You are here:

Key facts of the case:

 

X had requested that Google Finland and Google Inc. remove the links to two web addresses from the results obtained from a search made in Google Search on the basis of X’s name. The internet pages in question contained information relating to X’s state of health and the fact that he had been submitted to a psychiatric assessment and had been sentenced to imprisonment for murder committed in a state of diminished responsibility, due to his health condition. Google Finland and Google Inc. denied X’s request. X brought the matter to the attention of the Data Protection Ombudsman, who ordered Google Finland and Google Inc. (the controller) to remove the two links (decision of 3.12.2015). Google Finland and Google Inc. refused to do so, with reference to freedom of expression and the interest of the public in having access to information and in discussing punishment and diminished responsibility in the case of serious violent offences. In its decision, the Supreme Administrative Court examined the fair balance between the data subject’s right to privacy and protection of personal data on the one hand and the public interest on the other. The decision was based on the Personal Data Act (523/1999), which also incorporates the provisions of the Data Protection Directive 95/46/EC into national law.

Key legal question raised by the Court:

According to the Personal Data Act, the personal data processed must be necessary for the declared purpose of the processing (section 9(1)) and the controller has a duty to erase any unnecessary personal data (section 29(1)). The key legal question before the Supreme Administrative Court was whether the two links in the name-based search results were necessary within the meaning of the Personal Data Act and whether the controller (Google Inc.) could be ordered to remove the links from the search results.

Outcome of the case:

In interpreting the Personal Data Act, the Supreme Administrative Court referred to the CJEU ruling in the case C-131/12 (Google Spain and Inc v Agenda Española de Protección de Datos (AEDP) and Mario Costeja González) in which the CJEU held that the data subject’s fundamental right to privacy and the protection of personal data override, as a general rule, the interest of the general public to have access to personal data through a name-based search. However, a fair balance should be sought between these rights and interests. That balance may depend on the nature of the information in question and its sensitivity and on the interest of the public in having that information. The latter may vary, according to the role played by the data subject in public life.

X had been sentenced to imprisonment of ten years and six months for murder committed in a state of diminished responsibility. Under section 11 of the Personal Data Act, the processing of sensitive data is prohibited. Personal data relating to the state of health of a person or to a criminal act, punishment or other criminal sanction is deemed to be sensitive. However, the Supreme Administrative Court held that although the said data was sensitive, X could be considered to play a role in public life because of the nature of his crime. On the other hand, sensitive personal data related to a person’s physical or mental health is within the inner core of the right to respect for private life. Furthermore, the two web pages in question could be found and accessed through the search engine also without making a search based on X’s name. In the opinion of the Supreme Administrative Court, removing the links to the two web addresses from the results obtained from a search made on the basis of X’s name could not be considered to limit the possibilities of the public to participate in societal debate or exercise their freedom of speech. The interest of the public did thus not override X’s right to privacy and protection of personal data. The two links in the search results, which Google Inc. had been requested to remove, were not necessary, within the meaning of the Personal Data Act, as regards the purpose of the processing of data by Google Inc. The Supreme Administrative Court concluded that, taking into account the relevant national provisions, Articles 7, 8 and 11 of the Charter, Articles 8 and 10 of the ECHR, Article 7(f) of the Data Protection Directive, and the evidence presented before the court, Google Inc. could be ordered to remove the two links from the search results.