of the different entities involved, and in particular to clearly and precisely clarify which entity is the data controller for Belgium and for which processing activity. Google Belgium appealed the decisions before the Court of appeal on the grounds that - the order was addressed to Google Belgium which is not the controller in this case * the APD did not sufficiently motivate how it could be established that Google Belgium was linked to the activities of Google LCC as the controller; * Article 58 GDPR does not provide the possibility to impose a corrective measure on another entity than the controller (ie Google LLC); * the APD published the decision without removin
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 2020/AR/1111 in BE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 2020/AR/1111 - Belgium (2021). Retrieved from cookiefines.eu
Last updated: