Background information
Date of final decision: March, 17, 2022
Controller: Google LLC
Legal Reference:Transparency (Article 12), Right to erasure (Article 17)
Decision: Infringement of the GDPR: article 12.1 and 12.3 GDPR
Key words: Search engine - delisting request
Summary of the Decision
Origin of the case
This decision is the result of a request for the delisting of several press articles reporting the criminal convictions by a former lawyer - disbarred as a result of these convictions. The convictions happened less than 10 years ago and the complainant is now a legal advisor.
Key Findings
The Litigation Chamber of the BE Supervisory Authority (SA) dismissed the complaint against Google for refusing to delist the press articles relating to the complainant (concerning his disbarment as a lawyer following two criminal convictions for several offences).
In parallel, the decision (in line with decision 37/2020 of the BE SA) recalls its competence to impose sanctions and/or corrective measures against Google's local (in this case Belgian) establishment (i.e. Google Belgium SA) and not exclusively against Google LLC, even if it is the sole data controller.
On the basis of the CJEU's Google Spain case law, the applicability of Article 3.1. of the GDPR (not contested by the Google parties) and the useful effect of European law, the Litigation Chamber concludes that it has the power to (1) notice shortcomings of the GDPR by Google LLC, (2) that these breaches are attributable to Google Belgium SA and (3) that corrective measures and sanctions should be imposed on Google Belgium SA (highest level of protection for the benefit of the data subjects).
Decision
Even if the BE SA dismissed the complaint concerning Google’s refusal to delist (based on a reasoning that relies on various substantiated criteria to conclude that the public still has an interest to access the information concerning the lawyer in the search engine), the BE SA finds:
- a failure to comply with Article 12(1) in conjunction with Article 17 of the GDPR with regard to the quality of the statement of why the delisting is refused , and with regard to the delisting request form (unclear identification of the controller in particular)
- a failure to comply with Article 12(2) in conjunction with Article 17 of the GDPR (failure to facilitate the complainant's right to erasure, as the complainant was effectively 'passed around' from Google Ireland to Google LLC via Google Belgium).
These shortcomings are by Google LLC, imputed to Google Belgium and sanctioned by means of a reprimand addressed solely to Google Belgium SA.
This decision was annulled by the Market Court (i.e. the appeal body for decisions of the Litigation Chamber of the Belgian SA) insofar as it imposed corrective measures and sanctions on Google Belgium as a local establishment and not on Google LLC as the sole data controller. The Market Court ruled that the decision of the Litigation Chamber did not sufficiently demonstrate the indissociable link between the two entities to allow the imposition of these measures and sanctions on Google Belgium.
For further information:
- Judgment of the Market Court published on the Belgian SA website (FR)
- Decision in French: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au…
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.