Right to be forgotten: Google & the GDPR fine

We all make mistakes sometimes. But it is rare for a mistake to be so significant that it makes headlines. If that happens and your actions appear in Google search results, it is natural to want to contact Google to have them removed for privacy reasons. Unfortunately, it is not that simple.

The Right to Erasure with Google

The GDPR grants consumers the right to be forgotten under Article 17. If you no longer want companies to process your personal data, a written request to stop processing and delete the data is usually sufficient. However, with internet search engines—most notably Google—it is not that straightforward. While you can use Google's online data removal form and the European Court of Justice established the right for individuals to have links to personal information removed in its 2014 "Google ruling," the success of these requests depends on meeting specific criteria.

This ruling makes Google and other search engines responsible for the processing of personal data. They can therefore be required to remove links, but this does not happen automatically. Several laws intersect here, and each case requires a careful balancing act between:

• the General Data Protection Regulation (GDPR),
• the right to informational self-determination,
• the right to freedom of the press and expression, and
• the protection of personal rights.

Is a data protection lawsuit against Google therefore doomed to failure from the start? Not at all. However, the outcome of these proceedings can vary significantly from case to case, as the following examples show.

Google: GDPR Penalties & Fines

So far, there have only been a few cases in which private individuals have taken legal action to compel Google to remove links to search entries. Fines imposed on Google under the GDPR have been even rarer, but all the more severe.

The most groundbreaking rulings to date regarding the "right to be forgotten on Google" have been:

• A former head of a charitable organization sued Google, demanding the removal of various search results about him that mentioned his full name in connection with both his illness and his seven-figure debt. He lost the case, and the search results did not have to be deleted. The reason: according to the Federal Court of Justice (BGH), the balancing of interests between the individual's desire for deletion and the public's interest in information tipped in favor of the public. Furthermore, the reasoning behind the judgment stated that the same applied to the freedom of expression of the press outlets responsible for the linked newspaper articles.
• A convicted murderer also took legal action against the largest search engine. His name was still searchable in an online press archive regarding the murders; the reports on the crimes were fully accessible and readable among the top search results. His appeal to the Federal Court of Justice was dismissed, but a further appeal to the Federal Constitutional Court was permitted. The reasoning here: the so-called identifiable reporting diminishes over the years. The case occurred in 1982, and the court's decision was clear: "Only by allowing past events to recede into the background can individuals be given the chance for a fresh start in freedom. The temporality of freedom includes the possibility of being forgotten."
• In this third case, Google was hit with a hefty GDPR fine by the Belgian Data Protection Authority: the search engine operator was ordered to pay 600,000 euros. A citizen had taken action because he wanted to have search entries removed regarding old, demonstrably defamatory articles about himself. Google failed to comply, the man sued – and won. The GDPR fine was imposed on Google due to violations of Articles 17 and 12 of the GDPR.

These three cases demonstrate how differently courts rule in lawsuits against Google when it comes to deleting search results. According to consistent rulings by the ECJ, the basic requirements for obtaining the deletion of Google search results are as follows:

• The information contained in the link is outdated;
• The personal data or information in the link is of no interest to the public;
• The link contains personal data, the publication of which violates one's own personality rights,
• The personal data in the link is no longer relevant to its original purpose.

In 2019, the European Court of Justice also ruled that the right to be forgotten on Google applies within the EU, but not to the entire internet. Regardless of this, the Federal Constitutional Court emphasized the value of freedom of expression and freedom of the press once again in a ruling issued at the end of 2019: "The general right of personality does not grant a claim to have all personal information (...) removed from the internet. In particular, there is no right to filter publicly accessible information according to one's own free choice and solely based on one's own ideas, or to limit it to aspects that the affected parties consider relevant or appropriate for their own personal image."

The chances of winning such a lawsuit are therefore not high, but they do exist. However, it is very rare for Google to be ordered to pay a fine. That is why, once again, before you do something foolish that you might regret in a few years: don't do it! Or make sure no one is watching.