The right to be forgotten versus the right to freedom of press and information.

Those two fundamental rights frequently find themselves on a clashing course. Achieving a correct balance between the right to privacy and the right to information is a tough and critical task. My comments try to offer a summarizing overview on how this issue is dealt with both, on an international level as well as by domestic courts.

The right to be forgotten: where does it come from?

The right to be forgotten is no new kid on the block. The 1995 General Data Protection Directive (no. 95/46) already provided – in article 12 – data subject’s right to obtain “..the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data”.

However, the right to be forgotten became an issue of intense general debate after the Spanish High Court had accessed the Court Justice of the EU (case no. C-131/12) asking to receive clarification on the question whether an individual had a specific right to have their personal data be removed from the search results of an Internet platform.

The Grand Chamber of the CJEU answered such question (together with others) through judgement of May 13, 2014, setting that:

- article 6 of the Directive no. 46 of 1995 required personal information to be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes”, to result “adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed”, also to be “accurate and, where necessary, kept up to date”, while “every reasonable step must be taken to ensure that data which are inaccurate or incomplete …are erased or rectified” and finally to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed”,

- subsequently, on the basis of the provisions of EU Directive no. 95/46, “the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful”, further clarifying that “as the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question”.

Hence, in the CJEU’s view, an individual’s right to privacy may prevail over the right to information, being however necessary to strike ‘a fair balance’ between those rights, to be achieved – on a case-by-case basis – through an accurate evaluation both, of the nature of the information in question and its sensitivity for the data subject's private life as well as of the public's interest in the information (the latter also depending on whether the individual is a public figure or not).

The CJEU’s decision also contained an important principle on a ‘territoriality’ aspect, i.e. on when the EU provisions governing the processing of personal data became applicable to foreign companies. According to the Court, “..even if the physical server of a company processing data is located outside Europe, EU rules apply to search engine operators if they have a branch or a subsidiary in a Member State”.

The impact on the Search Engines.

With that a serious problem – with significant legal implications – was served to the search engines. Their previous argument that, being their servers located outside the EU, resulted no longer sufficient to avoid the interventions of the DPAs in the EU and the application of the EU privacy provisions.

Once this decision of the CJEU hit the headlines of the international Press, several major search engines found themselves flooded with requests to block access to (or erase) information pertaining to a specific individual from their databases and with lawsuits complaining about improper compliance with the individual’s ‘right to be forgotten’.

The Search Engines were not overly happy to bear the new burdens put onto their shoulders and initially struggled to face and resolve the technical implications involved by the attempt to comply with the indications laid down in the CJEU’s decision.

They were even less happy with the perspective of an obligation of a ‘global’ (i.e. worldwide) enforcement of such right. Hence, they questioned such obligation as soon as they got a chance to do so. In a lawsuit pending between a major search engine and the French Commission nationale de l’informatique et des libertés (CNIL) in front of the Conseil d’État (i.e. the Highest Administrative Court) the following questions came up as relevant for deciding the case and were referred to the Court of Justice of the European Union for clarification (case no. C- 507/17):

- whether the ‘right to de-referencing’, as established in the CJEU’s Google vs. Spain decision should “be interpreted as meaning that a search engine operator is required, when granting a request for de-referencing, to deploy the de-referencing to all of the domain names used by its search engine so that the links at issue no longer appear, irrespective of the place from where the search initiated on the basis of the requester’s name is conducted, and even if it is conducted from a place outside the territorial scope of Directive [95/46/EC] of 24 October 1995?”

- if not, whether such right is to be intended “as meaning that a search engine operator is required, when granting a request for de-referencing, only to remove the links at issue from the results displayed following a search conducted on the basis of the requester’s name on the domain name corresponding to the State in which the request is deemed to have been made or, more generally, on the domain names distinguished by the national extensions used by that search engine for all of the Member States of the European Union?”

- finally, whether such right implies that “a search engine operator is required, when granting a request for de-referencing, to remove the results at issue, by using the ‘geo-blocking’ technique, from searches conducted on the basis of the requester’s name from an IP address deemed to be located in the State of residence of the person benefiting from the ‘right to de-referencing’, or even, more generally, from an IP address deemed to be located in one of the Member States subject to Directive [95/46/EC] of 24 October 1995, regardless of the domain name used by the internet user conducting the search?”

According to the rules governing the proceedings handled by the CJEU, a special advisor (i.e. the Advocate General) is called to provide the Court – through an independent opinion – with suggestions on how the case should be decided. On January 10, 2019 the Advocate General issued his opinion on this case and the search engines felt there were reasons to call ‘victory’ with respect to the AG’s suggestions as to ‘territoriality’. The international Press was eager to report that according to the Highest EU Court the right to be forgotten should apply only within the EU.

