Swedish Data Protection Authority Imposes Administrative Fine On Google

• Published date: 14 May 2020
• Author: Ms Sofia Lysen (Elmzell)
• Subject Matter: Privacy, Data Protection
• Law Firm: lus Laboris

The Swedish Data Protection Authority (DPA) has imposed a fine of SEK 75 million (approximately EUR 7 million) on Google for failure to comply with the GDPR.

In 2017, the Swedish Data Protection Authority (DPA) ordered Google to delist certain search results about several different data subjects from Google's search engine. In 2018, responding to complaints that Google had not complied with the previously issued order, the DPA initiated a follow-up audit.

The DPA discovered that Google had not properly removed result listings it had been ordered to remove. This violated the General Data Protection Regulation (GDPR) right to erasure. Google also violated the GDPR by processing special categories of personal data and data relating to criminal convictions and offences. Google had in one case suggested that it was not obliged to remove the data, as this was not part of the person's previous request, but the DPA did not agree.

In addition, the DPA found that Google had not removed another person's data which also was ordered removed in 2017. Google's failure to remove the search result listing without undue delay constituted a failure to comply with the GDPR right to erasure, and the DPA determined that Google also processed the person's personal data relating to criminal offences, another violation.

In the process of delisting search results, Google also notified the site owner to which the link was directed that a webpage link was removed. This may have effectively given the site owners information about which person requested the delisting. The DPA found that such processing of personal data was unlawful under the GDPR, since it was incompatible with the initial purpose and Google had no legal basis for this type of processing without authorisation by the person requesting a delisting. The DPA therefore required Google to cease informing site owners of delistings. According to the DPA, Google also...