Google ordered “Google My Business” entries to be deleted

On September 15, 2022, the Court of Justice of Chambéry (France) condemned Google France, Google USA and Google Ireland, citing multiple violations of the General Data Protection Regulation (GDPR). Delete a dentist’s Google My Business (GMB) listing. The three companies must also pay the dentist EUR 20,000 in compensation for her moral damage and EUR 20,000 for defense costs.

The decision comes from a French court, but represents a genuine interest for all those involved in GMB listings in Europeprovided that it is justified in detail and essentially based on the principles of the GDPR.

By entering his name in the Google search engine in 2017, a dentist discovered the existence of a GMB card about her, which includes her last name, address, an evaluation and opinions on her professional activity.

She sued Google for refusing to delete the listing and reviews. The dentist alleged breach of their personal data. The court agreed and considered the data processing to be unlawful due to the lack of a legal basis.

In this case, the personal data appearing in her GMB file was the dentist collected by a third party, namely Infobelwho picked her up from Orange. The dentist had not consented to the processing of her data by Orange as part of the publication of her contact details and the use of this data by Google to complete her GMB file. Consent cannot therefore serve as a legal basis for processing.

According to Google, consent was not required in this case because the processing of the data a legitimate interest. This derives from the public’s right to information, justified in particular by the criterion of the need to quickly find information related to a public health emergency.

But the court found that to be the case Google’s actual interest was linked to “a hidden commercial purpose”.. According to the court, the joint distribution of the leaflet and the announcements means for Google to strongly encourage professionals to use its services, whether free or paid. Google therefore claims in bad faith that the processing carried out in relation to the publication of the company newsletter is unrelated to its commercial prospecting..

The court then moved on balance the right to information and the right to data protection finally concluded that Google could not assert any legitimate interest in the processing of dentist data.

For Google to be able to enforce the right to information, it still had to be reliable and verifiable. However, anyone can publish an opinion anonymously, without the professional being able to ensure the reality of the facts. Google hasn’t set it up no measures to identify, where appropriate, the source of the information and its reliability.

This creates a “obvious imbalance between the professional and the userand the implications for that professional accountant can be significant.”. The court therefore sees a balancing act between Google’s legitimate interest in sharing the information and the rights and interests of the people whose data is being processed as absolutely misguided. Google has not taken any additional guarantees or other additional measures to achieve a balance between the rights and interests concerned. The court concludes that Google does not demonstrate a legitimate interest allow the individual’s consent to be overridden.

The court also held that Google, moreover, did not disregarded the principle of loyalty or the principle of transparency by not informing the dentist about the treatment, the rules or the guarantees and not allowing her to exercise her rights.

Consequently, the dentist is entitled to exercise her right to object to the processing of her data, given the lack of legitimate interest, but also due to the fact that Google carries out commercial prospecting actions.

This proves this verdict, which can be appealed The GDPR can be an effective legal basis in connection with the increasing number of litigations related to GMB listings and notices.

William Rue
Attorney Cairn Legal