Personal data and the (now so popular) ‘right to be forgotten’.

Search engines and Privacy: the leading case.

In its 2014 Google vs. Spain decision the Court of Justice of the European Union (CJEU) established some relevant principles on the ‘right to be forgotten’. Now were are seeing national DPAs elaborating on such principles.

A follow up by the Italian DPA.

The Italian Data Protection Authority (DPA), while handling a case against a search engine, came across the problem of how far its enforcement powers could be extended (territory wise), when ordering the ‘de-referencing’ of search results.

The case.

The case brought to the local DPA’s attention originated from a complaint filed by an Italian citizen, working in the US as a university teacher. The complainant  questioned  a  search  engine’s refusal to de-index (both, in Europe as well as outside of Europe) the results of Internet searches performed  with  respect  to  his  name,  leading  to  a  series  of  (anonymously  posted)  fake  news, published  on  forums  and blogs, referring  to  his health conditions  and  to  alleged  serious  criminal offenses  he  never  committed  and  never  had  been  investigated  about  by  the  competent Authorities.
The search engine argued to its defense that:
-  Freedom of information had to prevail over the complainant’s privacy expectations (especially when the questioned posts had been published a long time ago).
- As an academic, as an author of several publications and as an entrepreneur, the complainant had to be considered as a ‘public person’, as such having to accept that his privacy expectations were subject to the exemptions set with respect to the ‘right to inform the public’.
- The complainants request to obtain an order for permanent ‘de-referencing’ of the infringing IP addresses “everywhere in the World” and not just in Europe, exceeded the DPA’s enforcement powers for lack of authority under a territoriality perspective.

The DPA's findings and its decision.

In its decision – issued on December 21, 2017 – the Italian DPA disagreed on the defendant’s arguments and hold:
- With respect to the first aspect, that the ‘chronological reference’ appeared to be incorrect as the questioned posts had been published ‘not a long time ago’, but in 2017.
- As to the second issue, that when an individual’s right to be forgotten was at stake, a ‘balance’ had always to be found between such right and that of free information to the public. Such balance required to assess how significantly - and with what kind of prejudice - the information diffused was likely to affect an individual’s private sphere. In the specific case, the DPA concluded that the information offered through repeated online rants appeared to be presented as ‘objective facts’ – while being false and misleading – and therefore can cause significant harm and, moreover, resulted in illicit data processing, as information diffused to the public had always to be truthful and correct.
-  While acknowledging the defendant’s ‘de-indexing’ of the search results relating to the complainant’s name in Europe, that false and misleading ‘news’ (conveying a harmful image of the complainant’s personality and integrity) remained available on the Internet outside Europe. Therefore, it appeared justified to order the removal – within a 20 days deadline from notice – of the specific reference also from the extra-European search results.
To no one’s surprise the decision of the Italian DPA made clear reference to the general principles set in the Google vs. Spain decision of the Court of Justice of the European Union – CJEU on the ‘right to be forgotten’ (judgement of May 13, 2014 in case C-131/12).  

Further developments.

Interestingly, the DPA did not hesitate to include in its order to ‘de-reference’ also search results appearing outside of the territory of the European Union (setting – through such extension – an important precedent as to enforcement effectiveness).  It  is  also  worth to  mention  that  the DPA issued  its  decision  despite  the  fact  that  in  front of  the  CJEU  is  currently  pending  a  case  (Google versus  CNIL,  C-507/17)  referred  by  the  French Conseil d’états (the  Highest  Instance  Administrative Court) and seeking  clarity  on  whether  the  ‘right  to be  forgotten’  –  as  asserted  in  the  Google  vs. Spain decision – must be intended “.. as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46/EC] of 24 October 1995”.
It will be interesting to see how the CJEU deals with this specific territoriality aspect.