Persónuvernd (Island) - Case no. 2021101963

Summary

The Icelandic DPA ordered Google LLC to remove a search result containing a news article with an individual's personal data. The DPA ruled that the data subject's right to be forgotten superseded the public's interest in the information, as the data subject no longer held a position of public relevance and time had passed since the article's publication.

Full text

Help Persónuvernd (Island) - Case no. 2021101963: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 14:54, 18 January 2023 view sourceAK (talk | contribs)Bureaucrats, noContributionReport, Suppressors, Administrators274 edits Tag: Visual edit← Older edit Latest revision as of 14:37, 29 May 2026 view source Ap (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators661 editsm Tag: Visual edit Line 3: Line 3: |Jurisdiction=Iceland|Jurisdiction=Iceland |DPA-BG-Color=|DPA-BG-Color= |DPAlogo=|DPAlogo=LogoIS.png |DPA_Abbrevation=Persónuvernd|DPA_Abbrevation=Persónuvernd |DPA_With_Country=Persónuvernd (Island)|DPA_With_Country=Persónuvernd (Island) Latest revision as of 14:37, 29 May 2026 Persónuvernd - Case no. 2021101963 Authority: Persónuvernd (Island) Jurisdiction: Iceland Relevant Law: Article 17 GDPR Type: Complaint Outcome: Upheld Started: Decided: Published: 11.01.2023 Fine: n/a Parties: Google LLC National Case Number/Name: Case no. 2021101963 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Icelandic Original Source: Icelandic DPA (in IS) Initial Contributor: n/a The Icelandic DPA ordered Google LLC to remove a search result containing an article with a data subject's personal data due to the time that has passed since the events covered in the article occurred and the fact that the data subject no longer held a position of public relevance. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The data subject is an individual whose personal data was shared through a news article. As the news article was findable by a search query through Google's search engine, Google LLC being the controller, the data subject requested the controller to remove the search result from its database pursuant the data subject's right to be forgotten (Article 17 GDPR). Google denied the request, justifying it by the fact that the news article concerns the data subject's employment in a public setting, which is relevant for the public interest. Following Google's response, the data subject submitted a complaint to the Icelandic DPA. Holding In its decision, the DPA noted that it is necessary to assess the legality of the continued processing of the data subject's personal data by weighing the legitimate interests of third parties against the interests and fundamental rights of the data subject. In the case at hand, the financial interests of Google LLC related to its search engine as well as the public interest in being able to access the concerned information were weighed against the data subject's interest in privacy and data protection. For such an assessment, the DPA noted that it is particularly relevant if the concerned data subject is a public figure or if they hold a public position. Should that be the case, this may result in the data subject not enjoying the same privacy protection as private persons due to the importance of the freedom to discuss public matters openly. Although the data subject held a public position at the time when the news article was published, the data subject was not involved with projects of public importance at the time when the complaint was filed. Due to the amount of time that has passed since the events covered in the news article took place and due the fact that the data subject no longer retained a public decision, the DPA held that the data subject's interest in privacy superseded the public's interest in the information and Google LLC's financial interests. The DPA concluded that the controller should have removed the search result based on the data subject's right to be forgotten and ordered it to do so. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details. Solutions Display of search results in the Google search engine Case no. 2021101963 11.1.2023 In certain cases, people may have the right to have information displayed about them in search engines, e.g. on Google, will be removed. Although the results are removed from search engines, the content will still be on the Internet, but in some cases it is also possible to get it removed. In this case, it was considered that the complainant's privacy interests and his right to be forgotten outweighed the public's interest in having access to the said information about him. It was therefore proposed to Google LLC to remove certain websites from the search results for the complainant's name in the Google search engine. ---- Personal protection ruled in a case that dealt with the right of a person to have information about him deleted that was published in the search results of the Google search engine, when searching for the person's name. The conclusion of the Data Protection Authority was that, taking into account the circumstances of the case, the situation of the complainant and the time that has passed since the event discussed in the specified search results, the privacy interests of the complainant and his right to be forgotten were stronger and took precedence over the public's interest in having access to said information about the complainant. It was therefore also the conclusion of the Personal Protection Authority that Google LLC should remove the websites that the complaint covered from the search results for the complainant's name in the Google search engine. Given that the decision contains detailed information about the complainant, even if personal identifiers were erased, the Personal Protection Agency has decided not to publish the decision in its entirety. However, Personal Protection has compiled an extract from the ruling, which follows. A complaint was made about the publication of search results in the Google search engine, which referred to articles where the complainant was discussed. The articles discussed a unique incident where a complainant was involved, but nothing criminal took place. Google LLC denied the Complainant's request to remove the aforementioned search results on the basis that the information was related to the Complainant's employment status and his role in the public domain where the Complainant currently holds a management position. In Google's opinion, the personal information that appeared in the press coverage was still considered to serve the public interest. Personal protection considered that when assessing whether the complainant has the right to delete certain search results that appear when his name is entered into the Google search engine, it is first necessary to examine whether the processing of personal information that takes place during the use of the search engine is supported with authorization according to law no. 90/2018 on personal protection and processing of personal information. Secondly, it would have to be assessed whether the complainant has the right to receive the personal information, i.e. the links and the information that would be published with the search results, deleted on the basis of Article 20 of the same law, cf. also Article 17 of regulation (EU) 2016/679. The conclusion of the Personal Protection Authority states that it will not be seen that the said processing of personal information can rely on other sources in Article 9. Act no. 90/2018 but No. 6 of the provision. It stipulates that the processing of personal data is permitted if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, in particular when the data subject is a child. In the case, on the one hand, the financial interests of Google LLC related to the searc

Entities