The Spanish Agency for Data Protection (AEPD) has communicated the resolution of the procedure initiated against the company Google LLC in which it declares the existence of serious infractions against data protection regulations and imposes a penalty of 10 million euros on the company. transfer of data to third parties without legitimacy to do so and hinder the right of deletion of citizens (articles 6 and 17 of the General Data Protection Regulation).
Google LLC is responsible for the analyzes and treatments carried out in the USA. In the case of the communication of data to third parties, the Agency has verified that Google LLC sent to Proyecto Lumen information on requests made by citizens, including their identification, email address, the alleged reasons and the requested URL. The mission of this project is to collect and make content removal requests available, for which the Agency considers that, given that all the information contained in the citizen's request is sent so that it includes data accessible to the public in another database and for it to be disclosed through a website, "means in practice to frustrate the purpose of exercising the right of suppression."
The resolution recognizes that this communication of data by Google LLC to the Lumen Project is imposed on the user who intends to use this form, without opting for it and, therefore, if there is valid consent for this communication to be raised. in cape Establishing this condition in the exercise of a right recognized to the interested parties is not covered by the General Data Protection Regulation as it generates "an additional treatment of the data on which the deletion request is based when communicating them to a third party. ”. Likewise, in the privacy policy of Google LLC, there is no mention of this processing of personal data of users, nor does it appear among the purposes of the communication to the Lumen Project.
The AEPD also includes in its resolution that, it presented the request for content removal and complied with the right, that is, once the deletion of personal data was agreed, "there is no further treatment of the same, as is the communication that Google LLC makes to the Lumen Project.
Regarding the exercise of citizens' rights, the AEPD detailed in its resolution that "it is difficult to deduce whether the request is formulated invoking the personal data protection regulations, simply because this regulation is not mentioned in any of the forms, regardless of the reason that the interested party selects from among the proposed options, except in the form called 'Withdrawal under EU privacy law', the only one available that contains an express reference to this regulation”.
The system designed by Google LLC, which leads to interest through several pages to learn how to complete your request, requires you to previously mark the options it offers, "you can cause this finer by marking an option that suits the reasons you consider appropriate has known interest, but that separates you from your original intention, which may be clearly linked to the protection of your personal data, unaware that these options place you in a different regulatory regime because Google LLC has wanted it that way or that your request will be resolved according to the internal policies established by this entity”. The Agency's resolution recognizes that this system is equivalent to "and at the discretion of Google LLC the sober decision to apply and when not the RGPD, and this would mean accepting that this entity can avoid the application of the personal data protection regulations and, more specifically for this case, accept that the right to suppress personal data is conditioned by the content elimination system designed by the responsible entity”.
In addition to the economic sanction imposed in the resolution, the Agency has also required Google LLC to adapt to the personal data protection regulations the communication of data to the Lumen Project, and the processes of exercise and attention to the right of suppression, in in relation to requests to remove content from their products and services, as well as the information they offer to their users. Likewise, Google LLC must eliminate all personal data that has been the subject of a request for the right of suppression communicated to the Lumen Project, and has the obligation to as well as the latter to suppress and cease the use of the personal data that it has release
