Sweden Fines Google 7 Million Euros for GDPR Violations

• The Swedish Data Protection Authority is punishing Google for failing to honor multiple RTBF requests.
• The "right-to-be-forgotten" (RTBF) is a law that is meant to help people delist from search results.
• Google will appeal the decision, as they disagree with it on principle, so the case will continue in court.

Google has received a fine of €7,000,000 from the Swedish Data Protection Authority (Datainspektionen) for violating Articles 5, 6, and 17 of the General Data Protection Regulation (GDPR). According to the accompanying report, Google has failed to adequately comply with its obligations to remove specific search results, even after Swedish citizens specifically asked them to. Datainspektionen has specifically instructed Google to comply with the requests in 2017, but apparently, the search engine company ignored them.

The investigation continued throughout 2018, and the Swedish authorities also figured that Google chose to follow practices that don’t have any legal basis, like informing the website owners about who is behind a removal request. Thus, they are now asking Google to stop this practice, as it misleads individuals and possibly even hinders the procedure, as the citizens who submit removal requests may not wish to have their identities revealed. The “right-to-be-forgotten” (RTBF) law was introduced as a European law back in 2014 and was meant to help people delist from specific websites for any reason they may have.

The law applies to European search results, and the entries cannot be removed globally. So far, Google has received 2.4 million requests of this kind, 43% of which have been approved. Recently, the Court of Justice of the European Union (CJEU) considered a request by the French Data Protection Authority, which suggested that global deletion should be possible in certain cases. VPN tools can help anyone bypass IP location limitations and see the delisted results from anywhere, including European countries. The CJEU’s verdict is that global deletion shouldn’t be made possible and that it isn’t violating any privacy rights.

Of course, all of this is different from what Google is being accused of in Sweden, which is essentially negligence, the unilateral downgrading of the RTBF law, deterring people from exercising their lawful rights, and generally having tardy responses to all relevant requests. Google will now have a three-week window to appeal the fine, which is a path that they have already confirmed they are planning to take. Their laconic statement was that they disagree with this decision on principle and plan to appeal.