Garante per la protezione dei dati personali (Italy) - 9867661
From GDPRhub
| Garante per la protezione dei dati personali - 9867661 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 17(1)(c) GDPR Article 58(2)(a) GDPR Article 58(2)(c) GDPR Article 58(2)(g) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 26.01.2023 |
| Published: | 26.01.2023 |
| Fine: | n/a |
| Parties: | Il Sole 24 Ore S.p.a. Società Editoriale Il Fatto S.p.a Mr. XX |
| National Case Number/Name: | 9867661 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Provvedimento del 26 gennaio 2023 [9867661 (in IT)] |
| Initial Contributor: | Kevin |
In the context of an erasure request under Article 17 GDPR, the Italian DPA ordered two online newspapers to take action in order to ensure the delisting of their publications from external search engines, insofar as the data subject's name was used as a keyword for the search.
English Summary
Facts
In 2014, two Italian media outlets - "Il Sole 24 Ore" and "Società Editoriale il Fatto" (the controllers) - published online two articles regarding a judicial dispute where the data subject was involved. The data subject's name appeared in the publications and thus it became a keyword for searches on external search engines.
Months later, the competent Italian court found that the data subject was in no meaningful relationship with the facts at issue in the judicial proceeding. After the judgment, the data subject contacted the two publishers asking for the erasure of the articles from their online pages because the information violated the data subject's right to be forgotten under Article 17 GDPR. The data subject considered the publications outdated and deceptive.
Nevertheless, instead of erasing the articles, the controllers updated them by including the final judicial decision.
Holding
The Italian DPA held that the controllers violated Article 17 GDPR. In particular, a controller shall facilitate the exercise of data subject's rights in accordance with the procedural rules set forth in Article 12 GDPR. The fact that the controllers updated the content of the original publication was not considered sufficient by the supervisory authority.
Therefore, pursuant to Article 58(2)(c) and (g) GDPR, the Italian DPA ordered the controllers to take action in order to ensure the delisting of the publications from external search engines, insofar as the data subject's name was used as a keyword for the online search.
In addition, the Italian DPA issued a warning against the controller pursuant to Article 58(2)(a) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web no. 9867661] Provision of January 26, 2023 Register of measures no. 29 of 26 January 2023 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation"); HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code"); CONSIDERING the complaint pursuant to art. 77 of the Regulation presented to the Guarantor on 15 May 2020 with which Mr. XX, through his lawyer, Avv. Roberto Immediata, invoked the right to be forgotten pursuant to art. 17 of the Regulation, with reference to two articles dating back to 2014, available in association with one's name and surname, pertaining to a legal case defined with a final acquittal sentence of 2019 (http://... and https:// ... ); CONSIDERING that the interested party has asked the Guarantor to enjoin the companies holders of the treatment (Il Sole 24 Ore S.p.a. and Società Editoriale Il Fatto - hereinafter "SEIF" - S.p.a.) to «satisfy the requests to exercise the right pursuant to art. .17 of the Regulations» representing, in particular, that: ─ "despite the considerable amount of time spent, still, on the aforementioned engine, by performing a search on the name and surname of the applicant, the exposed combinations still result, never updated with the facts concerning the acquittal and, therefore, obsolete and misleading", with serious prejudice to his professional and social image: ─ on 2 December 2019, «formal requests for cancellation of personal data pursuant to art. 17 Reg. 679/2016" in which, in particular, "it invited the publications themselves to de-index or delist the urls indicated", requests that remained "without any result"; ─ the invoked right to be forgotten, as the right "to return to anonymity is, [therefore], related, on the one hand, to the right to personal identity - that is, not to have one's social image distorted - and on the other, to the right to the protection of personal data, so that the inaccurate republication of news belonging to the past determines the possibility of obtaining its cancellation" and, on the other hand, "only the data controller - having full management of the site on to which the news is published - can completely remove the news from the web"; ─ the processing of the complainant's data described in the complaint «is illegitimate as they are stored (in an obsolete and misleading way) in a form that allows their identification for a period much longer than that necessary for the purposes for which they were collected and treaties (i.e. to the public interest in information)'; ─ «initially legitimate, the modalities of publication and diffusion of the article on the net, such as those of relative conservation and filing, were then transformed into an illicit treatment of personal data when, after more than a month from receipt of the cancellation request, access to that journalistic service published long before and disseminated on the web is maintained»; with consequent manifest violation of the art. 17 of EU Regulation no. 679/2016; HAVING REGARD TO the note of 9 April 2021 with which the Authority asked Il Sole 24 Ore