Cass.Civ. - 6806/2023
|Cass.Civ. - 6806/2023
|Article 17 GDPR
|National Case Number/Name:
|European Case Law Identifier:
|Cass.Civ. (Italy) (in Italian)
The Court of Cassation of Italy found that the data subject’s request is a necessary element in the exercise of the right to erasure. The controller cannot be asked to autonomously check whether personal data it stores are still necessary to a debate of public interest.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject was tried and convicted in a criminal proceeding. He served his sentence in prison and started a new life afterwards. He found a job, made new friends and was in a romantic relationship. After some time, his girlfriend and friends became aware of the data subject’s criminal past through an article published on an online newspaper 18 years before the facts at issue. Shocked, they decided to cut any relationship with the data subject.
The data subject asked the controller the removal of the content, which was no longer necessary to pursue journalistic freedom to inform, and compensation for damages suffered due to the publication. The controller removed the article, but refused to compensate the data subject. The controller objected that it did not have an obligation to remove all the contents from its website that were no longer relevant for the public debate.
The court of first instance upheld the controller’s view and rejected the data subject’s claim for damages.
Holding[edit | edit source]
As the facts dated back to a time when the GDPR was not yet in force, the Court of Cassation denied that the Regulation was applicable at the facts at issue. To the contrary, Directive 95/46/EC regulated the matter. However, the legal reasoning developed by the court substantially follows the structure of Article 17 GDPR and therefore constitutes a relevant interpretation of such a provision.
The Court of Cassation upheld the judgement of first instance. According to the judges, a necessary element in the right to erasure is a gap between a depiction of the data subject which is no longer updated and the current situation of the latter. This gap is assessed from the point of view of the data subject, as they are in the best position to evaluate what does no longer correspond to the present. Therefore, the right to erasure can be activated only by the explicit request of the data subject to the controller.
The court also stressed that an excessively broad interpretation of the right to be forgotten would disproportionately affect the controller, forcing it to check if the content of all its publications is in fact necessary and relevant to a public debate.
As an additional element to support this conclusion, the court cites the CJEU case law, and particularly the judgement in case C-460/20. Here the CJEU stated that it is up to the data subject to prove that the processing of their personal data is no longer necessary and thus information shall be erased under Article 17(3)(a) GDPR. No obligation to investigate about further factual circumstances can be imposed on the controller. Consequently, the right to erasure always necessarily implies a data subject’s request, who should also bear the burden of proof.
In light of the above, the Court of Cassation rejected the data subject’s appeal.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Civil cassation section I - 07/03/2023, no. 6806 Heading THE SUPREME COURT OF CASSATION FIRST CIVIL SECTION Composed of the Distinguished Magistrates: XXX XXX XXX XXX XXX said the following: JUDGMENT on the appeal registered under no. 24739/2021 RG proposed by: L.M., domiciled ex lege in Rome, piazza Cavour at Chancellery of the Court of Cassation, represented and defended by the lawyer XXX; -applicant- against ADNKRONOS s.p.a., electively domiciled in Rome, XXX, at the lawyer's office XXX that represents and defends him together with the lawyer XXX; -counter-claimant- against the sentence of the Court of Perugia n. 378-2021 filed on 3.3.2021; having heard the report presented in chambers on 20.2.2023 by Councilor XXX. FACTS OF CAUSE 1. With appeal of 23.9.2015 L.M. appealed to the Court of Perugia against the spa Adnkronos, requesting compensation for damages for the violation of its right to oblivion pursuant to Legislative Decree no. 196 of 2003, articles 11 and 15, paragraph 2. The plaintiff made the claim that he had resided for about 18 years a (Omissis), where he had moved after having served his criminal sentence for crimes in matter of drugs, constituting a life context completely different from the previous one, in the context of which he had entered into a romantic relationship and had contracted new friendships; that the news of the arrest had remained visible on the agency's website press Adnkronos; that his fiancée had come to know by consulting the internet with the Google search engine, of the criminal record of the partner, of which she had been kept in the dark, and had decided to break off the relationship and in a short time even mutual friends had made the same decision; that such circumstances had engendered in the appellant a strong state of suffering, which then resulted in a crisis depressive. Mr. L. added that he had asked (Omissis) Adnkronos to remove the news from the archive visible on the web and which on (Omitted) the press agency had communicated to the appellant the cancellation of the aforementioned article. Furthermore Adnkronos, however, had refused to compensate the damage requested by L. and caused by failure to timely cancel the news in the period in which it was to be considered accrued his right to be forgotten because the news had lost its original value information for users of the Adnkronos site and represented his person in a non- more in line with current reality. 