Cass.Civ. - 6806/2023
From GDPRhub
| Cass.Civ. - 6806/2023 | |
|---|---|
 | |
| Court: | Cass.Civ. (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 17 GDPR |
| Decided: | 07.03.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 6806/2023 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Italian |
| Original Source: | Cass.Civ. (Italy) (in Italian) |
| Initial Contributor: | mg |
The Court of Cassation found that the data subject’s request is a necessary element in the exercise of the right to erasure. The controller cannot be asked to autonomously check whether personal data it stores are still necessary to a debate of public interest.
English Summary
Facts
The data subject was tried and convicted in a criminal proceeding. He served his sentence in prison and started a new life afterwards. He found a job, made new friends and was in a romantic relationship. After some time, his girlfriend and friends became aware of the data subject’s criminal past through an article published on an online newspaper 18 years before the facts at issue. Shocked, they decided to cut any relationship with the data subject.
The data subject asked the controller the removal of the content, which was no longer necessary to pursue journalistic freedom to inform, and compensation for damages suffered due to the publication. The controller removed the article, but refused to compensate the data subject. The controller objected that it did not have an obligation to remove all the contents from its website that were no longer relevant for the public debate.
The court of first instance upheld the controller’s view and rejected the data subject’s claim for damages.
Holding
As the facts dated back to a time when the GDPR was not yet in force, the Court of Cassation denied that the Regulation was applicable at the facts at issue. To the contrary, Directive 95/46/EC regulated the matter. However, the legal reasoning developed by the court substantially follows the structure of Article 17 GDPR and therefore constitutes a relevant interpretation of such a provision.
The Court of Cassation upheld the judgement of first instance. According to the judges, a necessary element in the right to erasure is a gap between a depiction of the data subject which is no longer updated and the current situation of the latter. This gap is assessed from the point of view of the data subject, as they are in the best position to evaluate what does no longer correspond to the present. Therefore, the right to erasure can be activated only by the explicit request of the data subject to the controller.
The court also stressed that an excessively broad interpretation of the right to be forgotten would disproportionately affect the controller, forcing it to check if the content of all its publications is in fact necessary and relevant to a public debate.
As an additional element to support this conclusion, the court cites the CJEU case law, and particularly the judgement in case C-460/20. Here the CJEU stated that it is up to the data subject to prove that the processing of their personal data is no longer necessary and thus information shall be erased under Article 17(3)(a) GDPR. No obligation to investigate about further factual circumstances can be imposed on the controller. Consequently, the right to erasure always necessarily implies a data subject’s request, who should also bear the burden of proof.
In light of the above, the Court of Cassation rejected the data subject’s appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Civil cassation section I - 07/03/2023, no. 6806
Heading
THE SUPREME COURT OF CASSATION
FIRST CIVIL SECTION
Composed of the Distinguished Magistrates:
XXX
XXX
XXX
XXX
XXX
said the following:
JUDGMENT
on the appeal registered under no. 24739/2021 RG proposed by:
L.M., domiciled ex lege in Rome, piazza Cavour at
Chancellery of the Court of Cassation, represented and defended
by the lawyer XXX;
-applicant-
against
ADNKRONOS s.p.a., electively domiciled in Rome, XXX, at the lawyer's office
XXX that
represents and defends him together with the lawyer XXX;
-counter-claimant-
against the sentence of the Court of Perugia n. 378-2021 filed
on 3.3.2021;
having heard the report presented in chambers on 20.2.2023 by
Councilor XXX.
FACTS OF CAUSE
1. With appeal of 23.9.2015 L.M. appealed to the Court of Perugia against the
spa Adnkronos, requesting compensation for damages for the violation of its right
to oblivion pursuant to Legislative Decree no. 196 of 2003, articles 11 and 15, paragraph 2.
The plaintiff made the claim that he had resided for about 18 years a
(Omissis), where he had moved after having served his criminal sentence for crimes in
matter of drugs, constituting a life context completely different from the previous one,
in the context of which he had entered into a romantic relationship and had contracted
new friendships; that the news of the arrest had remained visible on the agency's website
press Adnkronos; that his fiancée had come to know by consulting the internet
with the Google search engine, of the criminal record of the partner, of which she had been
kept in the dark, and had decided to break off the relationship and in a short time even mutual friends had made the same decision; that such circumstances had
engendered in the appellant a strong state of suffering, which then resulted in a crisis
depressive.
