EU Reg May Not Clarify Right to Forget: Nordic DPAs

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Marcus Hoy

Feb. 4 — Data protection authorities in Norway, Finland, Sweden and Denmark have provided Bloomberg BNA with details of domestic cases resulting from the European Court of Justice's (ECJ) May 13, 2014 right to be forgotten ruling (C-131/12).

(Click image to enlarge.)

Nordic Flags

They also discussed the likely impact of the new European Union General Data Protection Regulation (GDPR)—which is due to be adopted by the European Commission early in 2016—on the right to be forgotten.

The ECJ's landmark ruling forced Google Inc. to delete search results found to breach a Spanish individual's privacy rights , and has since led to EU citizens requesting Google to delete thousands of other search results.

Requests to delete search data must initially be directed to Google's subsidiaries in EU member states, and European national DPAs are charged with ruling on cases where complainants are dissatisfied with the company's response. National DPAs can also be asked to rule on right to forget complaints that are unrelated to Google searches.

The GDPR states that data subjects should have the right to erase personal data if it is no longer necessary for the purposes for which it was collected, if subjects have withdrawn their consent, or if they object to the processing. This right is “particularly relevant when the data subject has given his or her consent as a child,” the regulation states. However, the GDPR further states that the retention of data should be deemed lawful where it is deemed to be in the public interest or necessary for exercising the right of freedom of expression or compliance with a legal obligation.

According to information published by Google, it has received 3,776 deletion requests from Denmark through the end of January, 4,480 from Norway, 10,372 from Sweden and 5,133 from Finland. Higher figures are also provided for requests from individuals “with a relationship to” these nations. Between 40 and 45 percent of deletion requests have been honored, according to Google.

Officials at the four Nordic DPAs said that ambiguity existed over when some deletion requests should be granted or whether the public interest should take precedence. Most agreed that the EU's forthcoming General Data Protection Regulation (GDPR) , which is scheduled to be adopted by the European Commission early in 2016, is unlikely to provide greater clarity in the area.

Swedish DPA Auditing Google

The Swedish DPA is auditing 13 cases in which Google rejected right to gorget requests, DPA Legal Advisor Martin Brinnen told Bloomberg BNA . The investigation will likely be completed in about two months, he said.

According to the Swedish DPA, Google was issued with a number of questions in May 2015 in conjunction with the audit. The company's response hasn't been made public

No statistics were available for number of right to forget requests received by the Swedish DPA, Brinnen said, as those complaints weren't differentiated from other privacy cases . However, he confirmed that the DPA hasn't yet issued a final ruling on any of the right to forget requests it has received.

Most DPAs in the Nordic region agreed that the EU's forthcoming General Data Protection Regulation is unlikely to provide greater clarity on right to be forgotten issues.

Brinnen estimated that the number of right to forget complaints filed with the office has decreased over the last six months.

The GDPR is unlikely to lead to greater certainty about right to forget issues, he said.

Henrik Bergstrom, a partner at Bird & Bird in Stockholm said that after the ECJ's ruling “we noticed a trend of increased awareness and requests in Sweden.” But it is unclear “whether this is an enduring trend,” he said, but predicted that that the number of requests will rise if the DPA finds in favor of complainants in its initial rulings.

Finland Rules on Cases

Finland's Data Protection Ombudsman (DPO) Reijo Aarnio said that his office had so far received and recorded about 80 right to forget complaints. The volume of complaints has stabilized after being initially flooded with calls.

Finland's Act on Administrative Process (434/200) requires the DPO to ask for Googlés opinion on appeals, he said, and in approximately one in three cases Google has reconsidered and agreed to remove the challenged links, Aarnio said.

“We have given our verdict in some ten cases” Aarnio told Bloomberg BNA. “Half of these have consisted of advice to the appellant and half have been actual verdicts. In at least two of the cases, which referred to sensitive data, we required Google to delete the links in question. Those verdicts are quite recent and thus we dońt know whether Google is going to appeal them to the Administrative Court”

The general right to be forgotten guidelines issued by the Article 29 Working Party of data protection officials from the 28 EU member states are helpful, he said, adding that the GDPR would “probably not mean any major changes” for cases in Finland.

Jesper Nevalainen, a Bird & Bird partner in Finland said the ECJ ruling “increased awareness and requests by citizens in Finland.” The ruling clarified the DPO's jurisdiction, previously it was unclear whether Google was subject to the Finnish law, he said.

“We believe that the number of requests to Google as well as other service providers and the DPO will increase along with the general awareness of data protection and citizens' legal rights,” Nevalainen said. “The GDPR will especially have an impact on citizens' rights and how they are used”.

Norway Notes Increase in Cases

Norway isn't an EU member but adheres to most EU law through its membership in the European Economic Area (EEA) and the right to forget ruling is therefore valid there.

Figures provided to Bloomberg BNA by the nation's DPA show that the authority received a total of ten right to forget complaints in 2014 and 21 in 2015. Nine complaints have been accepted for review over the two years, while 13 have been rejected.

Norway's DPA Legal Adviser Kim Ellersen said that the increase in cases in 2015 was likely due to an increased awareness of the appeal process. “There is certainly still some confusion among the public here, but I'm not sure of how the process could be made easier to relate to” he said.

The GDPR will have little any effect on how future right to forget cases are determined, Ellertsen said. The right to be forgotten reviews the office undertakes today are quite similar to that which is being proposed in the GDPR, balancing a legitimate interest in accessing material with individual privacy, he said.

Christopher Sparre-Enger Clausen, managing associate at Oslo-based Thommesson, told Bloomberg BNA that the relatively low number of appeals in Norway may be due to a lack of awareness that Google's decisions can be appealed to the DPA. It is likely that DPAs throughout the Nordic region are making right to forget appeal decisions in a fairly uniform way, he said.

Clausen criticized the lack guidance from the ECJ on how to balance individual privacy rights with the public interest in access to information. There “is undeniably a risk” that DPAs could interpret the right to be forgotten differently because of a lack of guidance, he said.

Denmark Has No Completed Cases

Cristina Gulisano, an official at the Danish DPA, told Bloomberg BNA that her agency hasn't ruled on any right to forget cases. “The Danish DPA has received a little more than 45 requests, and about 20 of those requests were based on rejections from the search engine,” she said.

“These types of cases are still causing some confusion for citizens, and not all requests are specifically about the deletion of search results” she said. “When we start making decisions in these cases, it might cause more awareness, resulting in more complaints.”

The Danish DPA hasn't made a detailed assessment of the General Data Protection Regulation other than noting that it specifically addresses the right to forget, she said.

To contact the reporter on this story: Marcus Hoy in Copenhagen at correspondents@bna.com

To contact the editor responsible for this story: Jimmy H. Koo at jkoo@bna.com