2. Adnkronos, which appeared in court, objected to the timely removal of the article after the notice received from the appellant, and noted that, at the time of publication, the news possessed the characteristics of truth, continence and topicality. However, the defendant disputed that it was obliged to remove, on its own initiative, dai its computer archives, all the news that had lost its characters over time of current events and interest in informing the public without the interested parties had made any such request. 3. The Court of Perugia, with sentence no. 378 of 3.3.2021, rejected the request of appellant, stating that the protection of the right to be forgotten does not automatically lead to for a newspaper organization the obligation to remove or de-index the news, since the subject's right not to see a version of himself represented no longer corresponding to reality presupposes an evaluation of non-actuality of information that cannot be provided except after an express request from the interested party. According to the Tribunal, it would be extremely burdensome to impose on all content providers a obligation to check and update all news that could lose relevance e relevance, so that the responsibility of the digital archive manager must be considered exists only when there is inertia in the face of a formulated request by the interested party. The Court of Perugia therefore ruled out the illegality of the conduct of defendant, valuing the immediate removal of the news following the request by the present appellant. 4. L.M. filed an appeal against the decision of the Court, articulating a single reason with which he deduces, in relation to art. 360 c.p.c., n. 3, the violation and false application of articles 2,4,7,11,15,23 of the privacy code (Legislative Decree no. 196 of 2003), of the art. 6 of directive no. 95/46/EC and of the Constitution, art. 2. To this end, the appellant refers to those guidelines of the jurisprudence of legitimacy which, in the reconciliation between the right to be forgotten and the interest of the community in knowing the done, exclude the obligation to de-index or cancel the news if it remains a historical interest even many years after the event, as in the hypotheses in where the story is about famous people. The appellant therefore argues that case in question there was no interest in preserving the news, concerning a common citizen, whose legal affairs had ended with the expiation of the sorry. Adnkronos s.p.a. and objected in advance the inadmissibility of the appeal because the objection was initially unfounded of inadmissibility of the appeal due to the unappealability of the first instance sentences sanctioned by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph 10. The Attorney General dismissed the appeal. The hearing for the oral argument was set and was held on 2023.02.20. REASONS FOR THE DECISION 6. The objection of inadmissibility of the appeal because it was proposed per saltum in defect of agreement of the parties, is clearly unfounded, as noted in the order interlocutory, because the sentence in question is unappealable in accordance with the provisions by Legislative Decree no. 196 of 2003, art. 152 and by Legislative Decree no. 150 of 2011, art. 10, paragraph 10, e therefore appealable directly to the Supreme Court. 7. With the defense, Adnkronos also objected to the lateness of the appeal because proposed only on 10.01.2021 against the sentence published on 03.03.2021, but notified on 14.7.2021, with the purported effect of determining the expiry of the term for appealing on 13.9.2021. This affirmation, not cultivated in the oral discussion, is not easy understandable since the deadline for filing an appeal in cassation, pursuant to art. 325 c.p.c., is for sixty days and therefore only expired on 10.13.2021.8. It should then be specified, to clear the field of possible misunderstandings, that the case the Regulation 27.4.2016 n. is not applicable ratione temporis 679 of the Parliament European Union and of the Council on the protection of natural persons with regard to processing of personal data, as well as the free movement of such data and repealing the directive 95/46/EC (data protection regulation - GDPR), entered into force after the events, prior to November 2014. 9. The first of the issues highlighted in the interlocutory order, i.e. if pure the publisher of the website and not only the manager of the search engine can be held data controller, is not really the subject of the dispute. The defendant has raised no objections in this regard and the Court of Perugia reasoned, implicitly but clearly, in this perspective, so much so as to reject the question not because it had been proposed against a non-legitimized or titular subject liability of the disputed relationship, but only because it was held that the responsibility of the publisher arose only from the failure to promptly activate the request for intervention by the interested party. It is therefore only for the sake of completeness that it is observed that there can be no doubt in this sense in the light of what was stated in the judgment Google Spain C-131/12 which has stated that the processing of personal data carried out in the context of the activity of a search engine stands out and adds to that made by website publishers. In this sense the jurisprudence of this Court is unequivocally deployed is repeatedly involved in disputes concerning the processing of personal data and the right to be forgotten promoted precisely against the publishers of the website (Section 3, n. 5525 of 5.4.2012; Section 1, no. 7559 of 27.3.2020; Section 1, no. 9147 of 19.5.2020; and finally, very recently, Section 1, n. 2893 of 31.1.2023). 