European Court of Human Rights
FIRST SECTION
CASE OF BIANCARDI v. ITALY
(Application no. 77419/16)
JUDGMENT
Art 10 • Freedom of expression
• Civil sanctioning of an
editor for lengthy refusal
to de-index article on a criminal
case against private persons,
easily accessible by typing the latter’s names into Internet search engine • Obligation to de-index material applicable not only to Internet search engine providers but also to the administrators of newspaper or journalistic
archives accessible through the Internet • Information on sensitive data easily accessible online for eight months after a formal request to remove it by the persons concerned • Sanction not excessive
• No requirement to permanently
remove the article from the
Internet or to anonymise it
STRASBOURG
25 November 2021
This judgment will become final
in the circumstances set out in Article
44 § 2 of the Convention. It may
be subject to editorial revision.
In the case of Biancardi v. Italy,
The European Court of
Human Rights (First Section),
sitting as a Chamber composed of:
Ksenija Turković, President,
Péter Paczolay,
Krzysztof Wojtyczek,
Alena Poláčková,
Gilberto
Felici,
Erik Wennerström,
Raffaele
Sabato, judges,
and Renata Degener, Section Registrar,
Having regard to:
the application (no.
77419/16) against the Italian
Republic lodged with the Court under Article 34 of the Convention for the Protection
of Human Rights and Fundamental
Freedoms (“the Convention”) by an Italian
national, Mr Alessandro Biancardi (“the applicant”), on 7 December 2016;
the decision to give notice to the Italian Government (“the Government”) of the complaint concerning Article 10 of the Convention;
the observations submitted by the respondent
Government and the observations in reply submitted by the applicant;
the comments submitted by the “Reporters Committee for Freedom of the
Press”, the “UN Special Rapporteur on the Promotion
and Protection of the Right
to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression
of the Inter-American Commission on Human Rights”,
the “Media Lawyers Association” and the “Media Legal Defence”, who were
granted leave to intervene by the President of the
Section;
Having deliberated in private on
2 November 2021,
Delivers the following judgment, which was adopted
on that date:
INTRODUCTION
1. The applicant, the editor-in-chief of
an online newspaper, was held
liable under civil law for having kept on his newspaper’s
website and not having de-indexed an article reporting the facts of a criminal case instituted against private individuals. The applicant alleged the violation of his freedom of expression under Article 10 of
the Convention.
THE FACTS
2. The applicant was born
in 1972 and lives in Pescara. He was
represented by Mr M.
Franceschelli, a lawyer practising
in Pescara.
3. The Government
were represented by their Agent, Mr Lorenzo D’Ascia.
4. The facts of the case, as submitted by the parties, may be summarised as follows.
5. The applicant was the editor-in-chief of an online newspaper. On 29 March 2008, he published an article concerning a fight, followed by a stabbing, which had taken
place in a restaurant.
6. The article was headlined
“Fight in the restaurant –
the head of the police authority closes
the W and Z restaurants [which
belonged to the persons involved in the fight]”. The “standfirst paragraph” under the
headline read as follows:
“Pescara – Reputational damage
and financial repercussions
sustained by the W and Z restaurants
belonging to the X family”.
7. The article noted the head of the police authority’s decision to close the restaurants for twenty days. It mentioned the names of the persons involved (two brothers, V.X. and U.X., and their respective sons, A.X and B.X.), as well as the possible
motive for the fight, which
probably related to a financial quarrel about the ownership of a building. The article
reported on the line taken during part of the police questioning of V.X., U.X., A.X and B.X., and noted that U.X. and A.X. had been placed
under house arrest, that
B.X. had been taken to a detention facility and
that a house arrest order issued in respect of V.X. had been lifted.
8. On 6 September 2010, V.X. and the W restaurant
sent a formal notice (diffida stragiudiziale) to the applicant
asking that the article be removed from the
Internet, but to no avail.
9. On 26 October 2010, V.X. and W lodged two claims with the District Court of Chieti against,
respectively, Google Italy
S.r.l. and the applicant, pursuant
to Article 152 of Legislative Decree
no. 196 of 30 June 2003 (hereinafter
“the Personal Data Protection Code” – see paragraph 15 et seq. below) and Article 702 bis of the Code of Civil
Procedure (Formal requirements
regarding the bringing of proceedings before a court and
the parties thereto).
10. At the
hearing of 23 May 2011, the applicant
indicated that he had de-indexed the article in question, with a view to settling the case.[1] By
a decision of 28 March 2012, the court excluded Google Italy S.r.l. from
the proceedings following V.X.’s
withdrawal of his claim towards this party.
11. By a decision of 16 January 2013, the District Court of Chieti observed
at the outset that, in the light of the information that
the applicant had supplied on 23 May 2011, there was no need
to examine the part of V.X.’s
complaint regarding the request for the article to be removed from the Internet.
12. As for the remainder of the complaint,
concerning the breach of
the claimants’ right to respect for their reputation, the court awarded to each claimant 5,000 euros (EUR) in compensation for
non-pecuniary damage and
EUR 2,310 for costs and expenses.
13. The court
reiterated the applicable legislation on the matter – namely, Articles 7, 11, 15 and 25
of the Personal Data Protection Code. It noted in particular
that the information concerning
the claimants had been published on 29 March 2008
and had remained accessible on the Internet until
23 May 2011, notwithstanding
V.X.’s formal notice to the applicant asking that the article in question be removed from the Internet (see paragraph 8 above). In the court’s view, the public interest in to the right to provide information had then been satisfied
and, at least as from the date of V.X. sending
the above-mentioned formal notice, the processing of his
personal data had not been in compliance with Articles
11 and 15 of the Personal Data Protection Code. The
court then concluded that there had
been a breach of the claimants’ reputation and right to respect for their private life. The court also
noted that the information at issue was
easily accessible (much more than any information published in print newspapers, taking into account the large local dissemination of the online newspaper at
issue) by simply inserting the claimants’ names into the search engine, and that the nature of
the relevant data, as regards judicial proceedings, was sensitive.
