Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 11 - Freedom of expression and information
Key facts of the case:
X had requested that Google Finland and Google Inc. remove the links to two web addresses from the results obtained from a search made in Google Search on the basis of X’s name. The internet pages in question contained information relating to X’s state of health and the fact that he had been submitted to a psychiatric assessment and had been sentenced to imprisonment for murder committed in a state of diminished responsibility, due to his health condition. Google Finland and Google Inc. denied X’s request. X brought the matter to the attention of the Data Protection Ombudsman, who ordered Google Finland and Google Inc. (the controller) to remove the two links (decision of 3.12.2015). Google Finland and Google Inc. refused to do so, with reference to freedom of expression and the interest of the public in having access to information and in discussing punishment and diminished responsibility in the case of serious violent offences. In its decision, the Supreme Administrative Court examined the fair balance between the data subject’s right to privacy and protection of personal data on the one hand and the public interest on the other. The decision was based on the Personal Data Act (523/1999), which also incorporates the provisions of the Data Protection Directive 95/46/EC into national law.
Key legal question raised by the Court:
According to the Personal Data Act, the personal data processed must be necessary for the declared purpose of the processing (section 9(1)) and the controller has a duty to erase any unnecessary personal data (section 29(1)). The key legal question before the Supreme Administrative Court was whether the two links in the name-based search results were necessary within the meaning of the Personal Data Act and whether the controller (Google Inc.) could be ordered to remove the links from the search results.
Outcome of the case:
In interpreting the Personal Data Act, the Supreme Administrative Court referred to the CJEU ruling in the case C-131/12 (Google Spain and Inc v Agenda Española de Protección de Datos (AEDP) and Mario Costeja González) in which the CJEU held that the data subject’s fundamental right to privacy and the protection of personal data override, as a general rule, the interest of the general public to have access to personal data through a name-based search. However, a fair balance should be sought between these rights and interests. That balance may depend on the nature of the information in question and its sensitivity and on the interest of the public in having that information. The latter may vary, according to the role played by the data subject in public life.
X had been sentenced to imprisonment of ten years and six months for murder committed in a state of diminished responsibility. Under section 11 of the Personal Data Act, the processing of sensitive data is prohibited. Personal data relating to the state of health of a person or to a criminal act, punishment or other criminal sanction is deemed to be sensitive. However, the Supreme Administrative Court held that although the said data was sensitive, X could be considered to play a role in public life because of the nature of his crime. On the other hand, sensitive personal data related to a person’s physical or mental health is within the inner core of the right to respect for private life. Furthermore, the two web pages in question could be found and accessed through the search engine also without making a search based on X’s name. In the opinion of the Supreme Administrative Court, removing the links to the two web addresses from the results obtained from a search made on the basis of X’s name could not be considered to limit the possibilities of the public to participate in societal debate or exercise their freedom of speech. The interest of the public did thus not override X’s right to privacy and protection of personal data. The two links in the search results, which Google Inc. had been requested to remove, were not necessary, within the meaning of the Personal Data Act, as regards the purpose of the processing of data by Google Inc. The Supreme Administrative Court concluded that, taking into account the relevant national provisions, Articles 7, 8 and 11 of the Charter, Articles 8 and 10 of the ECHR, Article 7(f) of the Data Protection Directive, and the evidence presented before the court, Google Inc. could be ordered to remove the two links from the search results.
In the “right to be forgotten” ruling C-131/12 the CJEU held that the data subject’s fundamental right to privacy and the protection of personal data, as provided for in Articles 7 and 8 of the EU Charter of Fundamental Rights, override, as a general rule, the interest of the general public to have access to personal data through a name-based search. However, a fair balance must be sought between these rights and interests. That balance may depend on the nature of the information in question and its sensitivity and on the interest of the public in having that information. The latter may vary, among other things, according to the role played by the data subject in public life.
…
For the above reasons and taking into account the grounds of the decision of the administrative court, the search results, which had been ordered to be removed, must be considered to be unnecessary for the declared processing of personal data, in the meaning of sections 9(1) and 29(1) of the Personal Data Act.
Therefore, and taking into account the legal provisions mentioned in the decision of the administrative court as well as Articles 7, 8 and 11 of the EU Charter of Fundamental Rights, Articles 8 and 10 of the ECHR, Article 7(f) of the Data Protection Directive 95/46/EU, and the claims and evidence presented before the Supreme Administrative Court, there are no grounds for amending the decision made by the administrative court.
Oikeuteen tulla unohdetuksi liittyvässä Euroopan unionin tuomioistuimen tuomiossa C-131/12 on katsottu, että Euroopan unionin perusoikeuskirjan 7 ja 8 artiklassa tarkoitetut rekisteröidyn oikeudet syrjäyttävät lähtökohtaisesti suurella yleisöllä olevan intressin saada rekisteröidyn henkilötietoja hänen nimellään tehtävän haun perusteella. Näiden oikeuksien ja intressien välillä on kuitenkin pyrittävä löytämään oikeudenmukainen tasapaino, joka voi riippua kysymyksessä olevien tietojen luonteesta ja niiden arkaluonteisuudesta rekisteröidyn yksityiselämän kannalta sekä yleisöllä olevasta intressistä saada kyseiset tiedot käyttöönsä. Jälkimmäinen intressi voi olla erilainen muun muassa kysymyksessä olevalla henkilöllä julkisuudessa olevan aseman perusteella.
Edellä lausutuista syistä ja kun muutoin otetaan huomioon hallinto-oikeuden päätöksen perusteluissa lausutut seikat, poistettaviksi määrättyjen hakutulosten on katsottava olevan henkilötietolain 9 §:n 1 momentissa ja 29 §:n 1 momentissa tarkoitetulla tavalla henkilötietojen käsittelyn tarkoituksen kannalta tarpeettomia henkilötietoja.
Tämän vuoksi ja kun otetaan huomioon hallinto-oikeuden päätöksessä mainittujen oikeusohjeiden lisäksi Euroopan unionin perusoikeuskirjan 7, 8 ja 11 artikla, Euroopan ihmisoikeussopimuksen 8 ja 10 artikla ja tietosuojadirektiivin 95/46/EY 7 artiklan f alakohta sekä korkeimmassa hallinto-oikeudessa esitetyt vaatimukset ja asiassa saatu selvitys, hallinto-oikeuden päätöksen lopputuloksen muuttamiseen ei ole perusteita.
