The Swedish Data Protection Authority (DPA) charged Google a 75 million kroner ($7.8 million) GDPR fine over the failure to carry out the right-to-be-forgotten’ requests received from EU citizens to remove web pages from its search engine listings.
The right to be forgotten in the EU exists before GDPR. It was first covered in EU legislation in 2014 subsequent to a ruling by the European Court of Justice regarding the case, Google Spain SL, Google Inc versus Agencia Española de Protección de Datos, Mario Costeja González. The law mandates search engines to remove links to freely accessible webpages that are seen in search results created from a search of an individual’s name, in case that individual requests the removal of the listing and when particular conditions are satisfied.
GDPR strengthened the right to be forgotten. Upon receipt of a request from a citizen in EU who wants to exercise the right to be forgotten, provided the request does not clash with the right of freedom of expression and information, deletion of personal data must immediate where the data are no longer required for their original processing intent, or the data subject has taken his permission and there isn’t any other legal basis for processing.
Google has gotten innumerable requests from EU folks to remove content and had fulfilled roughly 45% of the requests.
The Swedish DPA performed an audit of Google in 2017 to evaluate how Google was dealing with requests to delist links indexed by its search engine and ordered Google to delist a number of webpages.
In 2018, the Swedish DPA reviewed the audit and found out that Google did not delist all the search results written in the order. The GDPR fine pertains to two listings that Google was directed to delist. In one case, Google’s understanding of the web pages that had to be removed was found to be too narrow. In the second case, Google did not remove the search result listing without undue delay.
The Swedish DPA additionally discovered that when Google delists web URLs, website owners receive notifications alerting them regarding the removal of the information from its listings and data is given regarding who made the request. These notices make sure that website owners know about the delisting, however, doing so simply allows the website owners to republish the delisted content using a different URL.
The Swedish DPA stated that this approach undercuts the usefulness of the right to be forgotten. Google does not have a legitimate basis for informing website owners any time removing search result listings, and in addition, gives people unreliable information regarding the use of the request form.
Google disagrees with the decision and plans to appeal regarding the financial penalty. The EU law requires the filing of the appeal within 3 weeks.