Mr. L. added that he had asked (Omissis) Adnkronos to remove the news
from the archive visible on the web and which on (Omitted) the press agency had
communicated to the appellant the cancellation of the aforementioned article. Furthermore
Adnkronos, however, had refused to compensate the damage requested by L. and caused by
failure to timely cancel the news in the period in which it was to be considered
accrued his right to be forgotten because the news had lost its original value
information for users of the Adnkronos site and represented his person in a non-
more in line with current reality.
2. Adnkronos, which appeared in court, objected to the timely removal of the article
after the notice received from the appellant, and noted that, at the time of
publication, the news possessed the characteristics of truth, continence and topicality.
However, the defendant disputed that it was obliged to remove, on its own initiative, dai
its computer archives, all the news that had lost its characters over time
of current events and interest in informing the public without the interested parties
had made any such request.
3. The Court of Perugia, with sentence no. 378 of 3.3.2021, rejected the request of
appellant, stating that the protection of the right to be forgotten does not automatically lead to
for a newspaper organization the obligation to remove or de-index the news,
since the subject's right not to see a version of himself represented
no longer corresponding to reality presupposes an evaluation of non-actuality of
information that cannot be provided except after an express request from the interested party.
According to the Tribunal, it would be extremely burdensome to impose on all content providers a
obligation to check and update all news that could lose relevance e
relevance, so that the responsibility of the digital archive manager must be considered
exists only when there is inertia in the face of a formulated request
by the interested party. The Court of Perugia therefore ruled out the illegality of the conduct of
defendant, valuing the immediate removal of the news following the
request by the present appellant.
4. L.M. filed an appeal against the decision of the Court,
articulating a single reason with which he deduces, in relation to art. 360 c.p.c., n. 3, the violation and false application of articles 2,4,7,11,15,23 of the privacy code (Legislative Decree
no. 196 of 2003), of the art. 6 of directive no. 95/46/EC and of the Constitution, art. 2.
To this end, the appellant refers to those guidelines of the jurisprudence of legitimacy which,
in the reconciliation between the right to be forgotten and the interest of the community in knowing the
done, exclude the obligation to de-index or cancel the news if it remains
a historical interest even many years after the event, as in the hypotheses in
where the story is about famous people. The appellant therefore argues that
case in question there was no interest in preserving the news, concerning
a common citizen, whose legal affairs had ended with the expiation of the
sorry.
Adnkronos s.p.a. and objected in advance
the inadmissibility of the appeal because the objection was initially unfounded
of inadmissibility of the appeal due to the unappealability of the first instance sentences
sanctioned by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph
10.
The Attorney General dismissed the appeal.
The hearing for the oral argument was set and was held on 2023.02.20.
REASONS FOR THE DECISION
6. The objection of inadmissibility of the appeal because it was proposed per saltum in defect of
agreement of the parties, is clearly unfounded, as noted in the order
interlocutory, because the sentence in question is unappealable in accordance with the provisions
by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph 10, e
therefore appealable directly to the Supreme Court.
7. With the defense, Adnkronos also objected to the lateness of the appeal because
proposed only on 10.01.2021 against the sentence published on 03.03.2021, but notified on
14.7.2021, with the purported effect of determining the expiry of the term for appealing
on 13.9.2021.
This affirmation, not cultivated in the oral discussion, is not easy
understandable since the deadline for filing an appeal in cassation, pursuant to art.
325 c.p.c., is for sixty days and therefore only expired on 10.13.2021.8. It should then be specified, to clear the field of possible misunderstandings, that the case
the Regulation 27.4.2016 n. is not applicable ratione temporis 679 of the Parliament
European Union and of the Council on the protection of natural persons with regard to
processing of personal data, as well as the free movement of such data and repealing the
directive 95/46/EC (data protection regulation - GDPR), entered into force
after the events, prior to November 2014.
9. The first of the issues highlighted in the interlocutory order, i.e. if pure
the publisher of the website and not only the manager of the search engine can be held
data controller, is not really the subject of the dispute.
The defendant has raised no objections in this regard and the Court of Perugia reasoned,
implicitly but clearly, in this perspective, so much so as to reject the question
not because it had been proposed against a non-legitimized or titular subject
liability of the disputed relationship, but only because it was held that the responsibility
of the publisher arose only from the failure to promptly activate the request for
intervention by the interested party.