14. The applicant lodged an appeal on
points of law; by a judgment
of 24 June 2016, the Supreme Court upheld the first-instance decision on all grounds and dismissed the applicant’s appeal.
The Supreme Court noted that
the processing of the plaintiffs’ personal data had been unlawful
inasmuch as that the article, published on 29 March 2008, had remained accessible on the
Internet, despite the above-mentioned
formal notice sent (to the applicant asking that the article in question be removed from the Internet) by V.X. on 6 September
2010, and that the possibility
to access the article had been easy and direct. The Supreme
Court excluded the possibility
that in this case the unlawfulness of the way in which
the personal data had been processed had been
linked either to the content of the said article, to its online publication and dissemination, or
to its conservation and
digital archiving.
RELEVANT LEGAL FRAMEWORK AND PRACTICE
RELEVANT DOMESTIC LAW
Legislative Decree no. 196
of 30 June 2003 (Personal Data Protection
Code)
15. The relevant provisions of the
Personal Data Protection Code read
as follows:
Article 7: Right to access
personal data, and other rights
“...
3. a) The person affected has the right to obtain the removal, the anonymisation or the
interruption of the processing of data that are being used illegally. ...
Article 11: Arrangements for the
processing and categorisation of data
“1. Personal data subject
to processing are:
...
e) kept, in a form that
allows the identification
of the person concerned,
for a period not exceeding the time necessary to achieve the objectives for which the data have been collected and subsequently processed. ...”
Article 15: Damage arising from data processing
“A person causing damage to a third person as
a consequence of the processing of his or her personal data must
compensate the person concerned
under Article 2050 of the Civil
Code. The person concerned is also entitled
to obtain compensation for
non-pecuniary damage resulting from the breach of Article 11.”
Article 25: Prohibition of communication and dissemination
“Communication and dissemination are forbidden in respect of ...:
a) personal data whose removal has been
ordered, after the period
of time indicated in Article
11 § (1) (e) has elapsed
...”
Article 99: Compatibility of the objectives
and the length of processing
“1. The
processing of personal data for historical, scientific or statistical purposes is considered
to be compatible with the different
objectives for which the
data was initially collected or processed.
2. The
processing of personal data for historical, scientific or statistical purposes may be carried out also upon the expiry of the period that is
necessary for achieving the
different purposes for which the data was initially collected and processed. ...”
Article 136: Journalistic purposes ...
“1. The provision contained in this paragraph [Journalism and Literary
and Artistic Expression]
are applicable to the processing of data:
a) carried out in the exercise of journalistic
activities and for the exclusive pursuit
of the inherent objectives.
...”
Article 139: Code of ethics concerning
journalistic activities
“The Data Protection
Authority encourages the adoption by the National Council of Journalists of a code
of ethics in respect of the processing of the [type of] data referred to in Article 136, which [would provide] protective measures ... in respect of ..., in particular,
data that could reveal information regarding [a person’s] state of health or sexual
life. ...”
Article 152: Standard judicial authorities
“1. A standard judicial
authority [autorità giudiziaria ordinaria] has jurisdiction to settle all disputes concerning
the application of the provisions
contained in the present
code ...
2. In order to institute proceedings
concerning all disputes mentioned in paragraph 1 above, an appeal shall be lodged with the registry of the court serving the
place of residence of the person whose
(personal data) are being processed.
3. The court will decide
[a case] sitting in a
single-judge composition.
...
13. A judgement may not be subject
to an appeal on the merits before
a second-instance court; however,
it may be subject to an appeal on points of law
before the Court of Cassation.
...”
INTERNATIONAL LAW MATERIAL
Recommendation CM/Rec(2012)3 of the Committee of Ministers
of the Council of Europe to member
States on the protection of human rights
with regard to search engines
16. In its relevant parts, this recommendation, adopted by the Committee of Ministers
on 4 April 2012, reads as
follows:
“7. The Committee of Ministers
..., under the terms of Article
15.b of the Statute of the Council
of Europe, recommends that member States, in consultation
with private sector actors
and civil society, develop
and promote coherent
strategies to protect freedom
of expression, access to information and other human rights and fundamental freedoms in relation
to search engines in line
with the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No. 5, hereinafter referred to as the “Convention”),
especially Article 8 (Right to respect for private and
family life) and Article 10 (Freedom of expression) and with the Convention for the Protection of Individuals with regard to Automatic Processing of
Personal Data (ETS No. 108, hereafter referred to as “Convention No.
108”), in particular by engaging
with search engine
providers to carry out the following actions:
– enhance transparency regarding the way in which access
to information is provided,
in order to ensure access to, and pluralism
and diversity of, information and services, in particular the criteria according to which search results are selected, ranked or removed;
– review search ranking and indexing of content which, although in the public space, is not intended
for mass communication (or for mass communication in aggregate). This
could include listing content
sufficiently low in search results so as to strike a balance
between the accessibility
of the content in question
and the intentions or wishes
of its producer (for example
having different accessibility levels to content which is
published seeking broad dissemination as compared to content which is
merely available in a public space). Default
settings should be conceived
taking account of this objective;
...
