Cass.Civ. - 6806/2023

Cass.Civ. - 6806/2023
Court:	Cass.Civ. (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 17 GDPR
Decided:	07.03.2023
Published:
Parties:
National Case Number/Name:	6806/2023
European Case Law Identifier:
Appeal from:
Appeal to:	Not appealed
Original Language(s):	Italian
Original Source:	Cass.Civ. (Italy) (in Italian)
Initial Contributor:	mg

The Court of Cassation of Italy found that the data subject’s request is a necessary element in the exercise of the right to erasure. The controller cannot be asked to autonomously check whether personal data it stores are still necessary to a debate of public interest.

English Summary

Facts

The data subject was tried and convicted in a criminal proceeding. He served his sentence in prison and started a new life afterwards. He found a job, made new friends and was in a romantic relationship. After some time, his girlfriend and friends became aware of the data subject’s criminal past through an article published on an online newspaper 18 years before the facts at issue. Shocked, they decided to cut any relationship with the data subject.

The data subject asked the controller the removal of the content, which was no longer necessary to pursue journalistic freedom to inform, and compensation for damages suffered due to the publication. The controller removed the article, but refused to compensate the data subject. The controller objected that it did not have an obligation to remove all the contents from its website that were no longer relevant for the public debate.

The court of first instance upheld the controller’s view and rejected the data subject’s claim for damages.

Holding

As the facts dated back to a time when the GDPR was not yet in force, the Court of Cassation denied that the Regulation was applicable at the facts at issue. To the contrary, Directive 95/46/EC regulated the matter. However, the legal reasoning developed by the court substantially follows the structure of Article 17 GDPR and therefore constitutes a relevant interpretation of such a provision.

The Court of Cassation upheld the judgement of first instance. According to the judges, a necessary element in the right to erasure is a gap between a depiction of the data subject which is no longer updated and the current situation of the latter. This gap is assessed from the point of view of the data subject, as they are in the best position to evaluate what does no longer correspond to the present. Therefore, the right to erasure can be activated only by the explicit request of the data subject to the controller.

The court also stressed that an excessively broad interpretation of the right to be forgotten would disproportionately affect the controller, forcing it to check if the content of all its publications is in fact necessary and relevant to a public debate.

As an additional element to support this conclusion, the court cites the CJEU case law, and particularly the judgement in case C-460/20. Here the CJEU stated that it is up to the data subject to prove that the processing of their personal data is no longer necessary and thus information shall be erased under Article 17(3)(a) GDPR. No obligation to investigate about further factual circumstances can be imposed on the controller. Consequently, the right to erasure always necessarily implies a data subject’s request, who should also bear the burden of proof.

In light of the above, the Court of Cassation rejected the data subject’s appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

Civil cassation section I - 07/03/2023, no. 6806


Heading


                     THE SUPREME COURT OF CASSATION
                         FIRST CIVIL SECTION
               Composed of the Distinguished Magistrates:
XXX
XXX

XXX
XXX
XXX
said the following:

                      JUDGMENT
on the appeal registered under no. 24739/2021 RG proposed by:
            L.M., domiciled ex lege in Rome, piazza Cavour at
Chancellery of the Court of Cassation, represented and defended

by the lawyer XXX;
-applicant-
against
ADNKRONOS s.p.a., electively domiciled in Rome, XXX, at the lawyer's office

XXX that
represents and defends him together with the lawyer XXX;
-counter-claimant-
against the sentence of the Court of Perugia n. 378-2021 filed

on 3.3.2021;
having heard the report presented in chambers on 20.2.2023 by
Councilor XXX.




FACTS OF CAUSE


1. With appeal of 23.9.2015 L.M. appealed to the Court of Perugia against the

spa Adnkronos, requesting compensation for damages for the violation of its right

to oblivion pursuant to Legislative Decree no. 196 of 2003, articles 11 and 15, paragraph 2.

The plaintiff made the claim that he had resided for about 18 years a

(Omissis), where he had moved after having served his criminal sentence for crimes in

matter of drugs, constituting a life context completely different from the previous one,
in the context of which he had entered into a romantic relationship and had contracted

new friendships; that the news of the arrest had remained visible on the agency's website
press Adnkronos; that his fiancée had come to know by consulting the internet

with the Google search engine, of the criminal record of the partner, of which she had been

kept in the dark, and had decided to break off the relationship and in a short time even mutual friends had made the same decision; that such circumstances had

engendered in the appellant a strong state of suffering, which then resulted in a crisis
depressive.

