Garante per la protezione dei dati personali (Italy) - 9747505

Garante per la protezione dei dati personali (Italy) - 9747505
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(e) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	27.01.2022
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	9747505
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante Garante per la protezione dei dati personali (in IT)
Initial Contributor:	Cesar Manso-Sayao

The Italian DPA ordered Google to de-list search results which associated a data subject’s name to a public job competition’s selection process, taking the storage limitation principle under Article 5(1)(e) GDPR into consideration.

English Summary

Facts

A data subject had entered a public competition for a job post, which ended in July 2019. The local authority that launched the competition published information related to the selection process, including which candidates had been admitted and which ones had not admitted to the oral exam, along with each candidate’s score in the preliminary phase. In March 2021, the data subject requested Google to remove the search results which associated his name to this selection process, but Google did not grant this request.

This prompted the data subject to issue a complaint against Google with the Italian DPA (Garante). The subject claimed that there was no relevant public interest reason for this information, which he considered to be excessively detrimental, to show up when his name was researched on Google, in particular because this information did not constitute a final ranking of merit, but rather a mere intermediate evaluation with relative scores. Additionally, the data subject noted that according to national law, a final merit ranking’s legal validity status is three years, and hence an intermediate document's validity within this evaluation process should reasonably run out in a shorter time.

In their defense, Google claimed that the information was published on the institutional website of a public authority, and considered that because the publication was relatively recent, and was only related to the complainant’s professional career, the conditions for exercising the right to be forgotten were not met.

Holding

The Garante noted that since the competition in question had ended since July 2019, the publication of data relating to the intermediate stages of the public competition procedure did not appear to correspond to a specific public interest. Therefore, the Garante held that the accessibility of this information should not prevail over the individual's data protection rights, especially in light of the fact that it is causing him disproportionate prejudice, citing point 8 Part II of the Article 29 Working Party Guidelines on the Implementation of the Court of Justice of the European Union judgement C-131/12, as well as the storage limitation principle under Article 5(1)(e) GDPR.

Based on these considerations, the Garante ordered Google to de-list the search results which associated the data subject’s name to the competition procedure’s URL within twenty days of the receipt of the decision, subject to an administrative sanction from the Garante under Article 83(5)(e) GDPR if the order is not complied with.

Comment

Although the decision textually says the “data minimisation principle pursuant to Article 5(1)(e) GDPR”, it is clear from the provision cited and the context of the case that this was a mistake, and that what it is actually referring to is the storage limitation principle.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9747505]

Provision of January 27, 2022

Record of measures
n. 27 of January 27, 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

GIVEN the Code regarding the protection of personal data, containing provisions for the adaptation of the national system to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, n.196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter the "Code");

GIVEN the complaint submitted to the Guarantor, pursuant to art. 77 of the Regulation, on 19 March 2021 with which XX asked to order Google LLC to remove, from the search results available in association with his name, a URL linked to a page containing an administrative act of a local authority that also reports information concerning him referring to a public competition in which he participated in 2019;

CONSIDERING that the interested party complained, in particular, that;

the competition in question ended in July 2019;

the deed published on the institutional website of the body that launched the competition "does not constitute a ranking of merit, but a mere intermediate information list" as it contains the list of those admitted and not admitted to the oral exam with their scores;

for these reasons, the public interest in having knowledge of such information for research conducted in association with their name cannot be deemed to exist and that such processing is excessively prejudicial to their legal sphere;

HAVING REGARD to the note of 2 July 2021 with which the Authority asked the data controller to provide his observations in relation to what is represented in the introductory act of the procedure and to communicate his possible intention to adhere to the requests of the complainant;

GIVEN the note of 22 July 2021 with which Google LLC found that it could not adhere to the request for removal made by the interested party because:

the URL indicated in the complaint refers to a document published on the institutional website of a local authority concerning the list of those admitted to the oral exam in a public competition;

the information thus available relates to the complainant's professional career and is recently published, which is why the conditions for exercising the right to be forgotten are not deemed to exist;

