Google – Court Ruling (Norway, 2022)

This case is an appeal of a decision by the Norwegian DPA, in which they instructed Google to delete one search result, but denied the data subject's erasure request for the two other search results. The Privacy Appeals Board agreed with the DPA in that Article 6(1)(f) legitimate interest is the correct lawful basis and, in particular, their reasoning around the processing of personal data subject to Article 10 GDPR. Pursuant to Article 6(1)(f) GDPR, the Privacy Appeals Board conducted a balancing test, in which they weighed the interests of the controller and the data subject. When balancing these interests, the Board found several matters to support the data subject's erasure request. First, when a data subject actively requests erasure, cf. Article 21(1) GDPR, their interest should by default outweigh the search engine's interests. This is reinforced when Article 10 GDPR personal data is involved. Second, as the data subject was sentenced in 2011 and had served their prison time by 2016, the search results relate to old matters. Third, the personal data should be correct and up to date, cf. Article 5(1)(d), cf. the Article 29 Group's criteria number 4 and 7 in their [https://ec.europa.eu/newsroom/article29/items/667236/en WP225 guidelines]. The 2011 ruling included a ban on the right to run a business, however in 2019 a court removed this ban so that the data subject could become a general manager in the company where they had worked as a project coordinator and project leader for several years. This is the same company where they were currently working and which was planning to go public. One of the news articles where the search results were leading to, gave an imprecise description of this situation. The Board also pointed out that it is relevant whether a person is of public interest and found that the data subject is not, even though they have a leading role in a company due to go public. Finally, the Board emphasised the data subject's personal b