Netherlands

[NL] Court orders Google Inc. to remove search results concerning a lawyer’s criminal conviction in 2012

IRIS 2016-7:1/25

Karlijn van den Heuvel

Institute for Information Law (IViR), University of Amsterdam

The District Court of Rotterdam has ordered Google Inc. to remove two hyperlinks from its “.nl” and “.com” search engine that refer to a blog post about the applicant’s foreign conviction in 2012 for illegal possession of a weapon.

The applicant worked as a lawyer outside the Netherlands in 2012 and 2013. In 2012 he was criminally convicted of illegal gun ownership and given a suspended prison sentence and community service. A local blogger wrote about the judgment, thereby disclosing the applicant’s name and picture. This blog post could be found on Google Search by entering the applicant’s name. In 2015 Google declined the applicant’s request to remove this search result.

The Court established that this case concerns the processing of personal data. The Court found Google Inc. to be the controller of the personal data, because it decides the purposes and means of the processing. Furthermore it held that it is sufficiently established that Google Inc. uses automatic equipment situated in the Netherlands. The application against Google Netherlands is inadmissible because they are not the controller, and therefore do not process personal data: their role is focused on sales support.

The applicant’s primary argument was that the processing is unlawful because it concerns sensitive personal data, namely criminal data, and that none of the exceptions to the prohibition on processing sensitive data apply (Articles 16, 22 and 23 of the Dutch Data Protection Act). Google argued that the URLs cannot be qualified as criminal data, and that the substantive assessment of the application only covers the search results and not the content of the websites that are listed. The Court rejects this defence. The request concerns sensitive data that may not be processed unless an exception applies, which is not the case in this instance. The removal request of the applicant must therefore be granted. The Court stated that it is aware of the profound implications of this finding for the processing of criminal data by search engine operators, but that the conclusion is inevitable.

The applicant’s subsidiary claim was that the processing was incompatible with data protection legislation, and that the processing violated Articles 7 and 8 of the EU Charter of Fundamental Rights (the right to private life and data protection, respectively). In addition, the Court observes that applicant’s request would also have been granted on this subsidiary basis. Explicitly referring to the CJEU judgment in Google Spain v Mario Costeja Gonzaléz (see IRIS 2014-6/3), the Court considers that the applicant’s “right to be forgotten” weighs more heavily than Google’s interest to produce a relevant search result and the public interest to find such results. The Court rejected Google’s argument that the applicant’s capacity as a lawyer was of special weight, because it is excessive to assume that every lawyer has such a role in society that the public must always be aware of any criminal conviction. Of relevance was that the conviction did not relate to the applicant’s professional abilities. The Court also attached weight to a “conviction spent” declaration submitted by applicant, which indicated that he was given a “clean slate” by the authorities in the foreign jurisdiction.