29 May The right to be forgotten in the online context: application and limitations
Authors: Francesca Tugnoli, Eleonora Margherita Auletta
Online publications: Everyday life
When news is published online, it is not easy to have control over it, especially if you decide to delete it in the future. In fact, while the right to be forgotten is an inviolable right, it has only been precisely specified in numerous rulings by the Court of Justice of European Union and Data Protection Supervisory Authorities.
Regulatory evolution of the right to be forgotten in the online context
The right to be forgotten[1] was first recognized in 1998, when the Court of Cassation affirmed the “interest of every person in not suffering further damage to their honor and reputation as a result of the online publication of news that has been unlawfully disclosed in the past”.[2] In an evolving world it is therefore necessary to grant the right to be forgotten to protect individuals.
When one talks about the deletion of online content, one thinks about the erasure of content which is published on the internet. De-indexing, however, technically refers to the removal of online content and the requirement that such content should only appear following a very in-depth text research activity. This means that personal data is not deleted and may still be accessible to those who are willing to take a deep dive into archives. The right to be forgotten was affirmed for the first time in the decisions of the European Union Court of Justice in the Google Spain SL and Google Inc vs Agencia Española de Protección de Datos and Mario Costeja González[3] case which highlighted that “the activity of a search engine as a provider of content which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference” entails the processing of personal data. In that regard, the operator of a search engine must be considered to be a controller in respect to the processing of personal data. This is because it “collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results”.
In relation to such processing activities, the data subject has the right to the de-indexing which is understood as the right to have the information referred to him and published online “ not linked to his name from a list of results appearing after a search made from his name”. This is a fundamental right, which therefore takes precedence over the economic interest of a search engine operator and also, over the opposing right of publicity of news.
If the data subject demands for the right to be de-indexed, their right must be concretely confronted with the factual circumstances.[4] A number of criteria[5] should be taken in consideration, in particular:
-
-
-
- Whether it is a matter of public interest.
- The popularity of the person that such data concerns.
- The subject of the report.
- The prior conduct of that person.
- The content, form and consequences of publication.
- The manner and circumstances in which the information was obtained.
- And the truthfulness of the information.
-
-
Limits to the right to de-indexing
When one talks about the Article 17(1) of the European Regulation No. 679/2016 (“Regulation”), they frequently interpret the terms “forget” and “erasure” as synonyms. This overlapping, however, must be considered to be improper since they are, in fact, different terms. Indeed, the objective to be forgotten can be pursued through the exercise of the right to erasure[6].
The European Data Protection Board (EDPB), in its Guideline no. 5/2019, clarified the limits to the right to de-indexing[7]. Firstly, it is possible to obtain the right to de-indexing in the circumstances referred to in Article 17(1) of the Regulation, i.e. when the processing of personal data is no longer necessary. This happens, for instance, when a long time has passed from the publication of the facts described in the indexed news item and therefore, that information is outdated and not updated.
These provisions are not appliable in cases where, pursuant to Article 17(3) of the Regulation, the storage of personal data is necessary for:
-
-
-
- Exercising the right of freedom of expression and information.
- For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- For reasons of public interest in the area of public health.
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
- For the establishment, exercise or defense of legal claims.
-
-
At national level, the Italian Data Protection Authority (“Italian DPA”) has been consulted [8] multiple times to assess the lawfulness of the rejection by the search engine operator in response to a de-indexing request made by a data subject. The Italian DPA has consistently upheld the interest of the data subject, when considering the balance between the data subject’s right to be forgotten and the public interest. In fact, it has considered the parameters clarified above, such as the time elapsed since the publication of the event and the current relevance of the news.
De-indexing in criminal law: a ‘potential’ right to support the presumption of innocence
In our legal system, it is increasingly common for the person under investigation to exercise their right to de-indexing of the information related to criminal proceedings. This right has been partially enshrined with the well-known Cartabia reform and in particular, in the Legislative Decree no. 150 of 10 October 2022 (Cartabia Law), which amended Article 64-c of the implementing provisions of the Code of Criminal Procedure[9] and introduced the right to obtain the de-indexing of measures in the event of:
-
-
-
- An Acquittal.
- Judgement not to proceed.
- A Dismissal.
-
-
In such cases, the person concerned may not only request to not have the information published when the acquittal or dismissal order is issued but also, may request that it be de-indexed when it has already been disseminated online.
