IDPC (Malta) - CDP COMP 144 2022
| IDPC - CDP_COMP_144_2022 | |
|---|---|
 | |
| Authority: | IDPC (Malta) |
| Jurisdiction: | Malta |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | CDP_COMP_144_2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | CDP_COMP_144_2022 (in EN) |
| Initial Contributor: | sh |
The Maltese DPA ordered a media company to add a no-index metatag to an news article within 20 days. This act fulfils a data subject's right to be forgotten.
English Summary
Facts
A data subject requested the Maltese DPA to order the removal of published article to be delisted by a media company (the controller). The article linked his name (due to his role at the time as the the executive of a gambling company) to organised crimes syndicates and the subsequent removal of betting licences for gambling companies. This meant that when users search words such as 'mafia', 'mob' or 'gambling', his name was likely to appear on the search enginge.
The controller replied to the complaint and argued to the DPA that they processed data for journalisitc purposes. The removal of said article would undermine the right of freedom of expression and information. Moreover, the suspession of the betting licences were the subject of Maltese court cases. The reporting of cases also enjoy journalistic privilege's under national law.
Holding
The Maltese DPA saw its task as balancing the right of the data subject to be forgotten (Article 17 GDPR) with the right to freedom of expression and information. This requirement to strike a fair balance between the two is also required by Article 9 of Malta's Data Protection Act. It lays down an exhaustive list of exemptions to enable the processing of data under freedom of expression and information.
The controller (a media company) and search engines such as Google were distinguished in the Maltese DPA. A democratic society requires the media to disseminate information that is in the public interest. The latter is an online search engine that crawls the web in order to look up kex words entered by the user and returns results in the form of a list. Because the complaint was only lodged against the controller. The DPA's investigation was strictly limited to them.
The DPA at first looked at CJEU case law to guide its decision and concluded that the judgements of Lindqvist, Satamedia and Buivids do not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In abscence of this, the DPA turned to ECHR case law which throughout the years has developed a standard set of criteria. These include, among others, the controbution to the debate of public interest, the degree of notoriety of the person affect and the consequence of the publication. As the publication in question contained sensitive data about criminal proceedings and had not been updated despite developments in the case, the DPA deemed the right to be forgotten to be more important than the controller's right to disseminate information.
More importantly for the DPA, the ECHR recently distinguished between de-indexing and the permanent removal of an article under the right to be forgotten in Biancardi v Italy. As a result, the DPA was not required to order the deletion of the article in order to comply with the right to be forgotten. The DPA also considered the case Hurbain vs. Belgium, in which the European Court of Human Rights emphasized the importance of digital archives in today's world. These must be upheld in order for the press to fulfill its role as a public watchdog. As a result, the press must be able to keep public archives containing previously reported news.
Taking these two recent decisions into account, the DPA ordered the media company to add a no-index metatag to the content head HTML of the case's online page. In this way, the complainant's fundamental rights were respected because his name was removed from the search engines' index, which meant that his name would no longer appear alongside the related key words about which he complained. At the same time, the controller's journalistic freedom is preserved because the article's original content remains unaltered. The controller was given 20 days to comply.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
