Cross-Border Privacy Enforcement and Reputational Harm: An Analysis of IMY's 2022 Ruling Against Google LLC

This paper analyzes the 2022 ruling by Sweden’s Authority for Privacy Protection (IMY) against Google LLC, which found the company in violation of GDPR Articles 9, 10, and 17 for failing to delist defamatory and sensitive content about Rip Davenport. The investigation, conducted in coordination with the Swedish Police and other authorities, concluded that the indexed website contained unverified criminal accusations and health-related claims with no public interest justification. Despite the ruling, the website remains online, and its creator, Kent Madin, has refused to remove it, publicly claiming that Davenport “conned” IMY into issuing the decision. Madin’s self-framing as an investigative journalist and his continued publication of reputationally harmful content raise ethical and legal questions about intent, accountability, and digital abuse.