whose requests to dereference websites containing personal information about them were rejected by Google, which have gone to court. One of the cases was settled out of court, whilst the other was the subject of judicial proceedings. In this case, which will be examined in detail here, the Stockholm Court of first instance, found in Google’s favour in a judgment dated 9 May 201648 by refusing to dereference certain links, ordering the complainant to pay costs of 369,000 Swedish kronor (i.e. the equivalent of €37,000) including 345,000 kronor as defence costs.49 The court considered that the large amount of the sums awarded
45 The Datainspektion which makes a particularly in-depth legal analysis on this point refers to the French Data Protection Authority (the CNIL) decision of 10 March 2016 concerning Google dereferencing all the domain name extensions for its search engine.
46 Decision of the DI pp.13-18.
47 Google is asking the court to cancel the dereferencing order concerning removals outside the EU/ EEE territory. The Swedish lawyer in arguments in over 30 pages drawn from the case law of international courts (ECJ, ECtHR, the international court of justice), national courts (Canadian, Portuguese, Spanish, American), foreign doctrine notably French and a multitude of legal instruments (ECHR, Charter of fundamental rights of the European Union, Directive 95/46/EC, United Nations Charter, regulation (EC) n° 2271/96 protecting against the effects of the extra-territorial application of legislation adopted by a third country, and actions based thereon or resulting therefrom, argues that the DI lacks the jurisdiction to make these kind of orders.
48 N° T 4355-15. The same court also handed down a judgement in Google’s favour in a second case FT 8038-16, on 23 December 2016. The complainant was not requesting the dereferencing of links per se but an indemnity from Google for breaches to his privacy which indexing links to a discussion forum had allegedly caused him.
49 The first instance court’s judgment was upheld on appeal by the Court of Appeal of Svea (Svea Hovrätt) in a judgement dated 5 March 2017(T4721- --7).
¼
https://blogdroiteuropeen.com p 068PART 1: THE DOMESTIC IMPLEMENTATION OF THE GOOGLE SPAIN CASE
THE RIGHT TO BE FORGOTTEN IN SWEDEN
was justified, by, as Google argued, the novelty of this issue in Swedish law and the size of the stakes involved in this trial for Google. These two factors explained the extent of the defendant’s investigations and therefore their cost.
The case was as follows: on 20 January 2015, Mr R. H.,50 the complainant, asked Google’s Swedish subsidiary (Google Sweden AB) to remove seven links which appeared in the Google Searches search index. Google refused to remove five of these links arguing that as they contained information concerning the complainant’s professional life, they were of interest to the public.
Mr H. then applied to the court to order Google Inc and Google Sweden AB to dereference websites on which articles concerning him were published.51 The complainant who had been the Chairman and Chief Executive of a building company, which had since gone bankrupt, claimed in support of this request that the incriminated articles (three articles published in building magazines in 2010 and 2011, including one with the evocative title “a joker has been excluded from three building sites”)52 contained offensive information and were out of date. He also claimed that the links constituted processing of personal data within the meaning of the 1995 Directive which he had not consented to and that his interests in having his privacy protected overrode Google’s or a third party’s interest in having the incriminated links endure. In addition to an order for Google to remove the links, the claimant also claimed damages of 10,000 kronor (i.e. 1000 euros) and for his legal costs to be re-funded.
Google submitted that the application should be dismissed because Google’s Swedish subsidiary could not be considered to be responsible for the processing, since it had no control over it.53 The search engine’s American operator also disputed the fact that displaying the incriminated links in Google Search violated the Personal Data Act.54 The operator said
50 The complainant’s name is written as it must be, in full in the judgements. I have decided to only use the complainant’s initials.
51 Mr. R. H. appears not to have contacted the DI before he seized the court.
52 The magazines in question are Byggnadsarbetaren (Construction Worker) and Byggvärlden (Construction World).
53 Nor the possibility of taking down the Google search links which are managed by Google Inc.
54 Google deals at length with the balance of interests which it says the judge must carry out. From the point of view of the data subject, this involves the right to privacy and the right to the protection of personal data. Opposite, there is the right of net users to have access to the information as well as Google’s right to the freedom of expression and the freedom of trade.
This freedom seems to be closely connected (and conditioned by) Google’s interest in disseminating information and being perceived as being a reliable search engine from which reliable
that, in any event, the interests of the controller or third parties to whom the data was made accessible, overrode the complainant’s interest in having his privacy protected against infringements. Google also used a third argument, saying that Swedish law did not permit the courts to order search engine operators to stop referencing websites because it was not stated by the Personal Data Act.
Two questions, which are relevant for the main aspect of this study on how the Swedish courts help protect individuals against referencing by search engines, emerge from the analysis of the judgement:
the circumstantial question on how the interests in issue are weighed out and of the lawfulness of the incriminated processing (A) and the more general procedural question of the court’s jurisdiction to order search engine operators to de-index links which potentially infringe privacy (B).
