IDPC (Malta) - CDP COMP 144 2022: Difference between revisions

Latest revision as of 10:34, 29 November 2023

IDPC - CDP_COMP_144_2022

Authority:	IDPC (Malta)
Jurisdiction:	Malta
Relevant Law:	Article 17 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	CDP_COMP_144_2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	CDP_COMP_144_2022 (in EN)
Initial Contributor:	sh

The Maltese DPA ordered a media company to add a no-index metatag to a news article within 20 days. This act fulfils a data subject's right to be forgotten under Article 17 GDPR.

English Summary

Facts

A data subject asked the Maltese DPA to order a media company (the controller) to remove a published article from its website. The article linked his name (as the executive of a gambling company at the time) to organised crime syndicates and the subsequent removal of betting licenses for gambling companies. This meant that when people searched for terms like 'mafia,''mob,' or 'gambling,' his name was likely to come up. The controller responded to the complaint, arguing to the DPA that the data was processed for journalistic purposes. The removal of the aforementioned article would jeopardize the right to free expression and information. Furthermore, the suspension of betting licenses has been the subject of Maltese court cases. Case reporting is also afforded journalistic privileges under national law.

Holding

The Maltese DPA saw its task as balancing the right of the data subject to be forgotten (Article 17 GDPR) with the right to freedom of expression and information. This requirement to strike a fair balance between the two is also specifically required by Article 9 of Malta's Data Protection Act.

First, the Maltese DPA made a distinction between search engines like Google and the Controller, a media company. A democratic society requires the media to disseminate information that is in the public interest. The latter is an online search engine that crawls the web in order to look up kex words entered by the user and returns results in the form of a list. As the complaint was only lodged against the controller, the DPA's investigation was strictly limited to them.

Second, the DPA used case law to inform its choice. It concluded that the CJEU judgements of Lindqvist, Satamedia and Buivids do not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In abscence of this, the DPA turned to ECHR case law which throughout the years has developed a standard set of criteria. These include, among others, the controbution to the debate of public interest, the degree of notoriety of the person affect and the consequence of the publication. As the publication in question contained sensitive data about criminal proceedings and had not been updated despite developments in the case, the DPA deemed the right to be forgotten to be more important than the controller's right to disseminate information.

More importantly for the DPA, the ECHR recently distinguished between de-indexing and the permanent removal of an article under the right to be forgotten in Biancardi v Italy. As a result, the DPA was not required to order the deletion of the article in order to comply with the right to be forgotten. The DPA also considered the case Hurbain vs. Belgium, in which the ECHR emphasized the importance of digital archives in today's world. These must be upheld in order for the press to fulfill its role as a public watchdog. As a result, the press must be able to keep public archives containing previously reported news.

Taking these two recent decisions into account, the DPA ordered the media company to add a no-index metatag to the content head HTML of the case's online page. In this way, the complainant's fundamental rights were respected because his name was removed from the search engines' index, which meant that his name would no longer appear alongside the related key words about which he complained. At the same time, the controller's journalistic freedom is preserved because the article's original content remains unaltered. The controller was given 20 days to comply.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