10. The second question posed by the interlocutory order pertains to the conditions and to the content of the intervention requested from the publisher of the website, responsible for the treatment some data. With the aforementioned ordinance, the Board questioned the enforceability of an obligation generalized check on the actuality of the information obtainable from the consultation on line, both in terms of the quantitative extension of the control, and in terms of adequate technique to be employed to avoid illegitimate compressions of the right to be forgotten e at the same time ensure the practicability of the control and preservation of a information trace suitable for achieving the conservation of historical memory rather that the permanence of journalistic information.11. For the purposes of the case, this second profile is not relevant for the simple reason that Adnkronos, at the request of Mr. L. has not limited itself to de-indexing but has proceeded to the cancellation of the article. 12. It is therefore only for the sake of completeness of examination that the Court recalls that it has recently reconsidered the jurisprudential orientation that it considered adequate e de-indexing alone is sufficient protection for the right to be forgotten requested by the data subject of the article by search engines (expressed with decisions n. 7559 of 27.3.2020, n. 9147 of 19.5.2020 and n. 15160 of 31.5.2021) to affirm with the ordinance n. 2893 of 31.1.2023 that "In terms of the processing of personal data and the right to be forgotten, the permanence of a press article, legitimately published at the time, in the computer archive of a newspaper, relating to facts dating back to the time object of a judicial inquiry, which then resulted in the acquittal of the accused, provided that, upon request of the interested party, the article is de-indexed and is not available through the common engines research, but only through the newspaper's historical archive and provided that it is requested documented by the interested party, a brief information note is affixed to the article, a margin or at the bottom, which gives an account of the final outcome of the judicial proceeding under measures that have become final, thus balancing the law pursuant to the Constitution, art. 21 of the community to be informed and to keep memory of the historical fact with that of the owner of the personal data stored not to suffer an undue damage to one's social image. 13. The question of law that needs to be answered and that was asked with the reason to the Court's attention is whether the website owner's obligation to intervene presupposes a request from the interested party or instead pre-exists for the mere fact of the supervening outdatedness of the news due to the passage of time, yes that would be configurable its liability for compensation for not having done so even in default of a request from the interested party. 14. The Court considers the response of the Umbrian judge to be correct in the first sense, when the news (as in this case it is undisputed and was ascertained by the Court with uncensored ruling) was legitimately published at the time in the presence of an informative public interest; in this sense this Court has expressed itself precisely with the aforementioned ordinance no. 2893 of 2023, with reference to articles 16 and 17 of GDPR (as has been said not applicable ratione temporis to this dispute), which outline an obligation to intervene without delay, temporally calibrated in relation at the request of the interested party. The Court rightly pointed out, in the first place, that precisely because the conduct harmful consists in the exposure of a no longer current representation of one's person, the perception of the gap between the previous image and the current one is necessary, which can only be left to the sensitivity and burden of activation of the interested party, failing to assume the persistent conformity of the news to the current reality. On the other hand, and in a dutiful balancing of the interests at stake, it would be excessively burdensome to shoulder the burden of the manager of a digital archive of news a periodic check of their outdatedness and their outdatedness, in default of any time parameter set by law and based on completely unknown elements such as the personal evolution of the subjects involved. 