Access to Public Information, Privacy, Data Protection and Retention
Magyar Helsinki Bizottsag v. Hungary
Decision Pending Expands Expression
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
On February 8, 2022, the Italian Supreme Court reversed the ruling of the Court of First Instance of Milan, which had upheld the legality of a measure issued by the Italian Data Protection Authority against Yahoo! search engine. On the basis of Mr. D.B.C.’s right to be forgotten, the measure had ordered Yahoo! to de-reference and delete the cache copies of internet content related to him. The Supreme Court considered, instead, that the removal of the cache copies would be disproportionate and that de-referencing alone was sufficient.
Under Article 152 of Legislative Decree no. 196 of 2003, Yahoo!Emea Limited and Yahoo!Italia s.r.l. (hereinafter “Yahoo”) brought an action before the Court of First Instance of Milan against the measure issued by the Italian Data Protection Authority on February 25, 2016.
On April 22, 2015, the plaintiff, Mr. D.B.C. requested that Yahoo remove certain content (specifically identified via URLs) from its search results on the basis of his right to be forgotten. This content referred to a judicial proceeding in which he was involved but that, in his submission, was no longer of interest to the general public.
Yahoo replied that it could not proceed with the requested deletion as the search engine was not the data controller.
D.B.C. brought an action to the Italian Data Protection Authority which accepted his request, ordering Yahoo to delete the content in violation of his right to be forgotten.
On January 15, 2016, the Court of First Instance of Milan rejected Yahoo’s appeal against the order. The Court considered it lawful for the Authority to issue an order against an Irish company. It based this finding on the following authorities:
The Judge pointed out that, according to the caselaw of the Court of Justice of the European Union (CJEU), the data subject’s fundamental right to be forgotten shall prevail both over the economic interest of the search engine, and over the interest of the general public in finding information on the data subject upon searching for his name online. In the Court’s opinion, Yahoo had merely contested whether Mr. D.B.C.’s right prevailed, without providing clear information concerning the general public’s interest in being able to access information on the criminal proceedings involving Mr. D.B.C. Finally, the Court observed that the measure issued by the Italian Data Protection Authority was aligned with principles inspiring the General Data Protection Regulation (Regulation EU 2016/679).
Yahoo appealed the decision of the Court of First Instance, submitting that:
The Supreme Court considered the first two objections to be unfounded. It observed that the dispute was not a matter of jurisdiction, but rather that it concerned the power of the Italian Data Protection Authority (an administrative body) to issue a measure addressed to a foreign (in this case, Irish-registered) company. It held that the EU legislation on jurisdiction and on a right to effective remedy was irrelevant.
On the third submission, the Court assessed the powers of the Italian Data Protection Authority to issue a measure addressed to a foreign company (Yahoo! EMEA). Specifically, it examined whether Article 4(1)(a) of Directive 95/46 should be interpreted as permitting the application of Italian data protection law rather than that of Ireland, the Member State in which the controller is registered. The Judges relied on the following principles and rules of the Court of Justice of the European Union:
Reading these three principles together, the Supreme Court upheld the Court of First Instance’s finding that the matter fell precisely within the scope of the CJEU’s rulings Google Spain and Weltimmo.
As a matter of fact, the Court found that Yahoo! Italia had provided support services to Yahoo! EMEA and the latter used its Italian establishment to promote and sell advertising space offered by that engine. Accordingly, the Judges ruled that the processing of personal data under analysis is subject to Italian provisions because it was carried out in the context of an establishment of the data controller located in the Italian territory.
The Court rejected Yahoo’s fourth objection, in light of the first principle explained above, according to which the operation of loading personal data on an internet page constitutes processing of personal data.
The fifth objection of Yahoo, the disproportionality of the Data Protection Authority’s order to delete the cache copies in addition to de-referencing, was accepted by the Judges.
Recalling the caselaw of the Supreme Court’s United Sections, the Court asserted the place of de-referencing of internet results as part of the right to have personal data deleted. The latter was considered one of three manifestations of the right to be forgotten, the other two manifestations being (1) the right not to see a piece of news republished after a significant period of time when it has been lawfully disclosed in the past and (2) the right to have lawfully published information contextualized.
The Court observed that, in the internet era, it is natural that information can be easily found after a significant period of time and that the remedy of de-referencing has gained increased relevance in that allows the name of the person involved in a certain event to be detached from the memory that the internet keeps of it. De-referencing protects the interest of the data subject not to be found easily on the internet while protecting the general public’s right to information on the specific event involving that subject (when his or her involvement is no longer specifically relevant).
The Judges, again, referred to the decision of the CJEU in Google Spain. There, the Luxembourg Court, with regards to de-referencing, stated:
In light of the CJEU’s caselaw, the Supreme Court affirmed that de-referencing a result strikes a fair balance between rights in that “it excludes the two alternative and extreme solutions that may come into play, namely, the choice to leave everything as it stands, and the choice to completely delete the information from the web, by removing it from the website in which it was located”. De-referencing does not fully delete information from the internet. It can still be found by directly accessing the website where it is “contained” or by inserting keywords that differ from the name of the data subject. In the CJEU’s words, “the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name” (Google Spain, 99). Conversely, deleting the cache copies would prevent internet users from accessing the information altogether and not only from accessing the information by typing the name of the data subject. Thus, they might be prevented from accessing information which remains relevant, even when the involvement of the data subject no longer is. The Court expressly stated that “the deletion of cache copies relating to information accessible through the search engine, insofar as it affects the ability of the search engine to provide an answer to the query posed by the user by means of one or more keywords, does not directly follow from the existence of the conditions necessary for the de-referencing; instead, to proceed with the deletion, it is necessary to strike a fair balance between the right to be forgotten of the data subject with the right having as its object the disclosure of information, concerning the fact in its entirety, through key words also different from the name of the data subject”.
The Supreme Court, accepting the fifth complaint, ruled that the decision of the Court of First Instance of Milan should not be upheld.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
The decision expands expression by considering the de-referencing of the content involving the data subject’s name to be sufficient. It reversed the ruling of the Court of First Instance which had considered proportionate the Italian Data Protection Authority’s order to delete the cache copies of the content.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Arts. 2 and 4
Case significance refers to how influential the case is and how its significance changes over time.
The decision has particular relevance in that: 1) it established that the Italian Data Protection Authority lawfully intervened against a foreign company (Irish Yahoo!); 2) it consolidated its preceding caselaw regarding the use of de-referencing as a proportionate remedy which strikes a fair balance between the right to be forgotten of a data subject and the right of the general public to be informed.
Let us know if you notice errors or if the case analysis needs revision.