Mr. L. added that he had asked (Omissis) Adnkronos to remove the news

from the archive visible on the web and which on (Omitted) the press agency had
communicated to the appellant the cancellation of the aforementioned article. Furthermore
Adnkronos, however, had refused to compensate the damage requested by L. and caused by

failure to timely cancel the news in the period in which it was to be considered
accrued his right to be forgotten because the news had lost its original value

information for users of the Adnkronos site and represented his person in a non-
more in line with current reality.

2. Adnkronos, which appeared in court, objected to the timely removal of the article

after the notice received from the appellant, and noted that, at the time of
publication, the news possessed the characteristics of truth, continence and topicality.

However, the defendant disputed that it was obliged to remove, on its own initiative, dai

its computer archives, all the news that had lost its characters over time
of current events and interest in informing the public without the interested parties

had made any such request.

3. The Court of Perugia, with sentence no. 378 of 3.3.2021, rejected the request of
appellant, stating that the protection of the right to be forgotten does not automatically lead to

for a newspaper organization the obligation to remove or de-index the news,
since the subject's right not to see a version of himself represented
no longer corresponding to reality presupposes an evaluation of non-actuality of

information that cannot be provided except after an express request from the interested party.

According to the Tribunal, it would be extremely burdensome to impose on all content providers a

obligation to check and update all news that could lose relevance e
relevance, so that the responsibility of the digital archive manager must be considered
exists only when there is inertia in the face of a formulated request

by the interested party. The Court of Perugia therefore ruled out the illegality of the conduct of
defendant, valuing the immediate removal of the news following the
request by the present appellant.


4. L.M. filed an appeal against the decision of the Court,
articulating a single reason with which he deduces, in relation to art. 360 c.p.c., n. 3, the violation and false application of articles 2,4,7,11,15,23 of the privacy code (Legislative Decree

no. 196 of 2003), of the art. 6 of directive no. 95/46/EC and of the Constitution, art. 2.

To this end, the appellant refers to those guidelines of the jurisprudence of legitimacy which,
in the reconciliation between the right to be forgotten and the interest of the community in knowing the

done, exclude the obligation to de-index or cancel the news if it remains
a historical interest even many years after the event, as in the hypotheses in
where the story is about famous people. The appellant therefore argues that

case in question there was no interest in preserving the news, concerning
a common citizen, whose legal affairs had ended with the expiation of the

sorry.

Adnkronos s.p.a. and objected in advance
the inadmissibility of the appeal because the objection was initially unfounded

of inadmissibility of the appeal due to the unappealability of the first instance sentences
sanctioned by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph
10.


The Attorney General dismissed the appeal.

The hearing for the oral argument was set and was held on 2023.02.20.



REASONS FOR THE DECISION

6. The objection of inadmissibility of the appeal because it was proposed per saltum in defect of

agreement of the parties, is clearly unfounded, as noted in the order
interlocutory, because the sentence in question is unappealable in accordance with the provisions

by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph 10, e
therefore appealable directly to the Supreme Court.

7. With the defense, Adnkronos also objected to the lateness of the appeal because

proposed only on 10.01.2021 against the sentence published on 03.03.2021, but notified on
14.7.2021, with the purported effect of determining the expiry of the term for appealing
on 13.9.2021.


This affirmation, not cultivated in the oral discussion, is not easy
understandable since the deadline for filing an appeal in cassation, pursuant to art.

325 c.p.c., is for sixty days and therefore only expired on 10.13.2021.8. It should then be specified, to clear the field of possible misunderstandings, that the case

the Regulation 27.4.2016 n. is not applicable ratione temporis 679 of the Parliament
European Union and of the Council on the protection of natural persons with regard to
processing of personal data, as well as the free movement of such data and repealing the

directive 95/46/EC (data protection regulation - GDPR), entered into force
after the events, prior to November 2014.

9. The first of the issues highlighted in the interlocutory order, i.e. if pure

the publisher of the website and not only the manager of the search engine can be held
data controller, is not really the subject of the dispute.


The defendant has raised no objections in this regard and the Court of Perugia reasoned,
implicitly but clearly, in this perspective, so much so as to reject the question
not because it had been proposed against a non-legitimized or titular subject

liability of the disputed relationship, but only because it was held that the responsibility
of the publisher arose only from the failure to promptly activate the request for
intervention by the interested party.


