The right to be forgotten is the result of a long jurisprudential development and is today expressly regulated by EU Regulation no. 679/2016 on personal data protection (the so-called GDPR) under Art. 17, which provides for the data subject's right to obtain the erasure of personal data concerning them, with the corresponding obligation arising for the data controller. Among the most significant exceptions to this right, which entails a delicate balance of conflicting interests, is the right to freedom of information. The recent judgment of the Supreme Court of Cassation of November 24, 2022, no. 34658, offers an opportunity to analyze how the balancing between constitutionally protected rights operates in practice, as well as the territorial boundaries of the measures issued by the Data Protection Authority (Garante per la protezione dei dati personali). Indeed, the issue to be resolved in the case at hand consists of the possibility for the Authority to issue a de-indexing order of a web address (meaning, the non-direct accessibility of the web address via search engines external to the archive where the content is located) with extraterritorial effectiveness, balancing the data subject's right to be forgotten with the search engine operator's right to freedom of information.
The Right to be Forgotten and the Case at Hand
The matter stems from the infringement of the right to be forgotten due to the "continued dissemination on the web of outdated news concerning a judicial affair in which [the data subject] had been involved, which concluded with a dismissal decree (decreto di archiviazione) by the judge for preliminary investigations due to the groundlessness of the criminal offense notice." By an order issued on October 26, 2017, the Data Protection Authority had ordered the removal of the URLs (Uniform Resource Locator), or web addresses, that still referred to it. The peculiarity of the ruling concerns the territorial effectiveness of the order, which extended not only to national and European versions of the search engine but also to non-European versions, taking into account the applicant's interests even outside the national territory. However, the search engine operator challenged the measure before the Tribunal of Milan, which, with a judgment dated September 21, 2020, accepted the operator's claims on the grounds that the erasure order was also extended to non-European versions. According to the lower court judge, in application of the now-repealed rules of Legislative Decree no. 196/2003, which transposed Directive 95/46/EC on personal data protection, the Privacy Authority lacked jurisdiction to issue measures with extraterritorial effectiveness, and a proper balancing between the applicant's right to be forgotten and the right to freedom of information had not been carried out. The Authority, however, lodged an appeal before the Supreme Court of Cassation because "the challenged judgment... had incorrectly identified the criterion on the basis of which the Authority should have carried out the necessary balancing of interests, assuming that extraterritorial de-indexing should have been measured against the distinct legal frameworks existing in non-EU countries where the national rule with extraterritorial effects would allow the Authority's order to be enforced."
Case Law Precedents on the Right to be Forgotten and the Balancing with the Right to Freedom of Information
Before analyzing the issue of the territorial effectiveness of the Authority's order, the Court reviews the most relevant rulings of national and European case law concerning the right to be forgotten and the right to freedom of information, with particular regard to the de-indexing procedure. The following points can thus be summarized:
-
It is necessary to balance the interests of the parties involved, as de-indexing cannot be granted solely based on the existence of the conditions for its execution (Cass. no. 3952 of February 8, 2022);
-
The balancing test operates differently depending on whether the data subject is a public figure or not; indeed, only in the latter case does the right to freedom of information, protected by Art. 21 of the Constitution, tend to yield before the individual's right not to be linked to outdated news without time limits, as it would otherwise prejudice the right to personal identity and the right to privacy (Cass. no. 15160 of May 31, 2021; Cass. no. 9147 of May 19, 2020; and Cass., Joint Sections, no. 19681 of July 22, 2019).
These principles were likewise confirmed by the case law of the European Court of Justice, with the judgment of May 13, 2014, C-131/12, in application of Directive 95/46/EC. In particular, the Court confirmed that "the activity of a search engine consisting in finding information published or placed on the Internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to Internet users according to a particular order of preference, must be classified as processing of personal data." Furthermore, the fundamental rights deriving from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union allow the data subject to demand that the information no longer be made accessible to the public, except where such an individual plays a specific public role.
The Admissibility of an Extraterritorial Global Delisting or Global Removal Order Against a Search Engine Operator
Having thus outlined the functioning of the balance between the right to be forgotten and the right to freedom of information, the Supreme Court of Cassation addresses the problem of the admissibility of the extraterritorial order issued by the Privacy Authority, starting primarily from the European Court of Justice judgment known as the "CNIL" case of September 24, 2019. According to the Court of Justice of the European Union, "while EU law does not currently require that the de-referencing granted should apply to all versions of the search engine, as noted in paragraph 64 of this judgment, it also does not prohibit it. Therefore, a supervisory authority or a judicial authority of a Member State remains competent to carry out, in accordance with national standards of protection of fundamental rights, a balancing exercise between, on the one hand, the data subject’s right to privacy and the protection of their personal data and, on the other hand, the right to freedom of information, and, at the close of that exercise, to require, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine."
With this clarified, the Court of Cassation confirms that "the right to the protection of one's personal data and its constitutional foundation do not tolerate territorial limitations to the expression of its sphere of protection, all the more so since in this case such a right overlaps and goes hand in hand with the rights to identity, privacy, and contextualization of information"; this is due to the close link between the protection of rights over personal data and the fundamental rights of the person guaranteed by the Constitution. The balancing exercise, therefore, must not be based on distinct existing legal frameworks, as asserted by the lower court judge, but can only refer to national and European principles, with the sole consequence that, should a conflict arise with a non-European legal system, the latter will simply not proceed to recognize the order issued by the Authority. In conclusion, the judgment of the Supreme Court of Cassation reviewed here adds to the complex jurisprudential framework that has developed regarding the right to be forgotten, confirming the legitimacy of extraterritorial global delisting or removal orders.