It is therefore only for the sake of completeness that it is observed that there can be no doubt in this
sense in the light of what was stated in the judgment Google Spain C-131/12 which has
stated that the processing of personal data carried out in the context of the activity of a
search engine stands out and adds to that made by website publishers.
In this sense the jurisprudence of this Court is unequivocally deployed
is repeatedly involved in disputes concerning the processing of personal data and the
right to be forgotten promoted precisely against the publishers of the website (Section 3, n. 5525
of 5.4.2012; Section 1, no. 7559 of 27.3.2020; Section 1, no. 9147 of 19.5.2020; and finally,
very recently, Section 1, n. 2893 of 31.1.2023).
10. The second question posed by the interlocutory order pertains to the conditions and to the
content of the intervention requested from the publisher of the website, responsible for the treatment
some data.
With the aforementioned ordinance, the Board questioned the enforceability of an obligation
generalized check on the actuality of the information obtainable from the consultation on
line, both in terms of the quantitative extension of the control, and in terms of
adequate technique to be employed to avoid illegitimate compressions of the right to be forgotten e
at the same time ensure the practicability of the control and preservation of a
information trace suitable for achieving the conservation of historical memory rather
that the permanence of journalistic information.11. For the purposes of the case, this second profile is not relevant for the simple reason that
Adnkronos, at the request of Mr. L. has not limited itself to de-indexing but has
proceeded to the cancellation of the article.
12. It is therefore only for the sake of completeness of examination that the Court recalls that it has
recently reconsidered the jurisprudential orientation that it considered adequate e
de-indexing alone is sufficient protection for the right to be forgotten requested by the data subject
of the article by search engines (expressed with decisions n. 7559 of 27.3.2020, n.
9147 of 19.5.2020 and n. 15160 of 31.5.2021) to affirm with the ordinance n. 2893 of
31.1.2023 that "In terms of the processing of personal data and the right to be forgotten, the
permanence of a press article, legitimately published at the time,
in the computer archive of a newspaper, relating to facts dating back to the time object of
a judicial inquiry, which then resulted in the acquittal of the accused, provided that, upon request
of the interested party, the article is de-indexed and is not available through the common engines
research, but only through the newspaper's historical archive and provided that it is requested
documented by the interested party, a brief information note is affixed to the article, a
margin or at the bottom, which gives an account of the final outcome of the judicial proceeding under
measures that have become final, thus balancing the
law pursuant to the Constitution, art. 21 of the community to be informed and to keep memory of the
historical fact with that of the owner of the personal data stored not to suffer an undue
damage to one's social image.
13. The question of law that needs to be answered and that was asked with the reason
to the Court's attention is whether the website owner's obligation to intervene
presupposes a request from the interested party or instead pre-exists for the mere fact of the
supervening outdatedness of the news due to the passage of time, yes that would be
configurable its liability for compensation for not having done so even in default
of a request from the interested party.
14. The Court considers the response of the Umbrian judge to be correct in the first sense, when the
news (as in this case it is undisputed and was ascertained by the Court with
uncensored ruling) was legitimately published at the time in the presence of
an informative public interest; in this sense this Court has expressed itself precisely with
the aforementioned ordinance no. 2893 of 2023, with reference to articles 16 and 17 of
GDPR (as has been said not applicable ratione temporis to this dispute), which
outline an obligation to intervene without delay, temporally calibrated in relation
at the request of the interested party.
The Court rightly pointed out, in the first place, that precisely because the conduct
harmful consists in the exposure of a no longer current representation of one's person, the perception of the gap between the previous image and the current one is necessary, which
can only be left to the sensitivity and burden of activation of the interested party,
failing to assume the persistent conformity of the news to the current reality.
On the other hand, and in a dutiful balancing of the interests at stake, it would be
excessively burdensome to shoulder the burden of the manager of a digital archive of news
a periodic check of their outdatedness and their outdatedness, in default of any
time parameter set by law and based on completely unknown elements
such as the personal evolution of the subjects involved.
15. In this sense, the European regulation prior to the GDPR already militated, contained
in the EC Directive 24.10.1995 n. 46, applicable ratione temporis.
The art. 12, letter b), required Member States to guarantee to any person
concerned the right to obtain from the data controller, depending on the case, the
rectification, cancellation or blocking of data whose treatment was not
complies with the provisions of the directive, in particular due to its incomplete nature
or inaccurate data; the art. 14, letter a), allowed the interested parties to object, at least in the
cases referred to in art. 7, letters e) and f), at any time, for compelling and legitimate reasons,
arising from their particular situation, to the processing of data concerning them,
unless otherwise provided by national legislation.