It is therefore only for the sake of completeness that it is observed that there can be no doubt in this
sense in the light of what was stated in the judgment Google Spain C-131/12 which has

stated that the processing of personal data carried out in the context of the activity of a
search engine stands out and adds to that made by website publishers.

In this sense the jurisprudence of this Court is unequivocally deployed

is repeatedly involved in disputes concerning the processing of personal data and the
right to be forgotten promoted precisely against the publishers of the website (Section 3, n. 5525
of 5.4.2012; Section 1, no. 7559 of 27.3.2020; Section 1, no. 9147 of 19.5.2020; and finally,

very recently, Section 1, n. 2893 of 31.1.2023).

10. The second question posed by the interlocutory order pertains to the conditions and to the

content of the intervention requested from the publisher of the website, responsible for the treatment
some data.

With the aforementioned ordinance, the Board questioned the enforceability of an obligation

generalized check on the actuality of the information obtainable from the consultation on
line, both in terms of the quantitative extension of the control, and in terms of
adequate technique to be employed to avoid illegitimate compressions of the right to be forgotten e

at the same time ensure the practicability of the control and preservation of a
information trace suitable for achieving the conservation of historical memory rather

that the permanence of journalistic information.11. For the purposes of the case, this second profile is not relevant for the simple reason that

Adnkronos, at the request of Mr. L. has not limited itself to de-indexing but has
proceeded to the cancellation of the article.

12. It is therefore only for the sake of completeness of examination that the Court recalls that it has

recently reconsidered the jurisprudential orientation that it considered adequate e
de-indexing alone is sufficient protection for the right to be forgotten requested by the data subject
of the article by search engines (expressed with decisions n. 7559 of 27.3.2020, n.

9147 of 19.5.2020 and n. 15160 of 31.5.2021) to affirm with the ordinance n. 2893 of
31.1.2023 that "In terms of the processing of personal data and the right to be forgotten, the

permanence of a press article, legitimately published at the time,
in the computer archive of a newspaper, relating to facts dating back to the time object of
a judicial inquiry, which then resulted in the acquittal of the accused, provided that, upon request

of the interested party, the article is de-indexed and is not available through the common engines
research, but only through the newspaper's historical archive and provided that it is requested
documented by the interested party, a brief information note is affixed to the article, a

margin or at the bottom, which gives an account of the final outcome of the judicial proceeding under
measures that have become final, thus balancing the

law pursuant to the Constitution, art. 21 of the community to be informed and to keep memory of the
historical fact with that of the owner of the personal data stored not to suffer an undue
damage to one's social image.


13. The question of law that needs to be answered and that was asked with the reason
to the Court's attention is whether the website owner's obligation to intervene
presupposes a request from the interested party or instead pre-exists for the mere fact of the

supervening outdatedness of the news due to the passage of time, yes that would be
configurable its liability for compensation for not having done so even in default

of a request from the interested party.

14. The Court considers the response of the Umbrian judge to be correct in the first sense, when the
news (as in this case it is undisputed and was ascertained by the Court with

uncensored ruling) was legitimately published at the time in the presence of
an informative public interest; in this sense this Court has expressed itself precisely with
the aforementioned ordinance no. 2893 of 2023, with reference to articles 16 and 17 of

GDPR (as has been said not applicable ratione temporis to this dispute), which
outline an obligation to intervene without delay, temporally calibrated in relation

at the request of the interested party.

The Court rightly pointed out, in the first place, that precisely because the conduct
harmful consists in the exposure of a no longer current representation of one's person, the perception of the gap between the previous image and the current one is necessary, which

can only be left to the sensitivity and burden of activation of the interested party,
failing to assume the persistent conformity of the news to the current reality.

On the other hand, and in a dutiful balancing of the interests at stake, it would be

excessively burdensome to shoulder the burden of the manager of a digital archive of news
a periodic check of their outdatedness and their outdatedness, in default of any
time parameter set by law and based on completely unknown elements

such as the personal evolution of the subjects involved.

15. In this sense, the European regulation prior to the GDPR already militated, contained

in the EC Directive 24.10.1995 n. 46, applicable ratione temporis.

The art. 12, letter b), required Member States to guarantee to any person
concerned the right to obtain from the data controller, depending on the case, the

rectification, cancellation or blocking of data whose treatment was not
complies with the provisions of the directive, in particular due to its incomplete nature
or inaccurate data; the art. 14, letter a), allowed the interested parties to object, at least in the

cases referred to in art. 7, letters e) and f), at any time, for compelling and legitimate reasons,
arising from their particular situation, to the processing of data concerning them,

unless otherwise provided by national legislation.