S.p.a (prot. 18998) and SEIF S.p.a. (prot. 18995) to provide their observations regarding what is represented in the complaint and to communicate their intention to comply with the requests of the complainant; GIVEN the notes of 28 April 2021 with which Il Sole 24 Ore S.p.a. and SEIF S.p.a., in analogous terms, have shown that: ─ on 2 December 2019, an "application for cancellation of personal data" was received, in the interest of the complainant, in which his lawyer invoked the right to be forgotten, for a story mentioned in an article dated 21 May 2014, which however was defined with a sentence pronounced on 13 June 2019, therefore only six months before the request; ─ the articles subject to the complaint have been updated reporting the acquittal of the complainant; ─ «the choice to proceed with its updating, rather than its removal - since the complainant never asked for its de-indexing, as can be deduced from reading the request of 2 December 2020, in which he always and only speaks of cancellation, while quoting en passant , the de-indexing - pertains to the moment in which the situation, described in the article in question, had its epilogue, i.e. in June 2019, indeed with the expiry of the term for the appeal of the Public Prosecution, which expired in September of that year"; ─ the update was not communicated to the complainant, deeming that there is no obligation in this sense, «which only applies when the data owner requests information that cannot be found elsewhere»; ─ the availability of the article - in which the complainant moreover «is mentioned among the subjects, involved in the investigations and drawn from the same precautionary measure, in just two lines, in which he appears with his name and surname and with his qualifications» - was justified due to the complexity and peculiarity of the legal case which, at the time of the claimant's requests, was still pending for some defendants; ─ «the processing took place, originally, in the legitimate exercise of the right of judicial reporting, as the claimant himself confirms and no request, concerning the exercise of the right, referred to in the aforementioned art. 17, has remained unfulfilled"; ─ «the complainant defines himself as a well-known and esteemed professional, engaged in the field of corporate, financial and investment brokerage in projects in the fashion field, therefore he is still present and operating in the economic sector and maintains his public and social evidence , which confirms the legitimacy of the Company's choice"; and, moreover, with specific reference to the profile relating to the exercise of rights, Il Sole 24 Ore S.p.a. specified that: ─to the PEC containing the "cancellation request" received on 2 December 2019 at 6.46 pm, the Company provided a timely response on 3 December 2019 at 11.07 am requesting a copy of the acquittal sentence, following which it updated of the news; information that - by performing a search on the net by typing the name and surname of the claimant - was already highlighted in the "snippet"; the complainant therefore consulted the Authority without first carrying out the necessary checks, in order to ascertain whether the sending of the sentence to the Publisher had had any effect, so as to be able to omit "at least the complaint, relating to the failure to update, with the data concerning his acquittal”; HAVING REGARD to the note of 20 May 2021 in which the complainant reiterated his claim to have the right to be forgotten and the de-indexing of the aforementioned articles recognised, invoking art. 17, paragraph 1, lett. c of the Regulation, the jurisprudence of the Court of Justice and the Guidelines Guidelines 5/2019, on the criteria of the right to be forgotten in cases involving search engines, drawn up by the European Data Protection Board (EDPB), representing in particular that: ─ the companies consulted have not provided "proof of prevailing and mandatory elements with respect to the individual right of the interested party to return to anonymity (right to be forgotten), not to have their corporate image distorted (right to personal identity) and to right to the protection of personal data"; ─ the continuous approach to the judicial matter that involved him makes the story appear as "still current" transforming, consequently, into an unjust prejudice; ─ despite being an esteemed professional, he has neither notoriety nor a particular position in public life; ─ other publishers of newspapers, to which the complainant addressed himself with the same request, proceeded to prohibit the indexing through the common search engines of the articles published on the matter in question on their respective online sites; CONSIDERING that, with respect to SEIF S.p.a., an additional preliminary investigation was necessary regarding the profile of the exercise of rights, at the end of which the Company specified (note dated 1 December 2022) that: ─ "following a thorough check of the Company's e-mail box, a check carried out ... revealed that the cancellation request sent by the complainant never reached the natural recipient", as specifically attested by the representative lawyer of the Company and that, despite the regular delivery of the PEC being documented, evidently due to a "technical problem" the aforementioned request did not actually reach the editorial staff and the legal office of the Company; ─ failure to respond to the complainant is therefore not due to bad faith or an obstructive will, as it is the Company's practice to respond regularly to requests from interested parties; ─ in any case, the article has been appropriately updated, as