Swedish Authority for Privacy Protection (IMY) – Court Ruling (Sweden, 2021)

In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google €7,200,000 (SEK 75 million) for violating Article 17 GDPR (the right to erasure). In particular, the IMY considered that Google had violated the right to erasure in connection with two complaints from data subjects (Complaint No. 2 and Complaint No. 8 in the supervisory case), as well as because of its general practice of regularly informing webmasters when search results are being removed. Google appealed that decision before the Stockholm Administrative Court (FiS). In December 2020, the FiS upheld that Google had breached the right to erasure with respect to Complaint No. 2, but found no such breach with respect to Complaint No. 8. In both cases, however, the FiS concluded that Google had acted contrary to data protection law because of its practice of notifying webmasters of deleted search results. The FiS further justified a reduction of the overall fine calculated by IMY for the breaches that were upheld. Google further appealed the FiS decision before the Court of Appeal in Gothenburg. In the context of these appeal proceedings, IMY argued that Google had breached the right to erasure with respect to both Complaint No. 2 and Complaint No. 8, and had also acted contrary to data protection law because of its practice of notifying webmasters of removed search results. IMY wanted the overall fine to be set at €6,300,000 (SEK 66 million). In particular, the proposed fine of €6,300,000 included: * a fine of €96,639 (SEK 1 million) for not respecting the right to erasure with respect to Complaint No. 2; * a fine of €1,448,547 (SEK 15 million) for not respecting the right to erasure with respect to Complaint No. 8; and * a fine of € 4,800,000 (SEK 50 million) for the practice of regularly informing webmasters of deleted search results. = The Gothenburg Court of Appeals partly reversed the findings of the the FiS and found that Google had complied with Article 17 GDPR on the right to erasure with respect to both Complaint No. 2 and Complaint No. 8. In particular: With respect to Complaint No. 2, the Gothenburg Court of Appeals found that the data subject had first only provided the main web address (URL) of the discussion thread where his/her name was mentioned, but had failed to provide the specific URLs where his/her name was mentioned each time. The Gothenburg Court of Appeal noted in this respect that Google's instructions on erasure requests clearly require the data subject to provide each and every URL that is part of the erasure request, as even small changes to the URL can lead to a different website. The Gothenburg Court of Appeal further noted that Google has set up a help page explaining the importance of providing each URLs in details. Finally, the Court of Appeals noted that, once the data subject had completed his/her erasure request by providing the specific URLs where his/her name was mentioned, Google had proceeded to the erasure of these pages without undue delay. Based on these considerations, the Court of Appeals concluded that Google had complied with Article 17 GDPR. With respect to Complaint No. 8, the Court of Appeals agreed with FiS that Google had complied with Article 17 GDPR by removing the concerned search result three days before IMY had ordered Google to do so. Hence, the Court of Appeals concluded that Google had deleted the requested search results without undue delay, in accordance with Article 17 GDPR. = The Gothenburg Court of Appeal upheld the FiS decision that Google's practice to regularly inform webmasters of the removal of search results was contrary to Article 5(1)(a) GDPR (principle of lawfulness), Article 5(1)(b) GDPR (principle of purpose limitation) and Article 6 GDPR (absence of valid legal basis for the processing). The Gothenburg Court of Appeals found in this respect that Google had systematically ignored the [https://ec.europa.eu/newsroom/article29/redirection/document/64437 Article 29 Working Party's Opinion on the right to erasure] over an extended period of time. Although the Opinion is not strictly binding, the Gothenburg Court of Appeal pointed out that the Article 29 Working Party's mandate is to ensure that the European Union's data protection rules are applied consistently in all Member States, and that controllers should thus consider such opinions and guidelines. In conclusion, the Gothenburg Court of Appeal found that Google's practice to inform webmaster of deleted search results was contrary to the GDPR, and upheld the fine of €4,800,000 million (SEK 50 million) imposed on Google by FiS.