In other words, even the European discipline prior to the GDPR behaved in terms of
requests and oppositions of the interested party, thus clearly evoking the need to

an activation on his part.

16. This led, precisely, the Court of Justice, Grand Section, of 13.5.2014-
C-131/12 (judgment "Google Spain") to affirm that the art. 2, lit. b) and d) of the directive

95/46/EC of the European Parliament and of the Council, of 24 October 1995, relating to the
protection of natural persons with regard to the processing of personal data, as well as to

free movement of such data, must be interpreted as meaning that, on the one hand,
the activity of a search engine consisting of finding published or entered information
from third parties on the Internet, in indexing them automatically, in memorizing them

temporarily and, finally, in making them available to Internet users according to
a certain order of preference, must be qualified as "data processing
personal data", pursuant to the aforementioned art. 2, letter b), if such information contains data

personal, and that, on the other hand, the manager of said search engine must be
considered as the "manager" of the aforementioned treatment, pursuant to art. 2,

lit. d), above; and furthermore, that the articles 12, lett. b), and 14, paragraph 1, lett. a), of the
Directive 95/46 must be interpreted as meaning that, in order to respect the rights established by those provisions, and provided that the conditions set by them are

actually satisfied, the operator of a search engine is obliged to suppress,
from the list of results that appears following a search carried out starting from the name of
a person, links to web pages published by third parties and containing information

relating to this individual, even if such name or such information does not
are previously or simultaneously deleted from the web pages in question, e
this possibly even when their publication on such web pages is in itself

lawful.

17. The national legislation, contained in the so-called Privacy Code, pursuant to Legislative Decree no.

6/30/2003 no. 196, even before the changes made with Legislative Decree no. 10.8.2018 n.
101, for the adaptation to the GDPR, clearly and unequivocally assumed that i
rights due to the interested party were exercised with activation on his part with a

specific request.

The art. 7 was structured in terms of the right of the interested party to obtain the intervention of the
data manager.


The art. 8 gave the interested party the right to obtain confirmation of the existence or not of
personal data concerning him, even if not yet registered, and theirs

intelligible communication.

The art. 9 governed the request addressed to the owner or manager in its possibilities
operating modes.


18. These conclusions are corroborated by the very recent ruling of the Court of
EU Justice, Grand Section of 8.12.2022 - C-460, actually focused on the content
of the burden of proof weighing respectively on the owner of the personal data and on the manager

of the site, and which nevertheless takes for granted the need for a request from the interested party
and within certain limits of proof on his part.


The European Court has in fact dealt with establishing whether and to what extent it pertains to the person
who submitted the de-listing request provide evidence for
corroborate his claim regarding the inaccuracy of the information included in the

content mentioned and on the other hand whether the operator of the search engine should itself
try to clarify the facts in order to ascertain the accuracy or otherwise of the information
allegedly inaccurate contained therein.


As to the obligations incumbent on the person requesting de-listing for
the inaccuracy of an indexed content, it was considered that it was up to it to prove

the manifest inaccuracy of the information appearing in said content or, at least, of a part of this information which is not of a secondary nature with respect to

to the entirety of this content.

However, in order to avoid an excessive burden capable of undermining the practical effect of the right
upon de-listing, the applicant is only required to provide evidence

which, taking into account the circumstances of the case, may reasonably be
required in order to demonstrate such a manifest misstatement; the applicant, therefore, is not
required, in principle, to produce, right from the pre-litigation stage, in support of the

your request for de-indexing to the search engine manager, a decision
jurisdiction, also arising from summary proceedings. Imposing an obligation

such a person would, in fact, have the effect of placing a burden on him
unreasonable.

In addition the manager of the search engine, in order to verify, following a request for

de-indexing, whether a piece of content can continue to be included in the list of
results of searches made using its search engine, must be based
on all the rights and interests at stake as well as on all the circumstances of the case of

species. However, in the context of the evaluation of the conditions of application of which
to art. 17, paragraph 3, letter a), of the GDPR, the manager cannot be required to carry out

an active role in the search for elements of fact that are not substantiated by the request for
cancellation, in order to determine the validity of this request.

