The right to be forgotten is the result of the lengthy evolution of case law and is now expressly regulated by Regulation (EU) No 679/2016 (the so-called GDPR) under article 17, which provides for the right of the data subject to obtain the erasure of personal data concerning him or her, with the corresponding obligation falling on the data controller.
Among the most notable exceptions to this right, which leads to a delicate juxtaposition of conflicting interests, is the right to freedom of information.
The recent judgment of the Court of Cassation No. 34658 of 24.11.2022 provides an opportunity to analyse how the balancing of constitutionally protected rights operates in practice, as well as the territorial boundaries of the provisions issued by the Data Protection Authority.
Indeed, the question to be resolved in this case concerns the ability of the Italian Data Protection Authority to issue an order requiring the de-indexing of a web address (i.e., making the web address inaccessible through search engines external to the archive where the content is located), with extraterritorial effect, balancing the right to be forgotten of the person concerned with the right to freedom of information of the search engine operator.
Right to be forgotten and the case in question
The case stems from an infringement of the right to be forgotten due to the “persistent dissemination on the web of out-of-date news about a legal matter in which [the interested party] was involved, which ended up being dismissed by the examining judge due to the groundlessness of the offence”.
On 26.10.2017, the Data Protection Authority ordered the removal of URLs (Uniform Resource Locators), or web addresses, that still referred to the case.
The ruling was unusual in that the territorial effectiveness of the order extended not only to national and European versions of the search engine but also to non-European versions, taking into account the plaintiff’s interests also outside the national territory.
However, since the delisting order was also extended to non-European versions, the search engine operator challenged the order before the Court of Milan, which, through a decision issued on 21.9.2020, accepted the operator’s arguments.
According to the judge in this case, in fact, in application of the now repealed rules of Legislative Decree 196/2003, which transposed Directive 95/46/EEC on the protection of personal data, the Italian Data Protection Authority did not have the authority to issue orders with extraterritorial effect and no proper balance had been struck between the plaintiff’s right to be forgotten and the right to freedom of information.
The Italian Data Protection Authority, however, appealed to the Court of Cassation on the grounds that “the contested judgment … had misidentified the criterion based on which the Authority should have balanced the interests, assuming that the de-indexing with extraterritorial effect should have been in accordance with the parameters of the different legal frameworks in the non-EU countries in which the national provision with extraterritorial effect would allow enforcement of the Authority’s order”.
Case law precedents on the right to be forgotten and the balance with the right to freedom of
information
Before analysing the question of the territorial effectiveness of the Authority’s order, the Court reviewed the most relevant rulings in national and European case-law on the right to be forgotten and the right to freedom of information, focusing in particular on the de-indexing procedure. The following points can thus be summarised:
- It is necessary to balance the interests of the parties involved, as de-indexing cannot be allowed solely based on the existence of the conditions for its execution (Court of Cassation No. 3952 of 8.2.2022);
- This balancing act differs depending on whether or not the person concerned is a public figure. Only in the latter case, in fact, does the right to freedom of information, protected by Art. 21 of the Constitution, tend to be subordinate to the right of the person concerned not to be linked to news that is outdated (Court of Cassation No. 15160 of 31.5.2021), with no time limit, which otherwise would prejudice the right to personal identity and the right to confidentiality (Court of Cassation No. 9147 of 19.5.2020 and Court of Cassation, Joint Chambers, No. 19681 of 22.7.2019).
These principles were also confirmed by the case law of the European Court of Justice in its judgment of 13.5.2014, C-131/12, in application of Directive 95/46/EC.
In particular, the Court confirmed that “the activity of a search engine consisting in finding information published or entered by third parties on the Internet, indexing it automatically, storing it temporarily and, finally, making it available to Internet users in a certain order of preference, must be qualified as the processing of personal data”.
Furthermore, the fundamental rights deriving from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union allow the data subject to demand that information no longer be made accessible to the public, unless that person has a special public role.
Admissibility of the extraterritorial order against the search engine operator for global delisting or
global removal
Having outlined how the balancing act between the right to be forgotten and the right to freedom of information works, the Court of Cassation addressed the admissibility of the extraterritorial order issued by the Italian Data Protection Authority, referring primarily to the European Court of Justice’s CNIL judgment of 24.9.2019.
According to the EU Court of Justice, while European Union law does not – as noted in paragraph 64 of said judgment – currently require that the de-indexing apply to all versions of the search engine in question, it also does not prohibit it.
Therefore, a supervisory or judicial authority in a Member State may, in accordance with national standards for the protection of fundamental rights, seek to balance, on the one hand, the right of the person concerned to the protection of their privacy and of their personal data and, on the other hand, the right to freedom of information and may thus require, where appropriate, the search engine operator to carry out de-indexing on all versions of the engine in question.
Having clarified this, the Court of Cassation confirmed that “the right to the protection of personal data and its constitutional basis do not tolerate territorial limitations on the scope of protection, all the more so since in the present case this right overlaps with the rights to identity, confidentiality and the contextualisation of information”. This is due to the close correlation between the protection of rights over personal data and the fundamental rights of the individual guaranteed by the Constitution.
It therefore will not be necessary to balance the interests based on separate existing legal frameworks, as asserted by the Court of Milan, which can only be achieved with reference to national and European principles, the sole consequence of which being that, where there is a conflict with a non-European legal system, the latter will not recognise the order issued by the Authority.
In conclusion, the Court of Cassation’s judgment reviewed here adds to the complex legal framework developed on the subject of the right to be forgotten, confirming the legitimacy of the extraterritorial order of global delisting or removal.