The Swedish Data Protection Authority (DPA) issued Google a 75 million kroner ($7.8 million) GDPR penalty for failing to comply with the right-to-be-forgotten’ requests coming from European Union residents to take out webpages from its search result pages.
The right to be forgotten in the European Union exists prior to GDPR. It was initially included in EU laws in 2014 after a judgment by the European Court of Justice concerning the lawsuit, Google Spain SL, Google Inc vs Agencia Española de Protección de Datos, Mario Costeja González. The rules require search engines to take out hyperlinks to freely accessible websites that show up in search engine listings produced from a lookup of a person’s name, when that person asks the taking away of the listing and in case, specific issues are satisfied.
GDPR toughened the right to be forgotten. After receiving of a request from a resident in EU who would like to avail his right to be forgotten, as long as the request doesn’t conflict with the right of freedom of expression and information, removal of personal information should instantaneous where the information is not necessary for their initial processing function, or the data subject has pulled his authorization and there’s no other legal regulation for processing.
Google has acquired countless requests from EU residents to delist content and had met around 45% of the requests.
The Swedish DPA carried out a review of Google in 2017 to check out how Google was fulfilling requests to remove websites listed by its search engine and directed Google to remove a couple of websites.
In 2018, the Swedish DPA checked up on the audit and learned that Google failed to remove all the search engine results specified in the order. The GDPR penalty deals with two listings of which Google was commanded to delete. In one case, Google’s knowledge of the websites that should be taken out was identified to be too limited. In the second case, Google didn’t delete the search result listing immediately.
The Swedish DPA furthermore learned that when Google removes URL pages, site owners get notifications telling them concerning the deletion of the material from its listings and details are supplied concerning who generated the request. These communications make certain that site owners are informed about the delisting, nevertheless doing this just makes it possible for the site owners to republish the deleted information using another web address.
The Swedish DPA mentioned that this process diminishes the power of the right to be forgotten. Google doesn’t have a lawful ground for notifying webpage owners whenever taking away search result listings, and moreover gives folks confusing information concerning the use of the request form.
Google does not agree with the court ruling and wants to appeal concerning the financial penalty. The EU law demands the submission of the appeal in three weeks.