III. Filtering and de-indexing
Context and challenges
12. A prerequisite for the
existence of effective search engines is the freedom to crawl and index
the information available on the Internet. The
filtering and blocking of Internet content by search engine providers entails the risk
of violation of freedom of expression guaranteed by Article 10 of the Convention in respect
to the rights of providers and users to distribute and access information.
13. Search engine providers should not be obliged to monitor their networks and services proactively
in order to detect possibly
illegal content, nor should they
conduct any ex ante
filtering or blocking activity, unless
mandated by court order or by a competent
authority. However, there may be legitimate requests to remove specific sources from their
index, for example in cases
where other rights outweigh the right to freedom of expression and information; the right
to information cannot be understood
as extending the access to content beyond the intention of the person who exercises her
or his freedom of expression.
14. In many countries, search engine providers de-index
or filter specific websites at
the request of public authorities
or private parties in order to comply with legal obligations or at their own
initiative (for example in cases not related
to the content of websites, but
to technical dangers such as malware). Any such de-indexing or filtering should be transparent, narrowly tailored and reviewed regularly subject to compliance with due process
requirements.
Action
15. Member States should:
– ensure that any law,
policy or individual request
on de-indexing or filtering is
enacted with full respect
for relevant legal provisions, the right to freedom of expression and the right to seek, receive and impart information.
The principles of due process
and access to independent and accountable
redress mechanisms should also be respected in this context.
16. In addition, member States should work with search engine providers so that they:
...
– explore the possibility of allowing de-indexation of content which, while in the public
domain, was not intended for mass communication
(or mass communication in aggregate). ...”
Council of Europe Convention for the Protection
of Individuals with Regard
to the Processing of Personal Data of 18 May 2018
17. The relevant provisions of this Convention, updating the previous Convention ETS (European
Treaty Series) no. 108 for the Protection
of Individuals with regard
to Automatic Processing of Personal Data of 28 January 1981, read as follows:
Article 5: Legitimacy of data
processing and quality of data
“1. Data processing shall
be proportionate in relation to the legitimate purpose pursued and reflect at all stages of the processing a
fair balance between all interests concerned, whether public or private, and the rights
and freedoms at stake.
2. ...
3. Personal data undergoing
processing shall be processed
lawfully.
4. Personal data undergoing
processing shall be:
...
b. collected for explicit,
specified and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is, subject
to appropriate safeguards, compatible
with those purposes;
c. adequate, relevant and not excessive in relation to the purposes
for which they are processed;
d. accurate and, where necessary, kept up to date;
e. preserved in a form which
permits identification of
data subjects for no longer
than is necessary
for the purposes for which those data are processed.”
Article 6: Special categories of
data
“1. The processing of:
...
– personal data relating
to offences, criminal proceedings and convictions, and related security measures;
...
shall only be allowed where appropriate safeguards are enshrined in law, complementing those of this Convention.
2. Such safeguards shall guard against the risks that the processing of sensitive data may
present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.”
Article 9: Rights of the data subject
“1. Every individual shall have a right:
...
e. to obtain, on request, free of charge and without excessive delay, rectification or
erasure, as the case may
be, of such data if these are being, or have been, processed
contrary to the provisions
of this Convention; ...”
Article 11: Exceptions and restrictions
“1. No exception to the provisions set out in this Chapter shall be allowed except to the provisions of Article 5 paragraph 4, Article 7 paragraph 2, Article 8 paragraph 1 and Article 9, when such an exception
is provided for by law, respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for:
...
b. the protection of the
data subject or the rights
and fundamental freedoms of
others, notably freedom of expression.”
EUROPEAN UNION LAW MATERIAL
Directive 95/46/EC of the European
Parliament and of the Council
of 24 October 1995
18. Directive
95/46/EC of the European Parliament
and of the Council of 24 October
1995 on the protection of individuals
with regard to the processing of personal data and on
the free movement of such
data (“Directive 95/46/EC”) was designed
to protect individuals’ fundamental rights and freedoms (including their right to privacy) in the
processing of personal data, while at the same time removing obstacles to the free
flow of such data. The relevant
Articles read as follows.
Article 8: The processing of special categories
of data
“...
5. Processing of data relating
to offences, criminal convictions or security measures may be carried out only under the control of official
authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted
by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.
Member States may provide that data relating to administrative sanctions or judgements in civil cases shall
also be processed under the
control of official authority.”
Article 9: Processing of personal data and freedom of expression
“Member States shall provide for exemptions or derogations from
the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they
are necessary to reconcile
the right to privacy with the rules governing freedom of expression.”
Article 12: Right of access
“Member States shall guarantee every data subject the right to obtain from the
controller:
...
(b) as appropriate the rectification, erasure or blocking
of data the processing of which does
not comply with the provisions of this Directive, in particular because of the
incomplete or inaccurate nature of the data;
...”
Article 14: The data subject’s right to object
“Member States shall grant the data subject the right:
(a) at least
in the cases referred to in
Article 7 (e) and (f), to object
at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise
provided by national legislation.
Where there is a justified objection, the processing instigated
by the controller may no longer
involve those data;
...”
Relevant Court of Justice of the European
Union (CJEU) case-law related
to Directive 95/46/EC
Google Spain and Google
Inc. (Case C-131/12)
19. In its grand chamber judgment of 13 May 2014 in Google
Spain SL and Google Inc., C-131/12, EU:C:2014:317,
the CJEU was called upon to interpret Directive
95/46/EC. It found that the “activity” of an Internet search
engine was to be classified as the “processing of
personal data” within the meaning
of Directive 95/46/EC, and held that
such processing of personal data by the operator of a
search engine was liable to affect
significantly the fundamental
rights to privacy and to the protection
of personal data (as guaranteed
under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union) when a search by means of that engine was
carried out on the basis of
an individual’s name, since
such processing enabled any Internet user to obtain (through the list of search results thus attained)
a structured overview of
the information relating to that
individual that could be found on the Internet
and thereby to establish a
more or less detailed profile of him or her.