Therefore, when processing such a request, it cannot be imposed on the

operator of the search engine concerned an obligation to investigate the facts and to
to this end, organize a contradictory exchange with the content provider,
aimed at obtaining missing elements regarding the accuracy of the indexed content.

This obligation would force the operator of the search engine itself to contribute to
prove the accuracy or otherwise of the mentioned content and would burden him a

burden that exceeds what can reasonably be expected from it in the light of
its responsibilities, competences and possibilities, and would therefore involve a serious risk
that contents that respond to a legitimate and preponderant one are de-indexed

need for information of the public and that it therefore becomes difficult to find them on the Internet.

In this respect, there would be a real risk of a deterrent effect on the exercise of the right
freedom of expression and information if the manager of the search engine proceeded to

such a de-indexing in an almost systematic way, in order to avoid
having to bear the burden of investigating the relevant facts to ascertain the accuracy or not

of the indexed content. Therefore, in the event that the subject who has submitted a request for de-indexing

provide relevant and sufficient evidence, suitable to substantiate your request and documents
to demonstrate the manifestly incorrect nature of the information included in the
indexed content or, at least, a portion of that information that does not have a

secondary character with respect to the totality of such content, the manager of the engine
research is required to accept this request for de-indexing. The same is true if
the interested party makes a judicial decision taken against the site publisher

Internet is based on the observation that information included in the indexed content,
which do not have a secondary character with respect to the totality of the latter, are,

at least at first glance, inaccurate.

Conversely, in the event that the inaccuracy of such information included in the content
indexed does not manifestly appear in the light of the evidence provided

by the interested party, the operator of the search engine is not required, in the absence of one
judicial decision, to grant such a request for de-listing. In the case of
an administrative or judicial proceeding is initiated concerning the alleged claim

inaccuracy of information included in an indexed content and the existence of such
procedure has been brought to the attention of the manager of the search engine referred to

question, it is the responsibility of the manager, in order to always provide Internet users with information
relevant and up-to-date, add a warning in your search results
concerning the existence of such a proceeding.


It is so evident that European jurisprudence presupposes and implies
necessarily an activation fee on the part of the interested party, provided that the
content originally posted was lawful, as well as a reasonable contribution

evidentiary.

19. It must therefore be concluded that the appeal is unfounded, since it cannot be considered that

Adnkronos was required to eliminate from its archive the news of the arrest of Mr. L.,
legitimately published at the time, prior to your request, promptly
satisfied.


The objection proposed by the appellant in the context of
oral discussion, based on the onerousness of the initiative thus required of the subjects
interested.


Beyond the textual data, the proposition of the request requires neither formality nor
technicalities and does not require recourse to a technical defense or consultants of any kind

and consequently does not generate any additional cost. On the contrary, it would be the imposition on the managers of a periodic sounding of

information at the time legitimately published to impose a burden on managers
unsustainable and fraught with consequences for freedom of information.

20. In this regard, the Court considers enunciating the following principle of law:


"On the subject of the processing of personal data and the right to be forgotten, also in the regime
previous to EU Regulation 27.4.2016 n. 679 (GDPR), applicable ratione temporis,
the operator of a website is not obliged to ensure, as the case may be, the

deletion, de-indexing or updating of a press article, on its own
legitimately published time, even if relating to facts dating back to the time, in defect

of request of the interested party which is the only one to give rise to the obligation of the manager to
act without delay."

21. The appeal must therefore be dismissed.


The expenses follow the unsuccessful outcome, liquidated as in the device. It is also necessary
provide that, in the event of use of this ordinance, the indication is omitted
of the personal details and other identification data of the parties indicated in the order.



P.Q.M.


The court:

rejects the appeal and orders the appellant to pay the costs in favor of the
counter-claimant, settled in the sum of Euro 3,000.00 for fees, Euro 200.00 for

exhibited, 15% reimbursement of general expenses, plus statutory accessories.

Pursuant to the D.P.R. no. 115 of 2002, art. 13, paragraph 1 quater, inserted by law no. 228 of

2012, art. 1, paragraph 17, acknowledges the existence of the procedural conditions for the
payment, by the appellant, of the additional amount by way of unified contribution
equal to that due for the appeal, pursuant to paragraph 1-bis of the same art. 13, where

due.

Provides that, in the event of use of this ordinance, the indication is omitted
of the personal details and other identification data of the parties indicated in the order.


Thus decided in Rome, in the council chamber of the First Civil Section, on 20 February
2023.


Filed in the Registry on 7 March 2023