GIVEN the note of 23 July 2021 with which the interested party reiterated his request, noting, in particular, that no specific reasons are identified for the indexation of an intermediate deed of an insolvency procedure which has now been concluded given that, "if the validity legal status of a final merit ranking is 3 years, the public interest for an intermediate document that does not constitute a final merit ranking "should reasonably run out in a shorter time";

CONSIDERING, preliminarily, that:

as a result of the activities carried out in Europe through its offices, the principle of establishment applies to Google LLC and therefore the related processing is subject to the provisions of the Regulation by virtue of the provisions of art. 3, par. 1;

the processing of personal data connected to the use of the Google search engine is however directly managed, also for the EU territory, by Google LLC, based in the United States;

this circumstance is suitable to found, pursuant to art. 55, par. 1, of the Regulation, the competence of the Italian Guarantor to decide the complaints proposed to it with reference to its own national territory;

CONSIDERING that, unless the fact constitutes a more serious crime, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents, is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the tasks or the exercise of the powers of the Guarantor";

NOTING that:

the request made by the interested party concerns an intermediate act of an insolvency procedure containing the data, including the vote, of the candidates admitted and not admitted to the oral exam:

the competition in question was concluded from July 2019 and the publication of data relating to the intermediate stages of the procedure, including the indication of the outcome of the test, does not appear to correspond to a specific public interest;

the accessibility of the disputed information cannot therefore be considered justified on the basis of an interest of the community such as to prevail over the individual's right to the protection of his own legal sphere which from such persistent disclosure seems indeed to suffer disproportionate damage (see point 8 part II of the Guidelines of November 26, 2014), also taking into account the principle of data minimization pursuant to art. 5, par. 1, lett. e), of the Regulation which the same public bodies should comply with when they arrange for the publication of documents within their respective institutional sites also in light of the obligations envisaged in terms of transparency (see Article 19 of Legislative Decree no. . 33/2013, as well as "Guidelines on the processing of personal data, also contained in administrative deeds and documents, carried out for the purpose of advertising and transparency on the web by public entities and other obliged entities" issued by the Guarantor on May 15, 2014 , web doc. no. 3134436);

CONSIDERING, therefore, that it is necessary to consider the complaint well founded in relation to the request for removal of the aforementioned URL and to have, for the effect, to order Google LLC, pursuant to art. 58, par. 2, lett. c) and g), of the Regulations, to have it removed as a search result available in association with the name of the interested party within twenty days of receipt of this provision;

CONSIDERING, pursuant to art, 17 of the Guarantor's regulation no. 1/2019, that the conditions exist to proceed with the annotation in the internal register of the Authority referred to in art. 57, par. 1, lett. u), of the Regulation, in relation to the measures adopted in this case against Google LLC in accordance with art. 58, par. 2, of the same Regulation;

NOTING, however, that the measure adopted in the case in question against the aforementioned company derives from an assessment carried out by the Authority on the basis of the specificities of the individual case and that, therefore, its registration in the aforementioned internal register cannot be considered, in any future proceedings hinged against the same data controller, as a relevant precedent for the purposes provided for by art. 83, par. 2) lett. c), of the Regulations;

NOTING that, in the event of non-compliance with the provisions of the Guarantor, the administrative sanction referred to in art. 83, par. 5, lett. e), of the Regulations;

HAVING REGARD to the documentation on file;

HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000;

RAPPORTEUR Dr. Agostino Ghiglia;

WHEREAS, THE GUARANTOR

pursuant to art. 57, par. 1 letter f), of the Regulations declares:

a) the complaint based on the request for removal of the URL indicated in the complaint and, by effect, pursuant to art. 58, par. 2, lett. c) and g), of the Regulations, orders Google LLC to remove it as a search result found in association with the name of the interested party within twenty days of receipt of this provision;

b) pursuant to art. 17 of the regulation of the Guarantor n. 1/2019, provides for the entry in the internal register of the Authority pursuant to art. 57, par. 1, lett. u), of the Regulations, of the measures taken against Google LLC in accordance with art. 58, par. 2, of the same Regulation, without however attributing to this annotation - for the reasons mentioned in the introduction - a previous value in any future proceedings hinged on the same data controller, for the purposes provided for by art. 83, par. 2), lett. c), of the Regulation.

