The Swedish data protection authority has imposed a fine of almost 7 million euros on the internet company Google LLC in the course of a follow-up audit. The company had not fully implemented an earlier order in two cases from 2017, which involved the removal of several fixed entries from Google's search results. The offending search listing results had constituted unlawful processing of special categories of personal data and data relating to criminal convictions and offences, which is why the data subjects had obtained its deletion.
Google did not comply with this order insofar as in one case the URL concerned was interpreted too narrowly and deleted, which is why not the complete (forum) entry was deleted, but only one page of it.
In the second case, the authority objected to the fact that the relevant search results were not removed from the listing within the set deadline. Furthermore, the authority considers the deletion to be invalidated by a common practice of the group, as it sends users of its own webmaster tool information about when a URL of the website operator is removed from the Google listing. This in turn gives the webmaster the opportunity to upload the affected information again via a changed URL, which is then also recorded by Google again. The notification also contains the removed web address and an indication of who initiated the deletion. This allows drawing conclusions about the identity of the data subject and, according to the authority, constitutes unlawful processing, as the data subject has not given consent to the processing of his or her personal data for this purpose.
Addendum of 23 November 2020:
The Stockholm Administrative Court has ruled on Google's complaint against the fine that the violations found by the supervisory authority were true. However, the court considered that the amount of the fine was unreasonable and reduced the amount from the original SEK 72 million to SEK 52 million.