represented in the brief sent to the Authority on 28 April 2021 CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor"; WHEREAS the complainant, in invoking the right to be forgotten, pursuant to art. 17 of the Regulation, recalls the principles established by the Court of Justice of the European Union, with sentence of 13 May 2014 (case C-131/12) and by the aforementioned Guidelines 5/20169, which however provide the criteria for the determinations in subject of delisting by search engines, as independent data controllers, where the complaint in question concerns instead the publishers of the articles indicated in the deed, Il Sole 24 Ore Sp.a. and SEIF S.p.a., as data controllers; NOTING therefore that, with reference to the regulations applicable to these holders: the processing of the personal data of the interested party appears to have been carried out, at the time of the original publication of the news, in the exercise of the right of journalistic reporting as it responds to the public's interest in knowing the events reported in the related articles also in consideration of the professional activity carried out by the interested party (articles 136 et seq. of the Code and art. 6 Deontological rules); with respect to the requests made by the complainant (December 2019) the procedural matter had been defined for a few months (June 2019) and that therefore the oblivion invoked by the complainant against the publishers could not be based on the alleged "significant period of time elapsed" and that a reasonable measure could therefore be found in the updating of the news, in compliance with the principles expressed by the jurisprudence (starting from the well-known sentence of the Civil Cassation, section III, n. 5525/2012) which was carried out by the Publishers involved in the complaint; CONSIDERING on the other hand that, as also asserted by the defendant Editors, within the articles subject to the complaint, the reference to the involvement of the complainant in the legal case was limited to "only two lines, in which he appears with name and surname and with his qualifications" and that, pending the proceedings, the same affair appears to have been defined overall, also in the light of the procedural outcomes in acquittal terms with regard to other defendants more involved in the affair itself, so as to determine a weakening of the public interest in finding the articles themselves; CONSIDERING therefore that, at present, the adoption of specific technical measures aimed at prohibiting the indexing of the articles indicated above in association with the complainant's name and surname by search engines external to the sites of the respective newspapers can be considered suitable for satisfying the need for a balance between the right to be forgotten invoked by the complainant and the safeguarding of the information purposes invoked by the Publishers; this, also in line with the orientation expressed by the Italian legislator on the subject of the right to be forgotten, the provision of which (art. 64-ter of Legislative Decree 10 October 2022, n.150) entered into force on 1 January 2023 ; CONSIDERING therefore that it is necessary to order Il Sole 24 Ore and SEIF S.p.a. to adopt such measures in compliance with the requests of the complainant; DETECTED, with regard to the exercise of the rights pursuant to articles 15 -21 of the Regulation, which: a) Il Sole 24 Ore represented (and documented) that it had provided an initial timely response to the complainant's request dated 2 December 2019, requesting the documentation necessary for the update (which is ordered on the following 7 January 2020), without however communicating formally the adoption of this measure and the reasons for not accepting the further requests of the complainant; b) SEIF S.p.a. represented that the PEC containing the complainant's request, although formally delivered, was not received by the editorial staff of the newspaper and by the Company's Legal Department - responsible for providing the necessary response - due to a "technical problem", not attributable to bad faith of the data controller, considering the aptitude of the Company to generally guarantee a reply to the requests attributable to the exercise of the aforementioned rights; CONSIDERING that such conduct, albeit with the peculiarities of the case, nevertheless highlight elements abstractly suitable for integrating the details of a violation of art. 12 of the Regulation; CONSIDERING therefore that it is necessary to contact Il Sole 24 Ore S.p.a. and to SEIF S.p.a. a warning, pursuant to art. 58, par. 2, lit. a), of the Regulation, in relation to the circumstance that the failure or incomplete and late response to a request attributable to the exercise of one of the rights provided for by articles 15-21 of the Regulation constitutes a conduct contra legem, also liable to a sanction (art. 83, paragraph 5. letter b), inviting the Companies to identify, in relation to future similar cases, in the light of the well-known principles of accountability and privacy by design introduced by the Regulation (articles 24 and 25), adequate measures to guarantee the effective exercise of the rights of the interested parties in the terms and in the manner provided for by the aforementioned art. 12 of the Regulation; HAVING REGARD to the documentation in the deeds; GIVEN the observations made pursuant to art. 15 of the Guarantor's regulation n. 1/2000; SPEAKER Prof. Pasquale Stanzione; ALL THIS CONSIDERING THE GUARANTOR pursuant to art. 57, par. 1 lit. f), of the Regulation: a) declares the complaint well founded and, as a result, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, orders Il Sole 24 Ore and SEIF S.p.a. to adopt specific technical measures aimed at prohibiting, by search engines external to the websites of the respective newspapers, the indexing of the articles indicated in the introduction in association with the name and surname of the complainant; b) pursuant to art. 58, par. 2, lit. a), of the Regulation, establishes the measure of the warning towards Il Sole 24 Ore S.p.a. and to SEIF S.p.a. in relation to the circumstance that failure or incomplete response to a request attributable to the exercise of one of the rights envisaged by articles 15 - 21 of the Regulation constitutes conduct contra legem, also liable to an administrative-pecuniary sanction (article 83, paragraph 5 . letter b), inviting the Company to identify, in relation to future similar cases, in the light of the well-known principles of accountability and privacy by design introduced by the Regulation (articles 24 and 25), adequate measures to guarantee the effective exercise of rights of the interested parties in the terms and in the manner provided for by the aforementioned art. 12 of the Regulation. Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 26 January 2023 PRESIDENT station THE SPEAKER station THE SECRETARY GENERAL Matthew [doc. web no. 9867661] Provision of January 26, 2023 Register of measures no. 29 of 26 January 2023 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation"); HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code"); CONSIDERING the complaint pursuant to art. 77 of the Regulation presented to the Guarantor on 15 May 2020 with which Mr. XX, through his lawyer, Avv. Roberto Immediata, invoked the right to be forgotten pursuant to art. 17 of the Regulation, with reference to two articles dating back to 2014, available in association with one's name and surname, pertaining to a legal case defined with a final acquittal sentence of 2019 (http://... and https:// ... ); CONSIDERING that the interested party has asked the Guarantor to enjoin the companies holders of the treatment (Il Sole 24 Ore S.p.a. and Società Editoriale Il Fatto - hereinafter "SEIF" - S.p.a.) to «satisfy the requests to exercise the right pursuant to art. .17 of the Regulations» representing, in particular, that: ─ "despite the considerable amount of time spent, still, on the aforementioned engine, by performing a search on the name and surname of the applicant, the exposed combinations still result, never updated with the facts concerning the acquittal and, therefore, obsolete and misleading", with serious prejudice to his professional and social image: ─ on 2 December 2019, «formal requests for cancellation of personal data pursuant to art. 17 Reg. 679/2016" in which, in particular, "it invited the publications themselves to de-index or delist the urls indicated", requests that remained "without any result"; ─ the invoked right to be forgotten, as the right "to return to anonymity is, [therefore], related, on the one hand, to the right to personal identity - that is, not to have one's social image distorted - and on the other, to the right to the protection of personal data, so that the inaccurate republication of news belonging to the past determines the possibility of obtaining its cancellation" and, on the other hand, "only the data controller - having full management of the site on to which the news is published - can completely remove the news from the web"; ─ the processing of the complainant's data described in the complaint «is illegitimate as they are stored (in an obsolete and misleading way) in a form that allows their identification for a period much longer than that necessary for the purposes for which they were collected and treaties (i.e. to the public interest in information)'; ─ «initially legitimate, the modalities of publication and diffusion of the article on the net, such as those of relative conservation and filing, were then transformed into an illicit treatment of personal data when, after more than a month from receipt of the cancellation request, access to that journalistic service published long before and disseminated on the web is maintained»; with consequent manifest violation of the art. 17 of EU Regulation no. 679/2016; HAVING REGARD TO the note of 9 April 2021 with which the Authority asked Il Sole 24 Ore S.p.a (prot. 18998) and SEIF S.p.a. (prot. 18995) to provide their observations regarding what is represented in the complaint and to communicate their intention to comply with the requests of the complainant; GIVEN the notes of 28 April 2021 with which Il Sole 24 Ore S.p.a. and SEIF S.p.a., in analogous terms, have shown that: ─ on 2 December 2019, an "application for cancellation of personal data" was received, in the interest of the complainant, in which his lawyer invoked the right to be forgotten, for a story mentioned in an article dated 21 May 2014, which however was defined with a sentence pronounced on 13 June 2019, therefore only six months before the request; ─ the articles subject to the complaint have been updated reporting the acquittal of the complainant; ─ «the choice to proceed with its updating, rather than its removal - since the complainant never asked for its de-indexing, as can be deduced from reading the request of 2 December 2020, in which he always and only speaks of cancellation, while quoting en passant , the de-indexing - pertains to the moment in which the situation, described in the article in question, had its epilogue, i.e. in June 2019, indeed with the expiry of the term for the appeal of the Public Prosecution, which expired in September of that