15. In this sense, the European regulation prior to the GDPR already militated, contained in the EC Directive 24.10.1995 n. 46, applicable ratione temporis. The art. 12, letter b), required Member States to guarantee to any person concerned the right to obtain from the data controller, depending on the case, the rectification, cancellation or blocking of data whose treatment was not complies with the provisions of the directive, in particular due to its incomplete nature or inaccurate data; the art. 14, letter a), allowed the interested parties to object, at least in the cases referred to in art. 7, letters e) and f), at any time, for compelling and legitimate reasons, arising from their particular situation, to the processing of data concerning them, unless otherwise provided by national legislation. In other words, even the European discipline prior to the GDPR behaved in terms of requests and oppositions of the interested party, thus clearly evoking the need to an activation on his part. 16. This led, precisely, the Court of Justice, Grand Section, of 13.5.2014- C-131/12 (judgment "Google Spain") to affirm that the art. 2, lit. b) and d) of the directive 95/46/EC of the European Parliament and of the Council, of 24 October 1995, relating to the protection of natural persons with regard to the processing of personal data, as well as to free movement of such data, must be interpreted as meaning that, on the one hand, the activity of a search engine consisting of finding published or entered information from third parties on the Internet, in indexing them automatically, in memorizing them temporarily and, finally, in making them available to Internet users according to a certain order of preference, must be qualified as "data processing personal data", pursuant to the aforementioned art. 2, letter b), if such information contains data personal, and that, on the other hand, the manager of said search engine must be considered as the "manager" of the aforementioned treatment, pursuant to art. 2, lit. d), above; and furthermore, that the articles 12, lett. b), and 14, paragraph 1, lett. a), of the Directive 95/46 must be interpreted as meaning that, in order to respect the rights established by those provisions, and provided that the conditions set by them are actually satisfied, the operator of a search engine is obliged to suppress, from the list of results that appears following a search carried out starting from the name of a person, links to web pages published by third parties and containing information relating to this individual, even if such name or such information does not are previously or simultaneously deleted from the web pages in question, e this possibly even when their publication on such web pages is in itself lawful. 17. The national legislation, contained in the so-called Privacy Code, pursuant to Legislative Decree no. 6/30/2003 no. 196, even before the changes made with Legislative Decree no. 10.8.2018 n. 101, for the adaptation to the GDPR, clearly and unequivocally assumed that i rights due to the interested party were exercised with activation on his part with a specific request. The art. 7 was structured in terms of the right of the interested party to obtain the intervention of the data manager. The art. 8 gave the interested party the right to obtain confirmation of the existence or not of personal data concerning him, even if not yet registered, and theirs intelligible communication. The art. 9 governed the request addressed to the owner or manager in its possibilities operating modes. 18. These conclusions are corroborated by the very recent ruling of the Court of EU Justice, Grand Section of 8.12.2022 - C-460, actually focused on the content of the burden of proof weighing respectively on the owner of the personal data and on the manager of the site, and which nevertheless takes for granted the need for a request from the interested party and within certain limits of proof on his part. The European Court has in fact dealt with establishing whether and to what extent it pertains to the person who submitted the de-listing request provide evidence for corroborate his claim regarding the inaccuracy of the information included in the content mentioned and on the other hand whether the operator of the search engine should itself try to clarify the facts in order to ascertain the accuracy or otherwise of the information allegedly inaccurate contained therein. As to the obligations incumbent on the person requesting de-listing for the inaccuracy of an indexed content, it was considered that it was up to it to prove the manifest inaccuracy of the information appearing in said content or, at least, of a part of this information which is not of a secondary nature with respect to to the entirety of this content. However, in order to avoid an excessive burden capable of undermining the practical effect of the right upon de-listing, the applicant is only required to provide evidence which, taking into account the circumstances of the case, may reasonably be required in order to demonstrate such a manifest misstatement; the applicant, therefore, is not required, in principle, to produce, right from the pre-litigation stage, in support of the your request for de-indexing to the search engine manager, a decision jurisdiction, also arising from summary proceedings. Imposing an obligation such a person would, in fact, have the effect of placing a burden on him unreasonable. In addition the manager of the search engine, in order to verify, following a request for de-indexing, whether a piece of content can continue to be included in the list of results of searches made using its search engine, must be based on all the rights and interests at stake as well as on all the circumstances of the case of species. However, in the context of the evaluation of the conditions of application of which to art. 17, paragraph 3, letter a), of the GDPR, the manager cannot be required to carry out an active role in the search for elements of fact that are not substantiated by the request for cancellation, in order to determine the validity of this request. Therefore, when processing such a request, it cannot be imposed on the operator of the search engine concerned an obligation to investigate the facts and to to this end, organize a contradictory exchange with the content provider, aimed