Google LLC – Court Ruling (Greece, 2024)

The data subject is a journalist, who in 2011 started receiving backlash for publishing her research on generic drugs. Many websites posted abusive, defamatory and derogatory comments about her being transexual. Google associated her name with the derogatory and defamatory comments about her and, as a result, upon googling her name, those terms came up as an auto suggestion/auto completion in the search tool. In 2012, the data subject filed a case before the court of first instance (Athens Court of First Instance) against the U.S. based Google LLC and the Greek subsidiary, Google Greece, (controllers) requesting that the said auto suggestions/auto completions and links to the said pages would be deleted since they constituted a violation of her personality and damaged her honour and reputation. The court issued interim measures and then a decision ordering the controllers to cease and desist from associating in any way her name with these words and prevent any future posting of similar content in the search results. The court found that the controllers violated her personality rights under Greek law (Civil code, Articles 57-59) and awarded her €30,000 in non material damages. Nevertheless, the auto suggestions/auto completions regarding her name and the links were not deleted and the data subject contacted Google LLC and Google Greece multiple times in an attempt to resolve this. On their behalf, the controllers instructed her to file a request on their platform and point out the certain URLs for deletion. Both parties appealed before the court of appeal (Athens Court of Appeal). The controllers claimed that the court of first instance erred in the application of the law, arguing that they were not liable for the content of the third-party posts on the Internet appearing in the search engine and that they may remove specific URLs only if they are notified (with a specific reference) by the data subject. The data subject claimed a higher compensation. The court of appeal, in 2016, rejected the appeal. It made clear that both Google LLC and Google Greece were responsible for the technical and commercial operation of the search engine and the auto suggestions/auto completions feature and are considered controllers. It held that as controllers they were responsible for the content third parties posted on the Internet in the context of the operation of the search engine were bound to immediately comply with the court’s order. The controllers further appealed before the Supreme Court (Supreme Court of Greece- Areios Pagos). The Supreme Court upheld the decision of the court of appeal. First, it pointed out that online search engines, do not (in principle) create new, primary content, but merely indicate where existing content can be searched for, thereby providing a 'hyperlink' to the website containing the terms searched for. If the originating websites, web pages and blogs contain personal data, then their content in the search engine contains such data, in which case national and EU legislation on the protection of personal data applies. With references to the CJEU cases Google Spain ([https://curia.europa.eu/juris/liste.jsf?num=C-131/12 C-131/12]) and Lindqvist ([https://curia.europa.eu/juris/liste.jsf?language=de&num=C-101/01 C-101/01]), the court held that making available to internet users in a certain order of preference information published or posted on the internet by third parties must be classified as processing of personal data under Article 4(2) GDPR. Second, it held that therefore the search engine operators determine the purposes and means of carrying out the activities of the search engine, meaning that Google LLC and Google Greece must be qualified as the controllers of that processing under Article 4(7) GDPR. Third, it ruled that search engine operators shall be required to remove from the list of results, which appears after a search carried out on the basis of the name of a person, links published by third parties containing information relating to that person that are inaccurate or unlawful. In the present case, since the request for removal of the links to the websites was made in connection with application and issuing for interim measures in 2012, (which temporarily prohibited the controllers from making any such reference to the data subject in connection with the words), the court held that no further specific and concrete request was required from the data subject. The court held that she did not have to request the deletion again or proceed with the identification of the URLs to be deleted. Lastly, the court highlighted that this was in line with Article 8 and Article 11 CFR.