ECLI:FI:KHO:2018:112

The Data Protection Ombudsman had ordered the controller, Google Inc., to erase two URL search results from the Google Search results that became available due to searches made in the name of the person who demanded that the search results be erased (the applicant). One search result link was directed to an Internet discussion forum that indicated the applicant’s name, the syndrome the applicant had been diagnosed with, the murder sentence imposed on the applicant and its duration, and the fact that the applicant had undergone a psychiatric examination during which the applicant was found to be in a state of diminished responsibility. The other search result link was directed to a news and media content service that mentioned the applicant’s name, the duration of the murder sentence, and the fact that the sentence was imposed with reduced criminal responsibility.

The matter involved an assessment of whether the URL search results were unnecessary personal data with regard to the purpose of the processing by the controller, as referred to in the Personal Data Act, and whether it was permissible to order that they be erased.

Judgment of the European Union Court of Justice C-131/12, which is related to the right to be forgotten, finds that a data subject’s rights, referred to in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, override, as a rule, the interest of the general public in finding that information upon a search relating to the data subject’s name. However, a fair balance should be sought between these interests and rights, which may depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information. The latter interest may vary, in particular, according to the role played by the data subject in public life.

The applicant had been sentenced for murder committed in a state of diminished responsibility to ten years and six months of imprisonment. The offence was extremely serious and could be deemed to have occurred fairly recently, considering the date of issue of the Data Protection Ombudsman’s decision. Although the details on the criminal act and punishment were, as such, sensitive personal data referred to in the Personal Data Act, the applicant was, in the circumstances described above, deemed to have had a role in public life relevant in terms of the consideration of interests between the right to privacy and freedom of speech, referred to in Judgment of the European Union Court of Justice C-131/12.

In the consideration of interests, it had to be taken into account that, on the one hand, the data obtained through the search results ordered erased about the applicant’s health and state of mind comprised sensitive personal data in the core area of the right to privacy, referred to in the Personal Data Act. It was also relevant for such consideration that the Internet sites referred to in the search results could be found by using the search engine, in ways other than on the basis of a search made specifically with the applicant’s name. All in all, erasure of the search results could not be deemed to limit the public’s actual possibility for social discussion or other exercise of the freedom of speech.

In the circumstances described above, the public’s interest to obtain sensitive data concerning the applicant’s health and state of mind did not override the applicant’s right to protection of privacy and personal data. It was permissible to order that the search results be erased.