year"; ─ the update was not communicated to the complainant, deeming that there is no obligation in this sense, «which only applies when the data owner requests information that cannot be found elsewhere»; ─ the availability of the article - in which the complainant moreover «is mentioned among the subjects, involved in the investigations and drawn from the same precautionary measure, in just two lines, in which he appears with his name and surname and with his qualifications» - was justified due to the complexity and peculiarity of the legal case which, at the time of the claimant's requests, was still pending for some defendants; ─ «the processing took place, originally, in the legitimate exercise of the right of judicial reporting, as the claimant himself confirms and no request, concerning the exercise of the right, referred to in the aforementioned art. 17, has remained unfulfilled"; ─ «the complainant defines himself as a well-known and esteemed professional, engaged in the field of corporate, financial and investment brokerage in projects in the fashion field, therefore he is still present and operating in the economic sector and maintains his public and social evidence , which confirms the legitimacy of the Company's choice"; and, moreover, with specific reference to the profile relating to the exercise of rights, Il Sole 24 Ore S.p.a. specified that: ─to the PEC containing the "cancellation request" received on 2 December 2019 at 6.46 pm, the Company provided a timely response on 3 December 2019 at 11.07 am requesting a copy of the acquittal sentence, following which it updated of the news; information that - by performing a search on the net by typing the name and surname of the claimant - was already highlighted in the "snippet"; the complainant therefore consulted the Authority without first carrying out the necessary checks, in order to ascertain whether the sending of the sentence to the Publisher had had any effect, so as to be able to omit "at least the complaint, relating to the failure to update, with the data concerning his acquittal”; HAVING REGARD to the note of 20 May 2021 in which the complainant reiterated his claim to have the right to be forgotten and the de-indexing of the aforementioned articles recognised, invoking art. 17, paragraph 1, lett. c of the Regulation, the jurisprudence of the Court of Justice and the Guidelines Guidelines 5/2019, on the criteria of the right to be forgotten in cases involving search engines, drawn up by the European Data Protection Board (EDPB), representing in particular that: ─ the companies consulted have not provided "proof of prevailing and mandatory elements with respect to the individual right of the interested party to return to anonymity (right to be forgotten), not to have their corporate image distorted (right to personal identity) and to right to the protection of personal data"; ─ the continuous approach to the judicial matter that involved him makes the story appear as "still current" transforming, consequently, into an unjust prejudice; ─ despite being an esteemed professional, he has neither notoriety nor a particular position in public life; ─ other publishers of newspapers, to which the complainant addressed himself with the same request, proceeded to prohibit the indexing through the common search engines of the articles published on the matter in question on their respective online sites; CONSIDERING that, with respect to SEIF S.p.a., an additional preliminary investigation was necessary regarding the profile of the exercise of rights, at the end of which the Company specified (note dated 1 December 2022) that: ─ "following a thorough check of the Company's e-mail box, a check carried out ... revealed that the cancellation request sent by the complainant never reached the natural recipient", as specifically attested by the representative lawyer of the Company and that, despite the regular delivery of the PEC being documented, evidently due to a "technical problem" the aforementioned request did not actually reach the editorial staff and the legal office of the Company; ─ failure to respond to the complainant is therefore not due to bad faith or an obstructive will, as it is the Company's practice to respond regularly to requests from interested parties; ─ in any case, the article has been appropriately updated, as represented in the brief sent to the Authority on 28 April 2021 CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor"; WHEREAS the complainant, in invoking the right to be forgotten, pursuant to art. 17 of the Regulation, recalls the principles established by the Court of Justice of the European Union, with sentence of 13 May 2014 (case C-131/12) and by the aforementioned Guidelines 5/20169, which however provide the criteria for the determinations in subject of delisting by search engines, as independent data controllers, where the complaint in question concerns instead the publishers of the articles indicated in the deed, Il Sole 24 Ore Sp.a. and SEIF S.p.a., as data controllers; NOTING therefore that, with reference to the regulations applicable to these holders: the processing of the personal data of the interested party appears to have been carried out, at the time of the original publication of the news, in the exercise of the right of journalistic reporting as it responds to the public's interest in knowing the events reported in the related articles also in consideration of the professional activity carried out by the interested party (articles 136 et seq. of the Code and art. 6 Deontological rules); with respect to the requests made by the complainant (December 2019) the