On 14 July 2020, the Belgian Data Protection Authority (“DPA”) imposed a fine of EUR 600,000 on Google Belgium SA/NV for infringing a Belgian resident’s right to be forgotten.
Besides the fact that this is by far the highest fine imposed to date by our DPA, the decision contains several interesting considerations regarding international jurisdiction and the application of the one-stop-shop principle, the scope of special categories of personal data, as well as the conditions of exercise of the right to be forgotten, also called right to erasure.
The facts are the following: the complainant, the CEO of a large undertaking, requested Google Belgium, through the online form available on its website, to delist search results linked to his name that he considered harmful to his reputation. These links concerned search results regarding alleged ties with a certain political party, which he refuted, and a harassment complaint against him, which had been declared unfounded in 2010. As Google Belgium refused to remove several of the concerned links, the complainant initiated a formal complaint with the DPA on 12 August 2019.
In its decision, the DPA first dismissed the application of the one-stop-shop mechanism. As a reminder, the one-stop-shop mechanism enshrined in the GDPR provides that organizations with establishments in more than one Member State carrying out cross-border personal data processing activities only have one interlocutor for the supervision of such activities, called the “lead supervisory authority”. Based on this principle, Google Belgium challenged the jurisdiction of the Belgian DPA stating that only Google’s lead supervisory authority – the Irish Data Protection Commissioner – was competent in the case at hand (Google’s main establishment in Europe being Google Ireland). The DPA’s Litigation Chamber rejected this argument because the processing of the data in the present case was not carried out in the context of the activities of Google Ireland Ltd. but of Google LLC (established in California), so that no cross-border processing activities in the meaning of Article 4 (23) GDPR took place.
Google Belgium also challenged the admissibility of the claim on the grounds that the entity responsible for the processing activities is Google LLC and not Google Belgium. The Litigation Chamber, applying the principles of Google Spain, Google v. CNIL and Wirtschaftsakademie, also rejected this argument. The DPA considered that the requirement for effective and comprehensive protection of the data subjects and the “inextricable link” between Google Belgium’s and Google LLC’s processing activities duly justify Google Belgium’s liability, irrespective of the actual location of the processing.
Regarding the conditions of the right to erasure, the Litigation Chamber recalled that requests for delisting must be assessed in light of the criteria established to ensure a fair balance between the rights of the data subject and the public’s freedom of expression and its right to information. Two key considerations are examined by the DPA as part of this assessment: (i) whether the data subject plays a role in public life – which justifies a higher threshold for his or her personal data to be erased and (ii) whether the search results contain special categories of personal data – which are subject to stricter protection under the GDPR.
While the Litigation Chamber fairly logically ruled that the complainant plays a role in public life, it is rather interesting to note that, in its view, the fact that the search results merely mention that the data subject is professionally supported by a political party is not enough to qualify as a special category of personal data. In order to qualify as sensitive data, it is necessary for the personal data in question to have revealed the complainant’s own political opinions, which is not the case here according to the Litigation Chamber.
On the basis of these considerations, the Litigation Chamber considered that the complainant’s request to delist search results concerning a purported link with a certain political party were unfounded. On the delisting request regarding the harassment complaint, the DPA considered that the veracity of the allegations was not established and that these allegations, which were old, were likely to have prejudicial consequences on the complainant’s professional and private life. The DPA therefore held that those were no longer necessary to exercise the right to freedom of information. The violation was considered to be serious as Google failed to act diligently while having all the information required to do so as of the moment of submission of the complainant’s form.
The Litigation Chamber therefore ordered Google to delist the search results throughout the entire European Economic Area (in other words not only in Belgium) in order to ensure useful result.
Consequently, the DPA imposed a fine of EUR 500,000 for serious violation of the right to erasure (art. 17) and lawfulness of the processing (art. 6), and EUR 100,000 for the violation of the transparency principle (art. 12). Finally, Google was ordered to adapt the forms it makes available to its users to exercise their data subject rights and to provide more clarity on the roles and responsibilities of the different entities involved.
Please contact Karel Janssens for further information about this case and/or for general legal advice relating to privacy and data protection.