at obtaining missing elements regarding the accuracy of the indexed content. This obligation would force the operator of the search engine itself to contribute to prove the accuracy or otherwise of the mentioned content and would burden him a burden that exceeds what can reasonably be expected from it in the light of its responsibilities, competences and possibilities, and would therefore involve a serious risk that contents that respond to a legitimate and preponderant one are de-indexed need for information of the public and that it therefore becomes difficult to find them on the Internet. In this respect, there would be a real risk of a deterrent effect on the exercise of the right freedom of expression and information if the manager of the search engine proceeded to such a de-indexing in an almost systematic way, in order to avoid having to bear the burden of investigating the relevant facts to ascertain the accuracy or not of the indexed content. Therefore, in the event that the subject who has submitted a request for de-indexing provide relevant and sufficient evidence, suitable to substantiate your request and documents to demonstrate the manifestly incorrect nature of the information included in the indexed content or, at least, a portion of that information that does not have a secondary character with respect to the totality of such content, the manager of the engine research is required to accept this request for de-indexing. The same is true if the interested party makes a judicial decision taken against the site publisher Internet is based on the observation that information included in the indexed content, which do not have a secondary character with respect to the totality of the latter, are, at least at first glance, inaccurate. Conversely, in the event that the inaccuracy of such information included in the content indexed does not manifestly appear in the light of the evidence provided by the interested party, the operator of the search engine is not required, in the absence of one judicial decision, to grant such a request for de-listing. In the case of an administrative or judicial proceeding is initiated concerning the alleged claim inaccuracy of information included in an indexed content and the existence of such procedure has been brought to the attention of the manager of the search engine referred to question, it is the responsibility of the manager, in order to always provide Internet users with information relevant and up-to-date, add a warning in your search results concerning the existence of such a proceeding. It is so evident that European jurisprudence presupposes and implies necessarily an activation fee on the part of the interested party, provided that the content originally posted was lawful, as well as a reasonable contribution evidentiary. 19. It must therefore be concluded that the appeal is unfounded, since it cannot be considered that Adnkronos was required to eliminate from its archive the news of the arrest of Mr. L., legitimately published at the time, prior to your request, promptly satisfied. The objection proposed by the appellant in the context of oral discussion, based on the onerousness of the initiative thus required of the subjects interested. Beyond the textual data, the proposition of the request requires neither formality nor technicalities and does not require recourse to a technical defense or consultants of any kind and consequently does not generate any additional cost. On the contrary, it would be the imposition on the managers of a periodic sounding of information at the time legitimately published to impose a burden on managers unsustainable and fraught with consequences for freedom of information. 20. In this regard, the Court considers enunciating the following principle of law: "On the subject of the processing of personal data and the right to be forgotten, also in the regime previous to EU Regulation 27.4.2016 n. 679 (GDPR), applicable ratione temporis, the operator of a website is not obliged to ensure, as the case may be, the deletion, de-indexing or updating of a press article, on its own legitimately published time, even if relating to facts dating back to the time, in defect of request of the interested party which is the only one to give rise to the obligation of the manager to act without delay." 21. The appeal must therefore be dismissed. The expenses follow the unsuccessful outcome, liquidated as in the device. It is also necessary provide that, in the event of use of this ordinance, the indication is omitted of the personal details and other identification data of the parties indicated in the order. P.Q.M. The court: rejects the appeal and orders the appellant to pay the costs in favor of the counter-claimant, settled in the sum of Euro 3,000.00 for fees, Euro 200.00 for exhibited, 15% reimbursement of general expenses, plus statutory accessories. Pursuant to the D.P.R. no. 115 of 2002, art. 13, paragraph 1 quater, inserted by law no. 228 of 2012, art. 1, paragraph 17, acknowledges the existence of the procedural conditions for the payment, by the appellant, of the additional amount by way of unified contribution equal to that due for the appeal, pursuant to paragraph 1-bis of the same art. 13, where due. Provides that, in the event of use of this ordinance, the indication is omitted of the personal details and other identification data of the parties indicated in the order. Thus decided in Rome, in the council chamber of the First Civil Section, on 20 February 2023. Filed in the Registry on 7 March 2023