Pursuant to art. 157 of the Code, Google LLC is invited to communicate, within thirty days from the date of receipt of this provision, which initiatives have been undertaken in order to implement the provisions therein. Please note that failure to respond to the above request is punished with the administrative sanction pursuant to art. 166 of the Code.

Pursuant to art. 78 of the Regulation, as well as art. 152 of the Code and 10 of the d. lg. 1 September 2011, n. 150, against this provision, opposition may be proposed to the ordinary judicial authority, with an appeal filed, alternatively, at the court of the place where the data controller resides or is based or at that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the applicant resides abroad.

Rome, January 27, 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Ghiglia

THE SECRETARY GENERAL
Mattei

[doc. web n. 9747505]

Provision of January 27, 2022

Record of measures
n. 27 of January 27, 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, members, and the cons. Fabio Mattei, general secretary;

GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

GIVEN the Code regarding the protection of personal data, containing provisions for the adaptation of the national system to Regulation (EU) 2016/679 (Legislative Decree June 30, 2003, n. 196, as amended by Legislative Decree 10 August 2018, n. 101, hereinafter the "Code");

GIVEN the complaint submitted to the Guarantor, pursuant to art. 77 of the Regulation, on 19 March 2021 with which XX asked to order Google LLC to remove, from the search results available in association with his name, a URL linked to a page containing an administrative act of a local authority that also reports information concerning him referring to a public competition in which he participated in 2019;

CONSIDERING that the interested party complained, in particular, that;

the competition in question ended in July 2019;

the deed published on the institutional website of the body that launched the competition "does not constitute a ranking of merit, but a mere intermediate information list" as it contains the list of those admitted and not admitted to the oral exam with their scores;

for these reasons, the public interest in having knowledge of such information for research conducted in association with their name cannot be deemed to exist and that such processing is excessively prejudicial to their legal sphere;

HAVING REGARD to the note of 2 July 2021 with which the Authority asked the data controller to provide his observations in relation to what is represented in the introductory act of the procedure and to communicate his possible intention to adhere to the requests of the complainant;

GIVEN the note of 22 July 2021 with which Google LLC found that it could not adhere to the request for removal made by the interested party because:

the URL indicated in the complaint refers to a document published on the institutional website of a local authority concerning the list of those admitted to the oral exam in a public competition;

the information thus available relates to the complainant's professional career and is recently published, which is why the conditions for exercising the right to be forgotten are not deemed to exist;

GIVEN the note of 23 July 2021 with which the interested party reiterated his request, noting, in particular, that no specific reasons are identified for the indexation of an intermediate deed of an insolvency procedure which has now been concluded given that, "if the validity legal status of a final merit ranking is 3 years, the public interest for an intermediate document that does not constitute a final merit ranking "should reasonably run out in a shorter time";

CONSIDERING, preliminarily, that:

as a result of the activities carried out in Europe through its offices, the principle of establishment applies to Google LLC and therefore the related processing is subject to the provisions of the Regulation by virtue of the provisions of art. 3, par. 1;

the processing of personal data connected to the use of the Google search engine is however directly managed, also for the EU territory, by Google LLC, based in the United States;

this circumstance is suitable to found, pursuant to art. 55, par. 1, of the Regulation, the competence of the Italian Guarantor to decide the complaints proposed to it with reference to its own national territory;

CONSIDERING that, unless the fact constitutes a more serious crime, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents, is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the tasks or the exercise of the powers of the Guarantor";