In other words, even the European discipline prior to the GDPR behaved in terms of
requests and oppositions of the interested party, thus clearly evoking the need to
an activation on his part.
16. This led, precisely, the Court of Justice, Grand Section, of 13.5.2014-
C-131/12 (judgment "Google Spain") to affirm that the art. 2, lit. b) and d) of the directive
95/46/EC of the European Parliament and of the Council, of 24 October 1995, relating to the
protection of natural persons with regard to the processing of personal data, as well as to
free movement of such data, must be interpreted as meaning that, on the one hand,
the activity of a search engine consisting of finding published or entered information
from third parties on the Internet, in indexing them automatically, in memorizing them
temporarily and, finally, in making them available to Internet users according to
a certain order of preference, must be qualified as "data processing
personal data", pursuant to the aforementioned art. 2, letter b), if such information contains data
personal, and that, on the other hand, the manager of said search engine must be
considered as the "manager" of the aforementioned treatment, pursuant to art. 2,
lit. d), above; and furthermore, that the articles 12, lett. b), and 14, paragraph 1, lett. a), of the
Directive 95/46 must be interpreted as meaning that, in order to respect the rights established by those provisions, and provided that the conditions set by them are
actually satisfied, the operator of a search engine is obliged to suppress,
from the list of results that appears following a search carried out starting from the name of
a person, links to web pages published by third parties and containing information
relating to this individual, even if such name or such information does not
are previously or simultaneously deleted from the web pages in question, e
this possibly even when their publication on such web pages is in itself
lawful.
17. The national legislation, contained in the so-called Privacy Code, pursuant to Legislative Decree no.
6/30/2003 no. 196, even before the changes made with Legislative Decree no. 10.8.2018 n.
101, for the adaptation to the GDPR, clearly and unequivocally assumed that i
rights due to the interested party were exercised with activation on his part with a
specific request.
The art. 7 was structured in terms of the right of the interested party to obtain the intervention of the
data manager.
The art. 8 gave the interested party the right to obtain confirmation of the existence or not of
personal data concerning him, even if not yet registered, and theirs
intelligible communication.
The art. 9 governed the request addressed to the owner or manager in its possibilities
operating modes.
18. These conclusions are corroborated by the very recent ruling of the Court of
EU Justice, Grand Section of 8.12.2022 - C-460, actually focused on the content
of the burden of proof weighing respectively on the owner of the personal data and on the manager
of the site, and which nevertheless takes for granted the need for a request from the interested party
and within certain limits of proof on his part.
The European Court has in fact dealt with establishing whether and to what extent it pertains to the person
who submitted the de-listing request provide evidence for
corroborate his claim regarding the inaccuracy of the information included in the
content mentioned and on the other hand whether the operator of the search engine should itself
try to clarify the facts in order to ascertain the accuracy or otherwise of the information
allegedly inaccurate contained therein.
As to the obligations incumbent on the person requesting de-listing for
the inaccuracy of an indexed content, it was considered that it was up to it to prove
the manifest inaccuracy of the information appearing in said content or, at least, of a part of this information which is not of a secondary nature with respect to
to the entirety of this content.
However, in order to avoid an excessive burden capable of undermining the practical effect of the right
upon de-listing, the applicant is only required to provide evidence
which, taking into account the circumstances of the case, may reasonably be
required in order to demonstrate such a manifest misstatement; the applicant, therefore, is not
required, in principle, to produce, right from the pre-litigation stage, in support of the
your request for de-indexing to the search engine manager, a decision
jurisdiction, also arising from summary proceedings. Imposing an obligation
such a person would, in fact, have the effect of placing a burden on him
unreasonable.
In addition the manager of the search engine, in order to verify, following a request for
de-indexing, whether a piece of content can continue to be included in the list of
results of searches made using its search engine, must be based
on all the rights and interests at stake as well as on all the circumstances of the case of
species. However, in the context of the evaluation of the conditions of application of which
to art. 17, paragraph 3, letter a), of the GDPR, the manager cannot be required to carry out
an active role in the search for elements of fact that are not substantiated by the request for
cancellation, in order to determine the validity of this request.