The new legislation in fact enshrines the conditions under which the person concerned has the right to obtain the de-indexing of measures (or the non-indexing thereof). This supersedes the previous approach that referred this assessment to the Data Protection Authority and to the judicial authority to be carried out, on a case-by-case basis, in light of the balance of opposing needs. This new approach, however, does not concern the right to de-indexing content itself which was previously enshrined in European case law and implemented by the national authorities (Data Protection Authority and Judicial Authority). It concerns the right to prevent the news from being disseminated online from the onset, based on searches of the suspect’s name, thanks to the inhibitory order by the Court.
In this way, for the first time, preventive protection is provided to the person concerned, which contributes to the individual’s right not to be associated with criminal proceedings. This attempts to provide protection to an equally inviolable right such as that of the presumption of innocence.[10]
From a practical-operational point of view, in order to obtain the de-indexing of content, the interested party must apply to the office of the clerk of the judge who issued the order. The clerk will then provide the necessary formula[11] depending on whether the de-indexing or non-indexing of the content is requested. The data subject may then apply to the search engine provider, who will have to act on the order without assessing the merits of the request. In any case, the provider is not required to act on his own volition but rather will be required to act upon the express request of the interested party.[12]
Conclusion: Legislative paradox
In spite of the above guarantees, the most relevant issue related to ‘digital memory’ today concerns the difficulty of not deleting so much out of the original source of a content as the countless republications that sometimes remain accessible.
To sum up, one question arises spontaneously: is the right to be forgotten just an end to be strived for, or is it a right that may one day receive real and effective protection?
Only time will tell.
[1] The right to be forgotten, as an expression of the right to confidentiality and protection of personal data, is an absolute right, and as such it is enshrined both at the national level, within the framework of personality rights under Article 2 of the Italian Constitution and within the Privacy Code, and at the European level, through the EU Regulation No. 2016/679 (Article 17).
[2] See Marini M., Oblio, deindicizzazione e processo penale: dal diritto eurounitario alla riforma Cartabia, in “Sistema Penale”, 1/2023, https://www.sistemapenale.it/pdf_contenuti/1673254919_marini-2023a-oblio-deindicizzazione-processo-penale.pdf, p.7.
[3] See Court of Justice of the European Union, Grand Chamber, 13th May 2014, Google Spain SL and Google Inc vs Agencia Española de Protección de Datos e Mario Costeja González, C-131/12, at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62012CJ0131 .
[4] For more information about the sentence of the Court of Justice, see Guidelines on the implementation of the Court of Justice of the European Union judgment on “Google Spain and Inc v. Agencia Epañola de Protección de Datos (aepd) and Mario Costeja González” c-131/12 here.
[5] See, in the same sense, European Court of Justice, 27th June 2017, Satakunnan Markkinapörssi Oy e Satamedia Oy c. Finlandia, CE:ECHR:2017:0627JUD000093113, § 165 and also the decision of 24th September 2019, GC e a. (de-index of sensitive personal data), C‑136/17, EU:C:2019:773, § 60 and decision of Costeja cause n. C-131/12, of 13th May 2014, par. 88.
[6] See Bolognini L., Pelino E., Codice della disciplina della privacy, Giuffrè.
[7] Another hypothesis in which the data subject would be entitled to obtain the de-indexing of their personal data could be when they withdraw their consent to the processing of their data, on the assumption, however, that the search engine operator has used that legal basis (consent) for the processing of such personal data. Another case might be where the data subject objects to the processing of their data pursuant to Article 21 of the Regulation. In such circumstances, therefore, the search engine operator must provide for de-indexing unless there is a compelling legitimate reason that overrides the data subject’s rights and freedoms. In other words, a balance must be struck between the data subject’s right to have the news de-indexed and the search engine provider’s right to maintain it. Finally, it is possible to obtain de-indexing when personal data has been unlawfully processed, i.e., in the absence of a legitimate basis for processing.
[8] See https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9491078; https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9491061
[9] To see the opinion of the Data Protection Authority about the reform, see https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9802612
[10] See Art. 111 of the Constitution.
[11] The wording is as follows: ‘pursuant to and within the limits of Art. 17 of Regulation (EU) 2016/679 […], the indexation of this measure is precluded with respect to searches conducted on the internet network from the applicant’s name” or in the case of a request for de-indexing the formula to be affixed will be: “This order constitutes grounds for obtaining, pursuant to and within the limits of Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, an order to preclude the indexation by generalist search engines of content relating to the criminal proceedings, with respect to searches conducted from the petitioner’s name”.
[12] See Court of Cassation, Section I, decision of 7th March 2023, no. 6806, in https://www.federprivacy.org/strumenti/accesso-ristretto/diritto-all-oblio-vecchie-notizie-da-cancellare-dal-web-solo-su-richiesta