NOTING that:

the request made by the interested party concerns an intermediate act of an insolvency procedure containing the data, including the vote, of the candidates admitted and not admitted to the oral exam:

the competition in question has been concluded from July 2019 and the publication of data relating to the intermediate stages of the procedure, including the indication of the outcome of the test, does not appear to correspond to a specific public interest;

the accessibility of the disputed information cannot therefore be considered justified on the basis of an interest of the community such as to prevail over the individual's right to the protection of his own legal sphere which from such persistent disclosure seems indeed to suffer disproportionate damage (see point 8 part II of the Guidelines of November 26, 2014), also taking into account the principle of data minimization pursuant to art. 5, par. 1, lett. e), of the Regulation which the same public bodies should comply with when they arrange for the publication of documents within their respective institutional sites also in light of the obligations envisaged in terms of transparency (see Article 19 of Legislative Decree no. . 33/2013, as well as "Guidelines on the processing of personal data, also contained in administrative deeds and documents, carried out for the purpose of advertising and transparency on the web by public entities and other obliged entities" issued by the Guarantor on May 15, 2014 , web doc. no. 3134436);

CONSIDERING, therefore, that it is necessary to consider the complaint well founded in relation to the request for removal of the aforementioned URL and to have, for the effect, to order Google LLC, pursuant to art. 58, par. 2, lett. c) and g), of the Regulations, to have it removed as a search result available in association with the name of the interested party within twenty days of receipt of this provision;

CONSIDERING, pursuant to art, 17 of the Guarantor's regulation no. 1/2019, that the conditions exist to proceed with the annotation in the internal register of the Authority referred to in art. 57, par. 1, lett. u), of the Regulation, in relation to the measures adopted in this case against Google LLC in accordance with art. 58, par. 2, of the same Regulation;

NOTING, however, that the measure adopted in the case in question against the aforementioned company derives from an assessment carried out by the Authority on the basis of the specificities of the individual case and that, therefore, its registration in the aforementioned internal register cannot be considered, in any future proceedings hinged against the same data controller, as a relevant precedent for the purposes provided for by art. 83, par. 2) lett. c), of the Regulations;

NOTING that, in the event of non-compliance with the provisions of the Guarantor, the administrative sanction referred to in art. 83, par. 5, lett. e), of the Regulations;

HAVING REGARD to the documentation on file;

HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000;

RAPPORTEUR Dr. Agostino Ghiglia;

WHEREAS, THE GUARANTOR

pursuant to art. 57, par. 1 letter f), of the Regulations declares:

a) the complaint based on the request for removal of the URL indicated in the complaint and, by effect, pursuant to art. 58, par. 2, lett. c) and g), of the Regulations, orders Google LLC to remove it as a search result found in association with the name of the interested party within twenty days of receipt of this provision;

b) pursuant to art. 17 of the regulation of the Guarantor n. 1/2019, provides for the entry in the internal register of the Authority pursuant to art. 57, par. 1, lett. u), of the Regulations, of the measures taken against Google LLC in accordance with art. 58, par. 2, of the same Regulation, without however attributing to this annotation - for the reasons mentioned in the introduction - a previous value in any future proceedings hinged on the same data controller, for the purposes provided for by art. 83, par. 2), lett. c), of the Regulation.

Pursuant to art. 157 of the Code, Google LLC is invited to communicate, within thirty days from the date of receipt of this provision, which initiatives have been undertaken in order to implement the provisions therein. Please note that failure to respond to the above request is punished with the administrative sanction pursuant to art. 166 of the Code.

Pursuant to art. 78 of the Regulation, as well as art. 152 of the Code and 10 of the d. lg. 1 September 2011, n. 150, against this provision, opposition may be proposed to the ordinary judicial authority, with an appeal filed, alternatively, at the court of the place where the data controller resides or is based or at that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the applicant resides abroad.

Rome, January 27, 2022

PRESIDENT
Stanzione

THE RAPPORTEUR
Ghiglia

THE SECRETARY GENERAL
Mattei