A-Weighing up the interests in issue and the question of the lawfulness of the processing
The Swedish court drew on sources from Swedish law (the Personal Data Act and a judgment of the Swedish Supreme Court), the law of the European Union (the European Charter on Fundamental Rights, the ECJ’s case law and the guidelines of the Article 29 Data Working Party),55 as well as the law of the European Convention on Human Rights (the ECHR itself and the case law of the Court in Strasbourg).
The court began its considerations by establishing that the complainant had not consented to the processing which is required by Article 10 of the Swedish Personal Data Act. It then had to decide whether the processing was lawful under point f) of this same provision, which states that processing can occur if it is necessary “to perform the legitimate interests of the controller or of a third party to whom the data are communicated, if this interest outweighs protecting the privacy of the data subject”. This requires the court to weigh the complainant’s interest in having his privacy and personal data protected against Google’s interest in having the search results displayed in the search index and the public’s interest in having access to
information is accessible. Google also mentions the interest to publishers in having their information searched on the Internet as well as the interests of the press (reviews periodicals) in publishing the information.
55 Guidelines on the Implementation of the Court of Justice of the European Union Judgment on Google Spain and Inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González”, C- 131/12,14/EN,WP 225.
p 069
¼
https://blogdroiteuropeen.comTHE RIGHT TO BE FORGOTTEN IN SWEDEN
this information whilst making a search using the complainant’s name.
The Court took points 81 and 97 of the Costeja judgment as the starting point for its assessment, where it is stated that in principle the data subject’s fundamental rights under Articles 7 and 8 of the Charter override the economic interest of the operator of the search engine and the interest of the general public in finding the referenced information, yet this is not always the case. Indeed, there can be special reasons, such as the public role played by the person, which justify interfering in this person’s fundamental rights because of the public’s overriding public interest to have access to the information in question, through its inclusion in the list of results.
After stressing that a person’s right to have his or her privacy and personal data protected must be respected, the court56 then underlined the crucial nature of the freedom of expression (which includes the right to receive and to disseminate information) as a fundamental pillar of democracy.57 Emphasising the importance of the public’s confidence in the reliability of the search results supplied by Google Search or any other search engine, the Swedish court then put more focus on the nature of the complainant’s public figure.
This was the main criterion which the Swedish court used in the rest of its reasoning, the special reason within the meaning of the Costeja case law which justifies Google’s referencing of the incriminated links.
The Court deduced the complainant’s capacity as a public figure, because it was established that he was the CEO of the construction company, which was cited in the incriminated articles when they were published. It also considered this capacity because the complainant had continued to be actively involved in business, as he is also the owner of a company. The court stressed that although the claimant had ceased his activities in the building sector, this had no impact on its assessment.58
However, although there is no doubt that M. H. has a role in public life as a businessman, it seems debatable to immediately assert59 that the complainant is a public figure. This concept, which is more limited than the concept that he has a role in public life, and which it therefore is a “subgroup” of, normally applies to
“individuals who, due to their functions/commitments,
56 P. 18-19
57 In the enacting part of the judgment.
58 P.19.
59 Unless one considers that the publication of the articles themselves gave the complainant the capacity of a public figure which is circular logic.
have a degree of media exposure” according to the Guidelines of the Article 29 Data Working Party. These guidelines also refer to the definition in Resolution 1165 (1998) the Parliamentary assembly of the Council of Europe on the right to privacy, which states “Public figures are persons holding public office and/or using public resources and, more broadly speaking, all those who play a role in public life, whether in politics, the economy, the arts, the social sphere, sport or in any other domain”.
In any event, the court would have been better off avoiding opening itself up to criticism on such a crucial part of its reasoning by simply referring to the complainant playing a role in public life, as this would have been sufficient with regards to the weighing up required under points 87 and 91 of the Costeja judgment.60
At the very least, it would have been desirable for the court to have, on this precise point, referred to the definitions of a public figure and involvement in public life in the guidelines of the Article 29 Data Working Party.61
The Court also examined the nature of the incriminated information and the context in which it was published.
It considered two types of information separately:
firstly, information which connects the complainant to the incriminated companies and secondly, information concerning the complainant’s alleged dealings with a criminal organisation. Concerning the first information, the court found that this information did not relate to privacy or to the complainant’s family life. The judge also noted that the information concerning the complainant’s function as CEO of the incriminated companies and their bankruptcy is indisputable and correct and is therefore an argument for considering that the processing is lawful. By so doing, the judge, although referring to the allegations of fraud, omitted to pronounce on their truthfulness although Google had, on this point and the others, carried out detailed searches on all the aspects of M.H’s dereferencing demand, and had referred to the size of the complainant’s outstanding debts, and the tax issues overshadowing this in its arguments.
The Swedish court begins its assessment of the information on the complainant’s alleged connections with a criminal organisation by acknowledging that such information could harm the complainant’s reputation.
However, it cites the case law on the freedom of
60 See supra.
61 It should be noted that Google sometimes refers to the complainant’s capacity as a public figure and sometimes to his role in public life.