@@ Line 59: / Line 59: @@
 }}
-The Maltese DPA ordered a media company to add a no-index metatag to an news article within 20 days. This act fulfils a data subject's right to be forgotten under [[Article 17 GDPR|Article 17 GDPR.]]
+The Maltese DPA ordered a media company to add a no-index metatag to a news article within 20 days. This act fulfils a data subject's right to be forgotten under [[Article 17 GDPR|Article 17 GDPR.]]
 == English Summary ==
 === Facts ===
-A data subject asked the Maltese DPA to order a media company (the controller) to remove a published article from its website. The article linked his name (as the executive of a gambling company at the time) to organised crime syndicates and the subsequent removal of betting licenses for gambling companies. This meant that when people searched for terms like<nowiki>'mafia,''mob,' or 'gambling,'</nowiki> his name was likely to come up.
+A data subject asked the Maltese DPA to order a media company (the controller) to remove a published article from its website. The article linked his name (as the executive of a gambling company at the time) to organised crime syndicates and the subsequent removal of betting licenses for gambling companies. This meant that when people searched for terms like <nowiki>'mafia,''mob,' or 'gambling,'</nowiki> his name was likely to come up. The controller responded to the complaint, arguing to the DPA that the data was processed for journalistic purposes. The removal of the aforementioned article would jeopardize the right to free expression and information. Furthermore, the suspension of betting licenses has been the subject of Maltese court cases. Case reporting is also afforded journalistic privileges under national law.
-The controller responded to the complaint, arguing to the DPA that the data was processed for journalistic purposes. The removal of the aforementioned article would jeopardize the right to free expression and information. Furthermore, the suspension of betting licenses has been the subject of Maltese court cases. Case reporting is also afforded journalistic privileges under national law.
 === Holding ===
-The Maltese DPA saw its task as balancing the right of the data subject to be forgotten (Article 17 GDPR) with the right to freedom of expression and information. This requirement to strike a fair balance between the two is also specifically required by Article 9 of Malta's Data Protection Act.
+The Maltese DPA saw its task as balancing the right of the data subject to be forgotten [[Article 17 GDPR|(Article 17 GDPR)]] with the right to freedom of expression and information. This requirement to strike a fair balance between the two is also specifically required by Article 9 of Malta's Data Protection Act.
-The controller (a media company) and search engines such as Google were distinguished in the Maltese DPA. A democratic society requires the media to disseminate information that is in the public interest. The latter is an online search engine that crawls the web in order to look up kex words entered by the user and returns results in the form of a list. Because the complaint was only lodged against the controller. The DPA's investigation was strictly limited to them.
+First, the Maltese DPA made a distinction between search engines like Google and the Controller, a media company. A democratic society requires the media to disseminate information that is in the public interest. The latter is an online search engine that crawls the web in order to look up kex words entered by the user and returns results in the form of a list. As the complaint was only lodged against the controller, the DPA's investigation was strictly limited to them.
-The DPA at first looked at CJEU case law to guide its decision and concluded that the judgements of Lindqvist, Satamedia and Buivids do not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In abscence of this, the DPA turned to ECHR case law which throughout the years has developed a standard set of criteria. These include, among others, the controbution to the debate of public interest, the degree of notoriety of the person affect and the consequence of the publication. As the publication in question contained sensitive data about criminal proceedings and had not been updated despite developments in the case, the DPA deemed the right to be forgotten to be more important than the controller's right to disseminate information.
+Second, the DPA used case law to inform its choice. It concluded that the CJEU judgements of Lindqvist, Satamedia and Buivids do not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In abscence of this, the DPA turned to ECHR case law which throughout the years has developed a standard set of criteria. These include, among others, the controbution to the debate of public interest, the degree of notoriety of the person affect and the consequence of the publication. As the publication in question contained sensitive data about criminal proceedings and had not been updated despite developments in the case, the DPA deemed the right to be forgotten to be more important than the controller's right to disseminate information.
 More importantly for the DPA, the ECHR recently distinguished between de-indexing and the permanent removal of an article under the right to be forgotten in [https://hudoc.echr.coe.int/eng#{%22itemid%22:&#x5B;%22001-213827%22&#x5D;} Biancardi v Italy]. As a result, the DPA was not required to order the deletion of the article in order to comply with the right to be forgotten. The DPA also considered the case [https://hudoc.echr.coe.int/fre#{%22tabview%22:&#x5B;%22document%22&#x5D;,%22itemid%22:&#x5B;%22001-210884%22&#x5D;} Hurbain vs. Belgium,] in which the ECHR emphasized the importance of digital archives in today's world. These must be upheld in order for the press to fulfill its role as a public watchdog. As a result, the press must be able to keep public archives containing previously reported news.