Therefore, when processing such a request, it cannot be imposed on the
operator of the search engine concerned an obligation to investigate the facts and to
to this end, organize a contradictory exchange with the content provider,
aimed at obtaining missing elements regarding the accuracy of the indexed content.
This obligation would force the operator of the search engine itself to contribute to
prove the accuracy or otherwise of the mentioned content and would burden him a
burden that exceeds what can reasonably be expected from it in the light of
its responsibilities, competences and possibilities, and would therefore involve a serious risk
that contents that respond to a legitimate and preponderant one are de-indexed
need for information of the public and that it therefore becomes difficult to find them on the Internet.
In this respect, there would be a real risk of a deterrent effect on the exercise of the right
freedom of expression and information if the manager of the search engine proceeded to
such a de-indexing in an almost systematic way, in order to avoid
having to bear the burden of investigating the relevant facts to ascertain the accuracy or not
of the indexed content. Therefore, in the event that the subject who has submitted a request for de-indexing
provide relevant and sufficient evidence, suitable to substantiate your request and documents
to demonstrate the manifestly incorrect nature of the information included in the
indexed content or, at least, a portion of that information that does not have a
secondary character with respect to the totality of such content, the manager of the engine
research is required to accept this request for de-indexing. The same is true if
the interested party makes a judicial decision taken against the site publisher
Internet is based on the observation that information included in the indexed content,
which do not have a secondary character with respect to the totality of the latter, are,
at least at first glance, inaccurate.
Conversely, in the event that the inaccuracy of such information included in the content
indexed does not manifestly appear in the light of the evidence provided
by the interested party, the operator of the search engine is not required, in the absence of one
judicial decision, to grant such a request for de-listing. In the case of
an administrative or judicial proceeding is initiated concerning the alleged claim
inaccuracy of information included in an indexed content and the existence of such
procedure has been brought to the attention of the manager of the search engine referred to
question, it is the responsibility of the manager, in order to always provide Internet users with information
relevant and up-to-date, add a warning in your search results
concerning the existence of such a proceeding.
It is so evident that European jurisprudence presupposes and implies
necessarily an activation fee on the part of the interested party, provided that the
content originally posted was lawful, as well as a reasonable contribution
evidentiary.
19. It must therefore be concluded that the appeal is unfounded, since it cannot be considered that
Adnkronos was required to eliminate from its archive the news of the arrest of Mr. L.,
legitimately published at the time, prior to your request, promptly
satisfied.
The objection proposed by the appellant in the context of
oral discussion, based on the onerousness of the initiative thus required of the subjects
interested.
Beyond the textual data, the proposition of the request requires neither formality nor
technicalities and does not require recourse to a technical defense or consultants of any kind
and consequently does not generate any additional cost. On the contrary, it would be the imposition on the managers of a periodic sounding of
information at the time legitimately published to impose a burden on managers
unsustainable and fraught with consequences for freedom of information.
20. In this regard, the Court considers enunciating the following principle of law:
"On the subject of the processing of personal data and the right to be forgotten, also in the regime
previous to EU Regulation 27.4.2016 n. 679 (GDPR), applicable ratione temporis,
the operator of a website is not obliged to ensure, as the case may be, the
deletion, de-indexing or updating of a press article, on its own
legitimately published time, even if relating to facts dating back to the time, in defect
of request of the interested party which is the only one to give rise to the obligation of the manager to
act without delay."
21. The appeal must therefore be dismissed.
The expenses follow the unsuccessful outcome, liquidated as in the device. It is also necessary
provide that, in the event of use of this ordinance, the indication is omitted
of the personal details and other identification data of the parties indicated in the order.
P.Q.M.
The court:
rejects the appeal and orders the appellant to pay the costs in favor of the
counter-claimant, settled in the sum of Euro 3,000.00 for fees, Euro 200.00 for
exhibited, 15% reimbursement of general expenses, plus statutory accessories.
Pursuant to the D.P.R. no. 115 of 2002, art. 13, paragraph 1 quater, inserted by law no. 228 of
2012, art. 1, paragraph 17, acknowledges the existence of the procedural conditions for the
payment, by the appellant, of the additional amount by way of unified contribution
equal to that due for the appeal, pursuant to paragraph 1-bis of the same art. 13, where
due.
Provides that, in the event of use of this ordinance, the indication is omitted
of the personal details and other identification data of the parties indicated in the order.
Thus decided in Rome, in the council chamber of the First Civil Section, on 20 February
2023.
Filed in the Registry on 7 March 2023