20. Furthermore, the effect of such interference on the rights of a data subject would be heightened on account of
the important role played by the Internet and search
engines in modern society, which rendered the information contained in such a list of results ubiquitous. In the light
of the potential seriousness
of that interference, it could not
be justified merely by the economic interest of the
operator.
21. The CJEU held that a fair balance had to be sought between the legitimate interest of Internet users in having
access to such information and the data subject’s fundamental rights. It deemed
that a data subject’s fundamental rights, as a general rule, overrode the interests of Internet users, but that that balance might, however, depend on (i) the nature of the information in question and its sensitivity as regards the data subject’s
private life and (ii) the interest of the public in having that information.
22. The CJEU held that in certain
cases the operator of a search
engine was obliged to remove from the list
of results displayed
(following a search made on the basis
of a person’s name) any and
all links to Internet pages published
by third parties and containing
information relating to that
person, even when the publication of that information on the Internet pages in question was in itself lawful. That was so in particular where the data in question appeared to be inadequate, irrelevant or no longer relevant, or excessive, given the purposes for which they had been
processed and in the light of the time that had elapsed
since the date of the processing in question (see Delfi AS v. Estonia
[GC], no. 64569/09, § 56, ECHR 2015).
GC, AF, BH, ED v. CNIL (Case C-136/17)
23. In a judgment of 24 September 2019 in
GC and Others (De-referencing of sensitive data),
C-136/17, EU:C:2019:773, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning four decisions delivered by the
National Commission on Data Processing and Civil Liberties (Commission nationale
de l’informatique et des
libertés – CNIL) refusing to serve formal notices on Google requiring it to de-reference various links appearing in the lists of results
displayed following searches
of their names and leading
to Internet pages published by third
parties.
24. The CJEU decided, inter alia, that
information relating to legal
proceedings brought against an individual (and
information relating to any
ensuing conviction) constituted data relating to “offences” and “criminal convictions” within the meaning of Article 8(5) of
Directive 95/46/EC. The CJEU also ruled
that the operator of a search
engine was required to accede to a request
for de-referencing in respect
of links to Internet pages displaying such information, in the event that
the information in question (i) related
to an earlier stage of the legal
proceedings in question
and, (ii) having regard to
the progress of the proceedings, no longer corresponded to the current situation; however, the search engine operator in question would be required to accede to a request
for de-referencing only if – in the course of verifying whether there were reasons
of substantial public interest,
as listed in Article 8(4) of Directive 95/46/EC– it
had been established that, in the light of
all the circumstances of
the case, the data subject’s fundamental
rights – as guaranteed by Articles 7 of the
Charter of Fundamental Rights
of the European Union (“Respect
for private and family life”) and 8 of the Charter of Fundamental
Rights of the European
Union (“Protection of personal data”) – overrode the rights of potential Internet users who might have an interest
that was protected by Article 11 of the
Charter of Fundamental Rights
of the European Union (“Freedom of expression and information”).
Google LLC v. CNIL (Case C-507/17)
25. In a judgment of 24 September 2019 in
Google (Territorial scope of de-referencing),
C-507/17, EU:C:2019:772, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning the imposition by CNIL
on Google of a penalty of EUR 100,000 because of that company’s refusal, when granting
a de-referencing request,
to apply it to all of its search
engine’s domain name extensions. The CJEU was then requested
to clarify the territorial
scope of the requested de-referencing
and to determine whether
the provisions of Directive 95/46/EC required de-referencing at the national, European or worldwide level.
26. The CJEU ruled that in the event that a search engine
operator granted a request
for de-referencing (pursuant
to Article 12(b) and subparagraph
(a) of the first paragraph of Article
14 of Directive 95/46/EC and of Article 17(1) of Regulation (EU) 2016/679 of the European
Parliament and of the European
Council), that operator would not be required
to carry out that de-referencing on all versions of its search engine, but only on the versions of that search engine corresponding
to all the European Union
States, using, where necessary, measures which, while meeting the legal requirements, effectively prevented (or, at the very least,
seriously discouraged) an
Internet user from (i) conducting a search from one of the European
Union States on the basis of a data subject’s name, and (ii) gaining
access, via the list of results displayed
following that search, to
the links that were the subject of that request.
EU national data protection
authorities’ guidelines of
26 November 2014
27. On 26
November 2014 the domestic data protection
authorities of all the European Union States – meeting within
the Article 29 Working Party (an independent
European working party dealing
with issues relating to the
protection of privacy and personal data) – adopted a set of guidelines designed to ensure the harmonised implementation of the CJEU’s judgment of 13 May 2014 (Guidelines on the implementation of the Court of Justice of the European Union judgment on
“Google Spain and Inc. v. Agencia
Española de protección de datos (AEPD) and Marco Costeja
González” C-131/12 adopted on 26 November 2014 by the
Article 29 Data protection
working party). The second part of the guidelines concerns common criteria which the data protection authorities were invited to apply when handling complaints
following refusals by search
engines to de-list search results. The thirteenth criterion reads as follows:
“13. Does the data relate to a criminal
offence?