procedural matter had been defined for a few months (June 2019) and that therefore the oblivion invoked by the complainant against the publishers could not be based on the alleged "significant period of time elapsed" and that a reasonable measure could therefore be found in the updating of the news, in compliance with the principles expressed by the jurisprudence (starting from the well-known sentence of the Civil Cassation, section III, n. 5525/2012) which was carried out by the Publishers involved in the complaint; CONSIDERING on the other hand that, as also asserted by the defendant Editors, within the articles subject to the complaint, the reference to the involvement of the complainant in the legal case was limited to "only two lines, in which he appears with name and surname and with his qualifications" and that, pending the proceedings, the same affair appears to have been defined overall, also in the light of the procedural outcomes in acquittal terms with regard to other defendants more involved in the affair itself, so as to determine a weakening of the public interest in finding the articles themselves; CONSIDERING therefore that, at present, the adoption of specific technical measures aimed at prohibiting the indexing of the articles indicated above in association with the complainant's name and surname by search engines external to the sites of the respective newspapers can be considered suitable for satisfying the need for a balance between the right to be forgotten invoked by the complainant and the safeguarding of the information purposes invoked by the Publishers; this, also in line with the orientation expressed by the Italian legislator on the subject of the right to be forgotten, the provision of which (art. 64-ter of Legislative Decree 10 October 2022, n.150) entered into force on 1 January 2023 ; CONSIDERING therefore that it is necessary to order Il Sole 24 Ore and SEIF S.p.a. to adopt such measures in compliance with the requests of the complainant; DETECTED, with regard to the exercise of the rights pursuant to articles 15 -21 of the Regulation, which: a) Il Sole 24 Ore represented (and documented) that it had provided an initial timely response to the complainant's request dated 2 December 2019, requesting the documentation necessary for the update (which is ordered on the following 7 January 2020), without however communicating formally the adoption of this measure and the reasons for not accepting the further requests of the complainant; b) SEIF S.p.a. represented that the PEC containing the claimant's request, although formally delivered, was not received by the editorial staff of the newspaper and by the Legal Department of the Company - appointed to provide the necessary response - due to a "technical problem", not attributable to bad faith of the data controller, considering the aptitude of the Company to generally guarantee a reply to the requests attributable to the exercise of the aforementioned rights; CONSIDERING that such conduct, albeit with the peculiarities of the case, nevertheless highlight elements abstractly suitable for integrating the details of a violation of art. 12 of the Regulation; CONSIDERING therefore that it is necessary to contact Il Sole 24 Ore S.p.a. and to SEIF S.p.a. a warning, pursuant to art. 58, par. 2, lit. a), of the Regulation, in relation to the circumstance that the failure or incomplete and late response to a request attributable to the exercise of one of the rights provided for by articles 15-21 of the Regulation constitutes a conduct contra legem, also liable to a sanction (art. 83, paragraph 5. letter b), inviting the Companies to identify, in relation to future similar cases, in the light of the well-known principles of accountability and privacy by design introduced by the Regulation (articles 24 and 25), adequate measures to guarantee the effective exercise of the rights of the interested parties in the terms and in the manner provided for by the aforementioned art. 12 of the Regulation; HAVING REGARD to the documentation in the deeds; GIVEN the observations made pursuant to art. 15 of the Guarantor's regulation n. 1/2000; SPEAKER Prof. Pasquale Stanzione; ALL THIS CONSIDERING THE GUARANTOR pursuant to art. 57, par. 1 lit. f), of the Regulation: a) declares the complaint well founded and, as a result, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, orders Il Sole 24 Ore and SEIF S.p.a. to adopt specific technical measures aimed at prohibiting, by search engines external to the websites of the respective newspapers, the indexing of the articles indicated in the introduction in association with the name and surname of the complainant; b) pursuant to art. 58, par. 2, lit. a), of the Regulation, establishes the measure of the warning towards Il Sole 24 Ore S.p.a. and to SEIF S.p.a. in relation to the circumstance that failure or incomplete response to a request attributable to the exercise of one of the rights envisaged by articles 15 - 21 of the Regulation constitutes conduct contra legem, also liable to an administrative-pecuniary sanction (article 83, paragraph 5 . letter b), inviting the Company to identify, in relation to future similar cases, in the light of the well-known principles of accountability and privacy by design introduced by the Regulation (articles 24 and 25), adequate measures to guarantee the effective exercise of rights of the interested parties in the terms and in the manner provided for by the aforementioned art. 12 of the Regulation. Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 26 January 2023 PRESIDENT station THE SPEAKER station THE SECRETARY GENERAL Matthew
