It’s a veritable drop in the bucket compared to Google’s financial might, but the order issued to the US tech giant in Sweden to pay $8 million for violating EU’s General Data Protection Regulation (GDPR) is still one of the highest related to this legislation – and is also significant for another reason.
The case revolving around the controversial right to be forgotten rule that was first introduced in Spain in 2014. Under it, search engines must deindex links to obsolete negative private information if a person to whom it relates makes such a request.
At the same time, these web pages remain available on the sites that published them. And the GDPR, passed in 2018, additionally strengthened consumer protections around this issue.
Google and its supporters oppose this regulation.
Nevertheless, the company has complied with about 45 percent of the “millions” of right to be forgotten requests it has received to date.
The Swedish fine imposed on Google in this case, when compliance was missing or insufficient, didn’t come from a court but from the country’s Data Protection Authority (DPA).
And although the penalty is objectively low, the decision stands out for one detail: Google has also been ordered to stop letting websites know that their links have been removed from search results.
DPA found Google in breach of the rules as it failed to fully and in time deindex URLs of certain web pages.
But the company’s practice of notifying those whose links have been removed about it, and about who submitted the request, is also a violation of the spirit of the right to be forgotten, the Swedish regulator said.
One of the reasons Google is so diligent in informing website operators about link removals might be that these sites invariably end up publishing stories about it – and while these eventually also have to be delisted, they still give exposure to the issue in a way Google prefers to have it presented.
But DPA’s concern is that when they know a URL has been blacklisted, websites can publish the same content on another page.
“Google does not have a legal basis for informing site owners when search result listings are removed, and furthermore gives individuals misleading information by the statement in the request form,” DPA said.