To put this into a correct perspective, it seems necessary to remind that the CJEU is by no means obliged to follow the AG’s opinion, which certainly bears its weight and frequently is followed by the Court, but – not resulting ‘binding’ to the judges - has also been disregarded in several cases. Hence, the AG’s January 10, 2019 opinion needs to be analyzed bearing in mind the premise mentioned above.

As to the content of the opinion, fact is that the AG:

- first, noted The EU provisions governing data processing did not specifically address ‘the territorial scope of de-referencing’ and therefore found that search requests made outside the EU should not be affected by the de-referencing of the search results, as EU Law – as a matter of principle and given a few exceptions – should not have effect beyond the borders of the Member States,

- then went on to affirm that the right to be forgotten had necessarily to be balanced against other – equally fundamental – rights, inclusive the legitimate public interest in accessing information, and considered that “in contemporary information society, the right to search information published on the internet by means of search engines is one of the most important ways to exercise that fundamental right. This right undoubtedly covers the right to seek information relating to other individuals that is, in principle, protected by the right to private life such as information on the internet relating to an individual’s activities as a businessman or politician. An internet user’s right to information would be compromised if his search for information concerning an individual did not generate search results providing a truthful reflection of the relevant web pages but a ‘bowdlerised’ version thereof”,

- on such premise, suggested the Court to set the following principles for resolving the dispute brought to its attention: “(1) Directive 95/46/EC of … 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the operator of a search engine is not required, when granting a request for de-referencing, to operate that de-referencing on all the domain names of its search engine in such a way that the links at issue no longer appear, regardless of the place from which the search on the basis of the requester’s name is carried out”, and (2) The operator of a search engine is required to delete the links at issue from the results displayed following a search carried out on the basis of the requester’s name in a place located in the European Union. In that context, that operator is required to take all steps available to him to ensure effective and complete de-referencing. That includes, in particular, the technique known as ‘geo-blocking’, from an IP address deemed to be located in one of the Member States, subject to Directive 95/46, regardless of the domain name used by the internet user conducting the search”.

It will be interesting to see if – and how – the CJEU will follow the AG’s suggestions. The Court’s decision is likely to be available at some point of the current year.

Then the GDPR was approved and came into force.

In May 2016 the EU General Data Protection Regulation no. 679/2016 (GDPR) was approved, coming into force two years later in May 2018.

The Regulation sets (see Article 17) that any data subject has a specific right “to obtain from the controller the erasure of personal data concerning him or her without undue delay..”(with a corresponding controller’ erasure obligation) on certain conditions and among them that of when “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed”. In addition, it also puts onto the controller who has made an individual’s data public an obligation to take ‘reasonable steps’ (inclusive technical measures) to inform third parties about the fact that an individual intends to have personal data deleted.

However, the GDPR also provides a range of exceptions where the ‘right to be forgotten’ faces limitations: one of them relating to cases where data are collected and processed “for exercising the right of freedom of expression and information” (So Article 17/3/a).

The dilemma: how to find the right balance?

From the provisions of the GDPR’s mentioned above it appears that there is an obvious ‘tension’ between the right to be forgotten and the right to offer - and receive – information. The EU lawmakers, while drafting the GDPR did not ‘oversee’ such ‘tension’ nor did they ‘miss’ to give a straight indication on how to approach this problem. The tension – and so the lack of a solution – is therefore deliberate.

Actually, such problem is not new as we find it also in the Charter of fundamental rights of the EU, where an identical ‘tension’ may be found between articles 7 (Respect for private and family life) and 8 (Protection of personal data), on one hand, and article 10 (Freedom of expression and information), on the other hand, and where no clear indication is available about how to resolve potential conflicts between fundamental rights of equal level and relevance, none of which can be hold over the other.

This specific problem did arouse many times and was therefore addressed in various decisions of the European Court of the Human Rights, which had occasion to establish, as general principles, that:

- while deserving both rights, as a matter of principle, equal respect, a correct balance had to be achieved between the right to freedom of expression and press freedom under Article 10 ECHR and the right to privacy under Article 8 ECRH (decision June 27, 2017 in case Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland),

- the following aspects had to be duly considered for assessing whether such ‘correct balance’ had been struck or not: “contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, form and consequences of the publication, and, where appropriate, the circumstances  in which the photographs were taken”, and also “the way in which the information was obtained, its  veracity, and the gravity of the penalty imposed on the journalists or publishers” as a result of their reporting about information impacting on an individual’s private life (Grand Chamber, decision February 7, 2012 in case of Axel Springer AG v. Germany).

