Google Fined $8 Million by Swedish Data Protection Authority

The Swedish Data Protection Authority has announced it has imposed a SEK 75 million fine on Google for right to be forgotten failures.

The GDPR allows individuals to request that their personal data is permanently deleted, which for Google can mean having search results delisted. The violation actually predates the GDPR, which came into effect on May 25, 2018.  The right to have information removed from the search engine listings actually dates back to 2014 and was introduced to allow people to have potentially damaging information removed from the search engine listings.

In 2017, the Swedish DPA finalized an audit of how Google handles requests from individuals to have search engine results delisted that include their name and the DPA ordered Google to remove certain search result listings.

In 2018, acting on information that suggested Google had failed to comply with the order, the DPA investigated and found that Google failed to remove two of the listings. The DPA determined that in one case, Google had interpreted the order too narrowly and had not removed all of the web addresses, and for the second, Google did not remove the listing without undue delay.

The manner in which delisting requests are handled was also criticized. When a request is received to have a web address delisted, Google notifies the website owner about the de-listing. The website owner is also provided with information about who submitted the delisting request. This approach allows the website owner to simply re-list the content under another URL, which will then be indexed by Google and displayed in the search results. This method of action means the right to have information delisted is undermined.

The DPA said “Google does not have a legal basis for informing site-owners when search result listings are removed and furthermore gives individuals misleading information by the statement in the request form. That is why the DPA orders Google to cease and desist from this practice.”

Google disagreed with the decision on principle and plans to appeal the financial penalty. The search engine giant has three weeks to file its appeal.

GDPR Compliance Checklist

Got customers in Europe?
Your American company may be required by law to comply with GDPR.

Thank You

How we use your data
Immediate Access.
Confidentiality guaranteed.

GDPR Compliance Checklist

Got customers in Europe?
Your American company may be required by law to comply with GDPR.

Thank You

How we use your data
Immediate Access.
Confidentiality guaranteed.