Case Summary and Outcome

The Italian Supreme Court held that Google did not have to de-index search results of an individual as the individual had not provided details of the information he wished to be removed. After a lower court ordered Google to remove all results related to the individual as the information was no longer publicly relevant, Google had appealed to the Supreme Court. The Court acknowledged that the right to be forgotten can impose an obligation on search engines to remove information from its search results, but found that the request in this case was too generic and did not enable Google to sufficiently identify and de-reference the content which allegedly violated the individual’s right.

Facts

In 2016, an Italian man, B.R. filed an action against Google Inc. before the Court of First Instance of Spoleto, Italy, requesting all results containing his name be deleted from Google’s search results. B.R. claimed that the presence online of these newspaper articles regarding a past event in which he was involved was disproportionate and exceeded the purpose for which the articles were originally published. He also demanded compensation from Google. Google responded that B.R. did not specifically indicate the URLs (uniform resource locator) that he wanted the search engine to delete, and that there was still a relevant public interest in the information provided about him.

On December 14, 2016, the Court of First Instance of Spoleto established that – given the amount of time passed – there was no longer a public interest in the information published about B.R. and ordered the deletion of all the results concerning him. However, it rejected the B.R’s request for damages.

Google appealed the decision before the Supreme Court.

Decision Overview

The central issue for the Supreme Court’s determination was whether Google had an obligation to de-index any information related to B.R. in search results.

Google argued that the Spoleto Court had violated Article 15 of the European Union’s Electronic Commerce Directive, 2000/31/CE and Article 17 of the Italian Legislative Decree n. 70 of 2003, by issuing a generic order which would have requested Google, in the capacity as an internet service provider (ISP), to actively search and monitor content allegedly harmful to B.R.’s right to be forgotten, without having a URL as guiding identifier. It stated that the only way to indicate content online precisely is by referring to its URL, and without that Google would be forced to preventively monitor all the content accessible through it. Google submitted that the generic order was also in violation of Article 17 of the European Union’s General Data Protection Regulation (Regulation 2016/679).

The Court confirmed that a URL univocally designates the address of a resource on the network: in the present case, the reference would be to the URLs that can be found through Google searches that refer to B.R. The Court noted that Article 15 paragraph 1 of the Electronic Commerce Directive states that “Member States shall not impose a general obligation on providers … to monitor the information which they transmit or store, nor a general obligation to actively seek facts or circumstances indicating illegal activity’. The Court held that Google fell under this provision. The Court referred to the Court of Justice of the European Union (CJEU) cases, Scarlet Extended v SABAM and SABAM v. Netlog, which had ruled out the imposition on an ISP of a preventive and generalized filtering system capable of identifying files containing musical, cinematographic or audiovisual works in respect of which the applicant claims to hold intellectual property rights. The Court commented that in the field of intellectual property, the CJEU in Google France v. Louis Vuitton and L’Oréal v. eBay had held that an ISP provider cannot be held liable for the data it has stored at the request of an advertiser, unless, having become aware of the unlawful nature of such data or of the activities of that advertiser, it failed to promptly remove such data or to disable access to them.

The Court acknowledged that an obligation to intervene has been recognized in the field of the right to be forgotten which requires that the ISP may have to delete links to webpages of a third party from search results of an individual. Here, the CJEU in Google Spain v. AEPD had held that the obligation to intervene is based on the fact that the activity of the search engine – that is, finding information published or entered by third parties on the internet, automatically referencing it, storing it temporarily, and then making it available to online users according to a certain order of preference – must be qualified as processing of personal data and so search engines must comply with data protection law. The Court stated that the search engine must be provided precise information regarding the contents it has to delete, in order for it to be able to comply with its obligation, and that from a procedural point of view, indicating the URLs of the content is necessary in order to clearly define the petitum (i.e., the object of the request). This is true in light of the fact that Google’s obligation to intervene is not absolute and unlimited: it is conditioned by the possibility of taking note of the interference of the rights of a person, to privacy and to be forgotten through the search engine’s activity. A generic complaint, which does not identify the information affecting the right of the individual to the protection of personal data makes the intervention of the service provider very demanding.

The Court noted that in the Google Spain case, the CJEU ruled: “inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life”.

Accordingly, the Court found that failing to identify the information (the content resulting from searching B.R.’s name) made B.R.’s complaint indefinite because a request must contain all the factual elements which would allow the balancing between the right to be forgotten and the right to inform. The Court described this balancing exercise as the pivotal moment of a judge’s decision on whether or not to order de-referencing.

In respect of Google’s claim that a search engine could intervene and comply with its obligation exclusively when the person claiming the right to be forgotten has provided the URLs of the contents violating the right to privacy, the Court noted that URLs are normally the most appropriate means to identify the content object of the deletion request but this does not exclude that in some circumstances, when URLs are not provided, it is still possible to identify the content whose deletion is requested (for example by indicating keywords used in searches). If the indication is sufficiently specific, the URLs may not be necessary and failing to indicate them would not automatically entail the introductory act’s invalidity.

The Court held that B.R. failed, however, to comply even with this broader formulation of the duty to indicate the content which needs to be de-referenced or deleted. His introductory document, which referred to “all the results appearing upon typing the words ‘Don B.R.’”, was absolutely generic and did not make it possible to readily identify the content whose removal was requested.

Accordingly, the Supreme Court reversed the ruling of the Court of First Instance of Spoleto.