Hence, it appears that the issue of whether a ‘necessary balance’ had been struck, should be resolved applying a ‘proportionality’ case-by-case evaluation with respect to the limitations imposed over one of the two fundamental rights in tension.

The Italian Highest Civil Court feels further clarification is necessary.

The Italian Highest Court (“Corte di Cassazione”) was called to deal with this problem several times and had mostly adhered to the principles and criteria established by both, the CJEU as well as the EUtHR.

On March 20, 2018 the First Chamber offered a summarizing overview of the Court’s case-law on the specific issue and found that the fundamental right to be forgotten may have to give way to the – equally fundamental – right freedom of press and information under certain conditions, i.e. when: (1) the content published contributes to a debate of public interest, (2) there is an actual and current interest (for reasons of justice, protection of third parties’ rights, scientific, educational or cultural reasons) to have a specific content diffused, (3) the information published concerns an individual with a high degree of notoriety in public life, (4) the personal information is obtained - and made available – in a correct way, results true, is diffused by means not exceeding a strictly informative purpose, is devoid of personal insinuations or comments (therefore revealing an exclusive and objective interest in a further publication), (5) the individual concerned is offered a suitable in-advance notice about the intent of a republication after a significant amount of time had elapsed since the facts occurred (granting a possibility to reply before the information’s publication).

However, the Third Chamber of the Court now feels that additional clarity is necessary on how to achieve a correct balance between the right to be forgotten and the right to offer - and receive – information, especially after the GDPR has entered into force (on May 25, 2018), introducing specific provisions but leaving in place the – already mentioned – tension between the two rights.

The problem surfaced – once more – as a result of facts published in a weekly column of a magazine reporting about a series of particularly violent crimes occurred within a local community over an extensive period (30-40 years). One of these reports mentioned the name of an individual, who – 27 years earlier – had murdered his wife, was sentenced to jail and had served 12 years in prison. The individual, first, approached to local DPA (unsuccessfully) and, then, sued the magazine for damage compensation, arguing that the republication (together with his name and a picture of himself) of the report referring to sad events he was involved in a distant past, violated his right to be forgotten, had put him to the pillory, lacked of any interest to the public, had a negative impact on his social rehabilitation. The claims were dismissed by the lower courts, which found that:

-  all facts had been reported correctly and in an objective way (with extensive explanation of the claimant’s – then - difficult personal situation),  

- the republication appeared justified as it occurred in the context of an editorial project, analyzing violent crimes occurred in certain geographic area,

- no unnecessary ‘instrumental’ - or ‘disparaging’ - use of the claimant’s past conduct had been performed and no undue media attention had been caused,

- therefore, no improper sacrifice had been imposed on the claimant’s right to be forgotten in the context of a correct exercise of the right to provide information.

Through a temporary decision (no. 28084 of November 5, 2018) the Court acknowledged that its preceding case-law referred entirely to the – no longer effective – statute law provisions implementing Directive no. 46 of 1995. It further considered that achieving a correct balance between the two fundamental rights at stake had a direct impact on how to intend democracy in a modern society, which, on one hand, finds a crucial pillar in freedom of expression and pluralism of information and, on the other hand, cannot renounce the protection of an individual’s personality in its various expressions. Hence, the Third Chamber felt that a correct balance could be struck only if clear and consistent reference criteria were individuated and made available for assessing whether – and how - such goal could be achieved; it therefore referred the case to the Court’s Chief Justice asking the issues to be discussed and resolved by the Joint Chambers of the Supreme Court.

Conclusion.

It will be interesting to see how the Joint Chambers are going to deal with the task of providing ‘clear and consistent criteria’ for balancing an individual’s right to be forgotten against the – also fundamental – right to provide and receive information. As such balancing exercise obviously always depends on the specific characteristics of the case in dispute, I do not expect the Court being able to come up with a ‘standard’ suitable to be applied to all circumstances. Hence, it is likely that the Joint Chambers will stick to the Court’s past case-law and will recall – maybe with some ‘enriching’ additions – the criteria already elaborated and applied in the past. I also feel that that the decision the Court of Justice of the European Union is going to issue with respect the case involving a major search engine and the French CNIL (see above) will have a crucial impact on the future debate around the right to be forgotten. As to the ‘territoriality’ aspect involved by such case, some scholars take the position that the discussion about the possible negative impact on the right to information of a de-referencing obligation (put onto search engines) ‘misses the point’.  They argue that anytime a judicial authority issues an access block order, a certain information remains ‘available’ and may still be found on the Internet just by using search terms different from an individual’s name. What actually happens in such case, is that the name of an individual – covered by an access block order – simply does no longer lead to search results. The content (i.e. the information) relating to a certain event of public interest does not disappear but remains available. Hence, the right to be forgotten should not affect the right to information.