The Swedish Data Protection Authority (DPA) said it is imposing a fine of SEK 75 million on Google for failure to comply with the right to be forgotten under GDPR. The search engine operator has three weeks to appeal.
In 2017, the authority conducted an audit of Google’s handling of individuals' right to have search result listings that included their name removed from the search engine, in cases such as lack of accuracy, relevance or superfluity. The DPA concluded that a number of search result listings should be removed and subsequently ordered Google to do so.
The DPA carried out a follow-up audit in 2018 after indications that Google had not fully complied with the order. That audit is now finalised and the DPA is issuing a fine against Google.
The authority said it is critical of the fact that Google did not properly remove two of the search result listings that the DPA had ordered it to remove in 2017. In one of the cases, Google had made too narrow an interpretation of which web addresses needed to be removed from the search result listing. In the second case, Google had failed to remove the listing without undue delay.
When Google removes a search result listing, it notifies the website to which the link is directed, so that the site owner knows which link was removed and who was behind the delisting request. This allows the owner to re-publish the webpage on another address, which will then show up in a Google search. This, said the DPA, puts the right to delisting out of effect.
Olle Pettersson, legal advisor at the DPA, said that in its delisting request form, Google states that the site owner will be notified of the request in a way that might result in individuals refraining from exercising their right to request delisting, thereby undermining the effectiveness of this right.
The DPA said Google does not have a legal basis for informing site owners when listings are removed, and furthermore gives individuals misleading information by publishing the statement on the request form. That is why the DPA is ordering Google to cease and desist from this practice.
Google may appeal against the DPA's decision within three weeks. If it does not, the decision will enter into force by the end of that time period. Once the decision has entered into force, it will be handed over to the Legal, Financial and Administrative Services Agency (Kammarkollegiet), which handles the administration of fines under GDPR.