EU Member States may have different
approaches as to the public
availability of information about
offenders and their offences. Specific legal provisions may exist which
have an impact on the availability
of such information over time. DPAs
will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search
results relating to relatively minor offences that happened a long time ago, whilst being less
likely to consider the
de-listing of results relating
to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case
basis.”
The General Data Protection
Regulation
28. Regulation (EU) 2016/679 of the European
Parliament and of the European
Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data (the
General Data Protection Regulation
– hereinafter “the GDPR”), published
in OJ 2016 L 119/1, entered into
force on 24 May 2016 and repealed
Directive 95/46/EC with effect from 25 May 2018. The relevant provision of the Regulation read as follows:
Article 17 – Right to erasure (“right to be forgotten”)
“1. The data subject shall have
the right to obtain from
the controller the erasure of personal data concerning
him or her without undue delay and the
controller shall have the obligation to erase personal data without
undue delay where one of
the following grounds applies:
(a) the
personal data are no longer necessary in relation to the purposes
for which they were collected or otherwise processed;
...
2. Where the controller has made the
personal data public and is obliged
pursuant to paragraph 1 to
erase the personal data, the controller, taking
account of available technology
and the cost of implementation, shall
take reasonable steps, including
technical measures, to inform
controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to,
or copy or replication of, those
personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and
information;
...
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement
of the objectives of that
processing ....”
The European Data Protection Board’s Guidelines on the criteria of the
Right to be Forgotten in search engines cases under the GDPR
29. The Guidelines (5/2019) on the criteria
of the Right to be Forgotten
in search engines cases (adopted by the European Data protection Board on
7 July 2020) read as follows in their relevant parts:
4 ... this document aims to interpret the Right to be forgotten in the search engines cases in light of the provisions of Article 17 GDPR
(the “Right to request
de-listing”). Indeed, the Right
to be forgotten has been especially enacted under Article 17 GDPR to
take into account the Right
to request de-listing established
in the Costeja judgement
[CJEU, Case C-131/12, Google Spain SL and Google Inc.
v Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González, judgment
of 13 May 2014]. ...
18. According to Article 17.1.a GDPR, a data subject
may request a search engine provider, following
a search carried out as a general rule on the basis of
his or her name, to delist content from its search results,
where the data subject’s
personal data returned in those
search results are no longer necessary
in relation to the purposes of the processing by the search engine.
19. This provision enables a data subject to request the de-listing
of personal information concerning him or her that
have been made accessible for longer than it is
necessary for the search engine provider’s processing. Yet, this processing is notably carried
out for the purposes of making information more easily accessible for internet
users. Within the context
of the Right to request
de-listing, the balance between the protection of privacy and the interests
of Internet users in accessing the information must
be undertaken. In particular,
it must be assessed whether or not, over the course of time, the personal data have
become out-of-date or have not been updated.”
...
THE LAW
ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION
30. Under Article 10 of the Convention, the applicant
alleged that the interference in his freedom of expression – namely, his right
to inform the public – had been unjustified. He also complained that the penalty imposed on him had been
excessive. Article 10 of
the Convention reads as
follows:
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information
and ideas without interference by public authority and regardless
of frontiers. ...
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or
penalties as are prescribed
by law and are necessary in
a democratic society, in the interests
of national security, territorial integrity
or public safety, for the prevention
of disorder or crime, for the protection of health or
morals, for the protection of the reputation
or rights of others, for preventing the disclosure of
information received in confidence, or for maintaining the authority and impartiality
of the judiciary.”
Admissibility
31. The Court
notes that the application is neither manifestly
ill-founded nor inadmissible on any other grounds listed in Article 35 of the Convention. It
must therefore be declared admissible.
Merits
The parties’ submissions
(a) The applicant
32. The applicant pointed out that the criminal proceedings instituted against V.X. had still been pending
as at the date on which the Supreme Court’s judgment had been
issued in respect of his case. Therefore, it could not
be said that the period of time during which the information had remained published was excessive. Thus, V.X.’s “right
to be forgotten” had never existed in the first place.
33. The applicant submitted that the domestic authorities had not taken into
account Article 99 of Legislative Decree
no. 196/2003, which provided
that the processing of personal data for, inter alia,
“historical purposes”
[scopi storici] could be carried
out upon the expiry of the period allowed for achieving the different purposes for which the data had originally been collected and processed. He also referred to Articles 136 and 139
of the same Decree and to
the above-mentioned code of ethics, which contained specific provisions regarding the protection of journalists’ freedom of expression.
34. The applicant furthermore submitted that he had been unjustly
held liable for not having erased
the article in question, since only the search engine provider (that is to say,
Google Italy) that had been technically
capable of de-listing the article
in question.
35. The applicant also pointed out that, in cases similar to the present one, the balance between
the protection of individuals’
reputation under Article 8
and the freedom of expression
provided by Article 10 had been easily
secured by simply requiring the publications concerned to publish supplementary information or clarifications
to the articles in question.
(b) The
Government
36. The
Government submitted that
an adequate balance between
the applicant’s freedom of expression and the right of V.X.
and his restaurant to respect for his private life (and
the reputation of both) had been achieved
in the instant case.
37. The
Government added that the restriction in question had been prescribed
by law – namely,
Legislative Decree no. 196/2003, which
clearly stated that the maintenance of personal
data was subject to the continuing existence of the objective that had initially justified
their collection and
storage. The aim of journalism – namely,
to contribute to public debate
on matters of social, political
and economic interest – should be deemed to be ongoing whenever the knowledge of
certain events was still relevant to public discussion. In that regard, the Government submitted that the article had remained on the site of the
online newspaper for a substantial period of time. Indeed, no
information about the progress of the related criminal proceedings had been provided in the article, which had simply recounted
the material events. Therefore,
it could not be said that
the period of time during which the information had remained published was excessive.
