The APD imposed a fine of 600,000 euros on Google Belgium for non-compliance with the right to be forgotten by a citizen, after Google refused its request to dereference obsolete articles damaging to its reputation. This is the highest fine imposed by ODA to date.
Request to dereference internet pages with Google Belgium
The complainant, who by virtue of his position plays a role in public life in Belgium, made a request to Google Belgium to delete search results linked to his name on the search engine (what is called "dereferencing" "). Part of the pages he wished to see dereferenced relates to a possible political labeling, which he refutes; a second part relates to a complaint of harassment against him, declared unfounded many years ago. Google has made the decision not to dereference any of the pages in question.
Right to be forgotten
As for the pages concerning political labeling, the Contentious Chamber of the DPA considered that, given the role of the complainant in public life, maintaining their referencing was necessary in the public interest and thus agreed with Google.
As for the pages concerning a complaint against the complainant, the APD considers that the request for dereference is well founded and that Google has expressed a serious breach by refusing it. Since the facts have not been established, are old, and are likely to have serious repercussions for the complainant, the rights and interests of the person concerned must prevail. According to the Litigation Chamber, Google was particularly negligent, given that the company had evidence of irrelevance and out of date facts.
Hielke Hijmans, President of the Litigation Chamber: “In the right to be forgotten, a balance must be struck between, on the one hand, the right of the public to access information, and, on the other, and interests of the data subject. While some of the articles cited by the complainant may be considered necessary for the right to information, the others, which relate to unproven harassment and about 10 years old, must be able to be forgotten. By now maintaining links via its search engine, widely used by Internet users, which can cause significant damage to the complainant's reputation, Google has shown clear negligence. "
The penalty: 600,000 euros fine
The APD thus fined Google 600,000 euros for not having dereferenced the pages reporting the obsolete complaint against the complainant, for the lack of information provided to the complainant to justify the refusal of dereference, as well that the lack of transparency in the dereference form offered by Google.
It also orders Google to stop referencing the pages concerned in the European Economic Area, and to adapt its dereference request forms in order to provide more clarity in relation to which entity (ies) are responsible for this data processing.
This fine imposed on Google is the highest ever decided by the ODA. Until today, the highest fine imposed by its Litigation Chamber amounted to 50,000 euros.
Hielke Hijmans adds: "This decision is historic for the protection of personal data in Belgium, not only because of the amount of the penalty, but also because it ensures that the full and effective protection of the citizen is maintained in files related to large international groups such as Google, whose structure is very complex. "
ODA competence vis-à-vis Google Belgium
In this case, Google argued that the complaint cannot be substantiated because it is brought against Google Belgium, while the controller is not the Belgian subsidiary of Google, but the company Google LLC, established in California.
The Litigation Chamber did not accept this argument. According to her, the activities of Google Belgium and Google LLC are inextricably linked, and, therefore, the Belgian subsidiary can be held responsible.
This is crucial to ensure effective and complete protection of the GDPR, as it is not easy for a national authority in Europe to exercise effective control and impose sanctions against a society located in the States -United.
The Litigation Chamber, however, followed Google's argument that its main establishment in Europe (Google Ireland) is not responsible for dereferencing.
David Stevens, President of the ODA: “This decision is not only important for our Belgian citizens, it is also proof of our ambition to better protect privacy 'online' in collaboration with our European counterparts, which calls for concrete actions against active players at world level. In this way, we wish to actively contribute to the development of a real cdata protection at the European level. "
Conclusion: Right to erasure vs Right to be forgotten.
Under article 17 of the GDPR, the entity processing your personal data (called "data controller") must erase it as soon as possible if one of the following reasons applies:
- your data is no longer necessary for the purposes
- you withdraw your consent on which the processing is based and there is no other legal basis for the processing
- you object to the processing of your data and there is no overriding legitimate reason for the processing
- your personal data has been subject to unlawful processing;
- your personal data must be erased to comply with a legal obligation
- your personal data was collected as part of the information society service offer when you were a child
What happens if your data has been transmitted to other entities? This is where the expression "right to be forgotten" comes into play which, in our opinion, should rather be interpreted as a resale right of the right to erasure. Given technological developments, it is very likely that there is no real right to be forgotten.
When it has made your personal data public and is required to erase it because it is in one of the situations mentioned above, the entity which processes your data (called "data controller") shall take all reasonable measures to inform the other entities which process your data that you have requested the erasure of any link to this personal data, or of any copy or reproduction thereof.
It is therefore not an obligation of result but rather of means.
Even if you request it, the deletion of your data will nevertheless not be carried out in 5 very specific situations.
If you have any questions relating to this subject, do not hesitate to contact me via the “contact me” section of the blog. or write an email.