Google Belgium SA Fined for violating the right to be forgotten Summary A Belgian citizen, who is well-known in Brussels The Belgian DPA found that Google LLC, of which Google and has held various high-ranking positions in Belgium is a subsidiary, could be considered the data the energy sector, filed a complaint to the Belgian controller and asserted its competence to take action Data Protection Authority (DPA) concerning the against Google Belgium, arguing that the activities of delisting of 12 URLs from Google’s search results. The the two entities were inextricably linked. complainant argued that the links, which presented the complainant as affiliated with a political party and The DPA noted that the one-stop-shop mechanism, included outdated information about an unfounded which allows companies operating across multiple harassment complaint, were detrimental to his honor EU member states to deal with only one supervisory and reputation. Google responded by removing one authority for their cross-border processing activities, link, stating that another could not be accessed, and did not apply in these circumstances. Had this been refusing to block the remaining links. The complainant the case, the Irish DPA would have assumed the role did not receive noteworthy information as to how this as lead supervisory authority since Google Ireland Ltd. decision was justified by Google. is Google’s main establishment in the EU. However, the one-stop-shop mechanism did not apply for A substantial part of the case was concerned with two reasons. Firstly, the DPA argued, since the data determining whether Google Belgium SA (Google processing in question did not concern cross-border Belgium), Google Ireland Ltd. (Google’s main activities, and secondly, since Google Belgium’s establishment in the EU) or Google LLC, established in counsel had confirmed that Google Ireland Ltd. was California, should be considered the data controller. The not involved in the processing activities related to issue raised complex questions on the territorial scope of the complaint. Instead, the DPA argued that the GDPR the GDPR and became the determining factor in why the applied to Google LLC, and that Google Belgium as an historic fine was ultimately annulled by an appeals court. establishment of Google LLC triggered the applicability of the GDPR under Article 3(1). Decision of the Belgian DPA On the requests for dereferencing The Belgian DPA fined Google Belgium SA 600,000 EUR, The Belgian DPA found the search results relating to based on the annual turnover of its parent company, the harassment to be outdated and having potential Alphabet, for the following violations: prejudicial impact on the complainant’s professional • Breaching the complainant’s right to be forgotten and private life. The DPA concluded that Google and inadequately balancing the complainant’s Belgium had infringed the complainant’s right to be rights and interests against Google’s legitimate forgotten as well as his right to information by refusing interests in processing the relevant personal data to dereference the search results. However, the links (GDPR, Articles 17(1)(a) and 6(1)(f)) (500.000 EUR). relating to the political affiliation of the complainant were deemed able to remain online due to their • Failing to provide the complainant with sufficient continuing public relevance. information regarding the decision not to dereference the relevant links (GDPR, Article 12) (100.000 EUR). On the issue of competence Published: 30-06-2021 Journal number: 2020/AR/1111 Tags: 01 Legal basis and principles of processing, 07 Scope of the GDPR 70