38. The
Government emphasised that
the fact that the applicant had been
found guilty had been a consequence
of the failure to de-index from the Internet search engine the tags to the article published by the applicant (which would have prevented
anyone accessing the article by means of simply typing out the name of
V.X. or of his restaurant).
In other words, the decisions
of the Italian courts had stated that
the applicant should have de-indexed the article’s content, thereby making it more likely that only
people who were genuinely interested in learning
the facts of the matter in question would come across the article. However, the applicant had not been
obliged actually to remove the article in question from the Internet archives.
39. Contrary to what the applicant had stated
in his observations, the
Government submitted that
the obligation to de-index material
could be imposed not only on Internet search engine providers, but also on the administrators of newspaper or journalistic
archives accessible through the Internet.
(c) Third
party interveners
(i)
Reporters’ Committee for Freedom of the Press (“the Reporters’
Committee”)
40. This intervener reiterated that the “right to be forgotten”, as recognised by the CJEU in
Google Spain and as stipulated by the GDPR (see, respectively, paragraphs 19 et seq. and 28 et seq. above) is aimed
at providing users with the
ability to request that search engines
de-list or de-index the results of searches conducted on the basis of a person’s name. Within the Convention’s system, this right has
to be weighed against the right to freedom of expression and the right to publish information – in particular
when it would
result in the permanent removal of news articles published by the press (see Węgrzynowski and Smolczewski
v. Poland, no. 33846/07, 16 July 2013).
41. This third party also pointed out the essential role played by the press in a democratic society, including through media websites and its
establishment of digital archives. It also pointed
out that the Court had found that the public’s right to be informed outweighed the “right to be forgotten” in the
case of two individuals who had sought
to have online media reports about
their past criminal convictions anonymised (M.L. and W.W. v. Germany, nos. 60798/10 and
65599/10, 28 June 2018).
(ii) UN Special Rapporteur on the
Promotion and Protection of the Right
to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression
of the Inter-American Commission on Human Rights
42. This third-party intervener argued that there was
a significant distinction between de-listing and the outright
erasure of content under international standards regarding freedom of expression. The conclusion that the “right to be forgotten” encompassed the right to demand the erasure of certain
news content (as opposed to its mere de-listing) would almost certainly
lead to censorship worldwide,
and the “right to be forgotten”
would be inappropriately expanded to the extent of severely jeopardising press freedom.
(iii) Media Lawyers Association
43. The Media
Lawyers Association contended
that online media archives played a fundamental role in protecting and developing the rights and values enshrined in Article 10 of the Convention. The erasure of accurate
information from the record ran directly
contrary to the values protected by Article 10 and amounted to press censorship. Accordingly, any attempt to erase such information
had to be genuinely exceptional and only justifiable where strictly necessary.
(iv) Media Legal Defence
44. The Media
Legal Defence argued that the scope of the “right to
be forgotten” should not include the right to secure
the erasure or the anonymisation of newspaper articles containing the personal
information of individuals. In the intervener’s view, articles published by individuals or entities engaged in journalistic
activities or by governments should not be de-listed.
45. This third party also submitted that in the evaluation of the
balance between the right
to respect for one’s reputation and the right to freedom of expression, other elements came into play, such as whether
the complainant had suffered substantial harm, how recent
the information in question was
and whether it remained of interest to the
public. Individuals should not be empowered to restrict access to information concerning
themselves and published by
third parties, except when such information had an essentially private or defamatory character or when the publication of such information was not justified for other reasons.
The Court’s assessment
(a)
Preliminary remarks
(i) The
scope of the case
46. The Court
notes at the outset that it has
dealt with Article 10 cases concerning Internet publications in which the subject matter was an article or a post with defamatory or offensive content (see Delfi AS v. Estonia [GC], no. 64569/09, §§ 131-139,
ECHR 2015; Savva Terentyev
v. Russia, no. 10692/09, 28 August 2018; and Kablis
v. Russia, nos. 48310/16 and 59663/17, 30 April 2019). Moreover,
it has previously
examined the requirement to
publish – where appropriate
– supplementary information or clarifications
to an article contained in
Internet archives (see
Times Newspapers Ltd v. the United Kingdom (nos. 1 and 2, concerning
the requirement to append a
notice to the articles at stake in that
case to the effect that they were subject
to libel litigation), nos.
3002/03 and 23676/03, §§ 40-43, ECHR 2009).
47. With regard to Article 8, the Court has already examined
cases in which the domestic jurisdictions refused to remove personal data
from public Internet archives (see
Węgrzynowski and Smolczewski,
cited above, § 65, 16 July 2013) or to oblige media to anonymise online archived material concerning a crime (see M.L. and W.W., cited above, § 116).
48. The Court
observes, however, that the present case departs from all the Article 10 and 8 case cited above. Its crux
is indeed not related to the content of an Internet publication,
nor to the way an information is
published (as for instance, its anonymisation
or qualification); rather, it relates to the applicant’s failure to de-index
the above-mentioned information concerning
V.X. and his restaurant and
to his decision to keep the article easily accessible, despite the fact that the claimant had asked that
the article be removed from
the Internet.
49. The scope
of the case, as defined above, was also
emphasised by the Supreme Court, which
ruled out that the unlawfulness of the processing of V.X.’s
personal data arose from either
(i) the content of the said
article, (ii) its online publication and dissemination or
(iii) its conservation and
digital archiving (see paragraph 14 above).