PART 1: THE DOMESTIC IMPLEMENTATION OF THE GOOGLE SPAIN CASE
¼
https://blogdroiteuropeen.com p 070PART 1: THE DOMESTIC IMPLEMENTATION OF THE GOOGLE SPAIN CASE
THE RIGHT TO BE FORGOTTEN IN SWEDEN
expression of the European Court of Human Rights62 to argue that the claimant’s privacy has not been violated.
In fact, the Swedish court refers to judgments where the court in Strasbourg considered that the publication of information whose veracity had not been confirmed, was not a breach of Article 8 of the ECHR if the data subject had been given the chance of commenting on the information in question.
The Swedish court established in this case that the press article which had been criticised by the complainant clearly mentioned that it was impossible to establish that he had had contacts with the criminal organisation in question and that it was also impossible to prove that threats made against City Hall employees were connected to the complainant.
The court also found that the complainant had been given the chance of answering the allegations in the press article and of denying them.
The court also stressed, as a factor which had to be taken into account, that the incriminated information had been published with a journalistic purpose in a review which was dedicated to investigative journalism, and which Google had provided evidence of.63
Given the context of the publication, the court found that the information the complainant complained about could be of significant interest to the public especially as it was fairly recent information64 and concerned a person who was still active in the world of business.
The Court concluded that it resulted from the balance of interests in the case that the interests of Google and the third parties to be able to disseminate and have access to the information contained in the incriminated press articles overrode the complainant’s right to the protection of his privacy and his personal data.
Consequently, Google’s inclusion of links in its search results which were incriminated by the complainant did not constitute an unlawful processing of personal data. Having reached this conclusion, the court said that there was no need to consider whether the court had the jurisdiction to pronounce an order to end the referencing. However, this procedural issue which had been disputed by the defendant (Google) is of interest to us because it is crucial for assessing the extent of
62 Notably the judgment of White v. Sweden.
63 Google prepared its defence by making searches in reviews in which the incriminated articles had been published, and about the journalist who had written some of them. As the journalist was a reputed journalist who had been nominated for a number of awards, Google concluded that the articles had been published in a serious journal.
64 Here the Court compared the 5-6 years which have passed since publication in this case and the 16 years in the Costeja case.
the protection which people affected by referencing receive from national courts and beyond this, for assessing the effectiveness of the Swedish protective mechanisms with regards to the requirements laid down by European Union law.
B-The issue of the dereferencing order by the Swedish court
As stated above, Mr R.H had asked the court to order Google to dereference sites with the disputed information. He argued that as it was the controller, it was obliged under the Personal Data Act, “to take the necessary measures in order to correct, block or destroy the personal data which are incorrect or incomplete with regards to the purposes of the processing”. He also stated, referring to the Costeja judgment, that the controller can be ordered to take such measures if they have not been set up voluntarily.65The complainant also claimed that in accordance with the preparatory works (concerning the transposition of the 1995 Directive into Swedish law) “an individual has a right to bring an action before the court or the Datainspektion, for another individual to be ordered to remove links (sic!).66 However, the Internet search engine operator disputed the request for an order by arguing that there was no legal basis for such a power. Google said that this right for an order only existed for a breach of contractual obligations, or if it was stipulated by legislation, which is not the case here, as this power had not been inserted into the Personal Data Act. Google rejected the complainant’s interpretation of the preparatory works, considering that they refer exclusively to the Datainspektion’s power to pronounce a prohibiting order, subject to a fine.67
In his reply, the complainant points out, without developing the argument further, that “a private person cannot count on the Datainspektion taking his
65 Point 77:“Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.”
66 P.6.
67 The controversial passage in the preparatory works is as follows: “if there is a disagreement between the controller and the data subject on whether the data should be corrected or not, the data subject can refer the matter to the Data Protection Authority which can pronounce an Order subject to a fine if the law is not respected and ask [the court] to destroy the data or to bring a legal action concerning this before the court”. The complainant interpreted this phrase as giving the data subject the right to bring an action before court for an Order, while the defendant considers that the passage in the preparatory works which Mr H refers to only concerns the jurisdiction of the Datainspektion to pronounce a prohibition subject to a fine”.
1997/98:44 Personuppgiftslag, p.132.
p 071
¼
https://blogdroiteuropeen.comPART 1: THE DOMESTIC IMPLEMENTATION OF THE GOOGLE SPAIN CASE
THE RIGHT TO BE FORGOTTEN IN SWEDEN
case on his behalf because it decides which cases it handles itself”, and “for this reason a private person must be able to bring an action before the court”.68 Besides the legal arguments of a purely national nature which I do not take a position on,69 one might consider that the arguments concerning the effectiveness of the implementation of European law could be emphasised.
If the Datainspektion is under no obligation to follow up a complaint and to use its authority to order processing to stop, and furthermore, the courts lack
If the Datainspektion is under no obligation to follow up a complaint and to use its authority to order processing to stop, and furthermore, the courts lack