Court case 2021-17 – Court Ruling (Norway, 2021)

The data subject had been convicted of accessing, possessing and publishing images and videos containing sexual assaults on children. The criminal offences had taken place over a period of 20 years. During this time, the data subject worked as a psychiatrist and as an expert witness in cases relating to family and children welfare. After having served their prison sentence, the data subject contacted Google and asked to have five search results removed from the search engine. The data subject argued that the search results had a severe negative impact on them and their children. Google denied the request, stating that the search results were a matter of public interest. The data subject brought the case before Datatilsynet (The Norwegian Data Protection Office). Datatilsynet concluded that Google had to delete the search results. Google filed an appeal, and the case was brought before the Privacy Appeals Board (PVN). The PVN had to consider only two of the five search results, as the rest had been deleted before the start of the proceedings. The PVN first remarked that Google as a controller had a legal basis for their processing in article 6(1)(f) GDPR. However, according to article 17(1)(c) and article 21(1) GDPR, upon receiving an erasure request from the data subject, the search engine company would have had to delete the search results unless there were overriding legitimate grounds for not doing so. The PVN highlighted that the controller had the burden of proof when it came to such legitimate grounds. The PVN then noted that when a person working closely with children as a public figure is convicted for sexual offences relating to children, there is an obvious legitimate interest in making this information accessible to a wider audience. Although the legitimate interest is reduced over time, the PVN considered the time passed in this case (almost 4 years) to be rather short. On the other hand, the PVN argued that the search results contained information on