50. The Court
also notes that what is at
stake in the present case is the length and ease of access to the data concerned
and not their simple maintenance on the
Internet. In this regard,
the Court observes that the
applicant claimed that he could not
be given the responsibility
for de-indexing the article
in question, such a possibility being open, in his view, only
to the relevant Internet search
engine provider. The Court notes, however,
that this assertion is contradicted
by the fact that the applicant eventually did de-index the impugned article on 23 May 2011 (see paragraph 10 above). Indeed, de-indexing can be carried out by an
editor, “noindexing” being
a technique used by website owners
to tell a search engine
provider not to let the content of an article appear in the search engine’s search results.[2]
51. In this respect, the Court shares
the Government’s position that
the finding of the applicant’s
liability had been a consequence of the failure to
de-index from the Internet search engine
the tags to the article published
by the applicant (which would have prevented
anyone accessing the article by simply typing out the name of V.X. or of his
restaurant), and that the obligation to de-index material could be imposed not only on Internet search engine providers, but also on the administrators of newspaper or journalistic
archives accessible through the Internet (see paragraphs 38. and 39 above).
52. The Court
will therefore keep in mind the scope of the case, as
described above, as it now
proceeds to examine the applicant’s complaint.
(ii) The terminology
53. The Court
acknowledges that the terms “de-indexing”, “de-listing”
and “de-referencing” are often
used interchangeably in different sources of European
Union and international law and that
their specific meaning can often only be drawn from the context in which they are used (see – cited in paragraph 16 above – Recommendation CM/Rec(2012)3 of
the Committee of Ministers of the Council
of Europe to member States on the protection
of human rights with regard
to search engines part III
“Filtering and de-indexing”, points 13 and 14; the European Data Protection Board’s Guidelines on the criteria of the Right to be Forgotten in search engines cases under the GDPR (see paragraph 29 above); and the CJEU’s judgment in GC, AF, BH, ED v. Commission nationale de l’informatique et des libertés (Case C-136/17) (see
paragraph 24 above).
54. Within the above-mentioned
sources, the terms “de-indexing”,
“de-listing” and “de-referencing” indicate the
activity of a search engine
consisting of removing, on
the initiative of its operators, from the list of results
displayed (following a search
made on the basis of a person’s
name) Internet pages published by third
parties that contain
information relating to that
person (see paragraph 22 above).
55. Instead, in the instant case, the subject
to whom was addressed the request to limit access to personal data – namely,
the applicant – was not a search engine
but an editor, journalist,
and owner of an online newspaper website.
56. For the sake of consistency, the Court emphasises that in this judgment it
will use the term “de-indexing” to indicate the measure
that the applicant was asked to carry
out in order to guarantee V.X.’s
and W’s right to respect for their reputation.
(b) The Court’s assessment
57. The Court
notes that it was not in dispute between the parties that the applicant’s freedom of expression, as guaranteed under Article 10 of
the Convention, was interfered
with by the domestic court’s
decisions of 16 January
2013 and 24 June 2016; neither
was it in dispute between the parties that such interference was “prescribed by law” – namely, Legislative Decree no. 196 of 2003. The Court sees
no reasons to hold otherwise. It is
furthermore satisfied that the interference in question was designed
to protect “the reputation
or rights of others” and had thus a legitimate
aim under Article 10 § 2 of
the Convention.
58. As to the question of whether the said interference was “necessary in a democratic society”, the Court reiterates
from the outset the specificity
and the scope of the case at issue
(see paragraphs 46 et seq. above): the applicant was held
liable not for not removing the article, but for not having de-indexed
it (thus allowing for the possibility –
for a period whose length has been
deemed to be excessive – of
typing into the search engine the restaurant’s or V.X.’s names in
order to access information related to the criminal proceedings involving V.X.).
59. In this regard, and with reference to the above considerations concerning the
scope of the case, the Court reiterates the observations of the third-party interveners (see paragraphs 40 et seq. above), which draw
a clear distinction between,
on the one hand, the requirement to de-list (or
“de-index”, as in the present
case) and, on the other hand, the permanent
removal or erasure of news articles
published by the press. In the instant case, the
Court acknowledges that the
applicant was found to be liable solely on account of the first requirement
– that is to say no requirement to permanently remove the article was at
issue before the domestic courts. Nor was any
intervention regarding the anonymisation of the online article
in question at issue in this case.
60. In the Court’s view, this
is an important starting point from which to define the interference in the applicant’s freedom of expression and to identify, accordingly, the applicable principles in order to assess the
proportionality of that interference.
61. As to this last point, the Court has laid down relevant
principles to guide its assessment of whether or not an interference in this area is necessary
and has identified a number of criteria in the context of balancing freedom of expression and right to reputation. These criteria are the following: i) a contribution
to a debate of general interest;
ii) how well known the person concerned was and what the subject of the report in
question was; iii) the behaviour of the person concerned towards the media; iv)
the method of obtaining the
information in question, and its
veracity; v) the content,
the form and the consequences
of the publication in question,
and vi) the severity of the sanction
imposed on the applicant (see Axel Springer AG v. Germany ([GC], no. 39954/08, §§
89-95, 7 February 2012).
62. However, the Court observes that there are factual differences between Axel Springer AG and the present
case. Indeed, the former
case concerned the publication,
by the applicant company, of print
articles reporting the arrest
and conviction of a well-known
television actor whereas, as noted
above, the present case deals with the maintenance
online, for a certain period
of time, of an Internet article concerning
a criminal case against
private individuals. There
are therefore two main features that characterise the present case:
one is the period for which the online article remained on the Internet and the impact thereof
on the right of the individual
in question to have his reputation respected; the second feature relates
to the nature of the data subject in question – that is to say a private individual not acting within a public context as a political
or public figure. Indeed, anyone
– well-known or not – can
be the subject of an Internet search,
and his or her rights can be impaired by continued Internet access to his
or her personal data.
63. In the
light of this, the Court acknowledges
that the strict application of the criteria set
out in Axel Springer AG would be inappropriate in the
present circumstances. What the Court must examine is whether, in the light of the fundamental principles established in the Court’s case-law, the domestic courts’ finding of civil liability on the part of the applicant
was based on relevant and sufficient grounds, given the particular circumstances of the case (see among other authorities,
the above-cited cases of
Times Newspapers Ltd, §§ 40-43 and Delfi AS, §§ 131-139, ECHR 2015; see also the recent
case of Big Brother Watch and Others v. the United Kingdom [GC], nos. 58170/13
and 2 others, § 442 et seq.,
22 May 2021).
64. Special attention should be paid in this case to (i) the length of time for which the article was kept
online – particularly in the light of the purposes for which V.X.’s data was originally processed; (ii) the sensitiveness of the
data at issue and (iii) the
gravity of the sanction imposed on the applicant.
65. Regarding the first point, the Court notes that it is
true that, as pointed out by the applicant, the criminal proceedings against V.X. and other members of his family were still pending at
the time that the Supreme Court adopted
its judgement in the applicant’s case. However, it should be noted
that the information contained
in the article had not been updated
since the occurrence of the
events in question. Moreover,
notwithstanding the formal notice that V.X. sent to the applicant requesting the removal of the article from the Internet, the said
article remained online and
easily accessible for eight months.
66. In this regard, the applicable domestic law (see Article
11 of Legislative Decree no. 196/2003), read in the light of the international legal
instruments (see Article 5 (e) of the updated
Convention ETS no. 108 and Article 17 § 1 a) of the
GDPR) supports the idea that the relevance
of the applicant’s right to
disseminate information decreased over the passage of time, compared to V.X.’s right to respect for his reputation (in this respect, compare and contrast Éditions Plon v. France, no.
58148/00, §§ 53-57, ECHR 2004‑IV, where the
more time elapsed, the greater
the public interest in discussing
of the history of President Mitterrand’s
time in office prevailed over the President’s
rights with regard to medical confidentiality. In that case, the Court considered
in particular that, in any event, the duty of medical confidentiality had already been breached).
67. With regard to the sensitiveness of
the data in question in the instant case, the Court is mindful that
the subject matter of the article in question related to criminal proceedings instituted against V.X. As can also be seen from several Council of Europe and European Union sources (Article 6
of the updated Convention ETS no. 108 (see paragraph 17 above); CJEU judgment Google Spain (see paragraph
21 above); and GC, AF, BH, ED v. CNIL (see paragraph 24 above), the Court is of the belief that the circumstances in which
information concerning sensitive data is published constitutes
a factor to be taken into account when balancing the right to disseminate information and the right of a data subject to respect for his or her private life.
68. Concerning the gravity of the sanction, the Court reiterates that the applicant was held liable
under civil and not criminal law (contrast
Tuomela and Others v. Finland,
no. 25711/04, § 62, 6 April 2010, and Savva Terentyev, cited above, § 83). Although the amount of compensation that the applicant was ordered to pay to the claimants for the breach of their right to have their
reputations respected was not negligible,
the Court is of the view that the severity of the sentence and the amount of compensation awarded for non-pecuniary damage (EUR 5,000 per each claimant) must not be regarded as excessive, given
the circumstances of this
case.
69. Where the balancing exercise between, on the one hand, freedom
of expression protected by Article 10, and, on the other,
the right to respect for one’s private life, as enshrined in Article 8 of the
Convention, has been undertaken by the national authorities,
in conformity with the criteria
laid down by the Court’s
case-law, the Court would require strong reasons to substitute its view for that of the domestic courts (see, among other
authorities, Palomo Sánchez and Others v. Spain [GC],
nos. 28955/06 and 3 others, § 57, ECHR 2011, and
Delfi AS cited above, §
139).
70. The foregoing considerations are sufficient to enable the Court to
conclude that the finding
by the domestic jurisdictions
that the applicant had breached V.X.’s
right to respect for his reputation by virtue of the continued presence on the Internet of the impugned
article and by his failure to de-index it constituted a justifiable restriction of his freedom of expression (see, mutatis mutandis,
Times Newspapers Ltd, cited above,
§ 47) – all the more so given
the fact that no requirement was imposed on the applicant to permanently remove the article from the Internet.
71. Accordingly, there has been no violation
of Article 10 of the Convention.
FOR THESE REASONS, THE COURT, UNANIMOUSLY,
Declares the application admissible;
Declares that there
has been no violation of Article 10 of the
Convention.
Done in English, and notified
in writing on 25 November 2021, pursuant to Rule 77
§§ 2 and 3 of the Rules of Court.
Renata Degener
Ksenija Turković
Registrar President
[1] The relevant extract of the Supreme Court’s judgment reads as follows: “By a declaration reported in the
minutes of the hearing of the 23 May 2011, the representative of the [defendant
online newspaper, belonging to the applicant] indicated that the newspaper had proceeded to the cancelation of
the indexing (l’avvenuta cancellazione
dell’indicizzazione) of the article, for the sole purpose of settling the case”.
[2] See the article “Control what you share with Google”
https://developers.google.com/search/docs/advanced/crawling/control-what-you-share.