Garante per la protezione dei dati personali (Italy) - 9883613

Garante per la protezione dei dati personali - 9883613
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(d) GDPR Article 55(1) GDPR Article 57(1)(f) GDPR Article 58(2)(c) GDPR Article 58(2)(g) GDPR Article 77 GDPR
Type:	Other
Outcome:	n/a
Started:
Decided:	23.03.2023
Published:
Fine:	n/a
Parties:	Google LLC Data subject
National Case Number/Name:	9883613
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	garanteprivacy.it (in IT)
Initial Contributor:	DB, gina.u

Google LLC was ordered to remove URLs yielding results on web pages linking data subject to charges of fraud it was later acquitted of.

English Summary

Facts

The Guarantor for the Protection of Personal Data received a complaint of a data subject pursuant to Article 77 GDPR, in which Google LLC was ordered to remove URLs yielding results in which the data subject was linked to a judicial affair involving charges of fraud of which he later was acquitted. Due to these search results, both personal and professional reputation of the data subject were susceptible to harm.

Holding

Pursuant to Article 55 (1) GDPR, it falls within the realm of competence of the Italian Guarantor to decide complaints brought before it when reference to its national territory is given.

Google LLC asserted that web pages linked to two of the URLs mentioned by the data subject, cannot via search results be associated with the data subject. According to Article 57 1 f GDPR, the Guarantor does neither find sufficient reason to adopt measures in this regard nor to extend a similar assessment to the request for removal outside of solely European versions of the search engine.

The controller also noted that it cannot accede to the request for removal of the remaining URLs as neither has public interest ceded in these nor did the data subject sufficiently communicate the acquittal regarding the crime of fraud. The picture drawn by the search engine´s results does not however yield an apt representation of the data subject´s acquittal in 2015. The Guarantor has found that processing of such data via Google LLC violates the principles of accuracy and updating of data as provided in Art 5 par 1 let d GDPR. Following Art 58 2 c and g GDPR, the Guarantor finds the data subject´s complaint well-founded and hence orders Google LLC to issue the removal of said remaining URLs found to be in association with the data subject´s name.

Pursuant to Article 157 of the Code on the Protection of Personal Data, Google LLC is invited to present which measures have been taken to achieve what was prescribed. Failure to respond to the above request is punishable by the administrative penalty set forth in Article 166 of the Code.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei, general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code");

GIVEN the complaint presented to the Guarantor, pursuant to art. 77 of the Regulation, dated 15 September 2022 with which XX, represented by lawyer XX, asked to order Google LLC to remove certain URLs from the search results available in association with his name, connected to a legal case in which the same was involved with the charge of fraud and in relation to which he was acquitted in 2015, and to extend this intervention also with reference to countries that may have some significance for him;

CONSIDERING that the interested party has, in particular:

complained about the damage deriving to one's personal and professional reputation from the persistent availability on the net of information dating back over time and in relation to which many publishers, to whom the same request was addressed, have adhered by proceeding with the de-indexing of the relative articles;

the reasons for refusal opposed by Google in response to the preliminary questioning are groundless as they refer to an alleged public role of the same due to his candidacy for XX, in a completely extemporaneous way, which however ended with his failure to XX ;

HAVING REGARD to the note dated 21 October 2022 with which the Authority asked the data controller to provide his observations regarding what was represented in the introductory act of the procedure and to communicate his intention, if any, to comply with the requests of the complainant;

HAVING REGARD to the note dated November 10, 2022 with which Google LLC disclosed:

that two of the requested URLs - as identified on the first page of the feedback provided - are linked to pages that are not displayed for searches conducted with the name of the interested party;

not being able to comply with the request for removal of the remaining URLs considering that there is still a public interest in having knowledge of them, also taking into account the fact that the complainant has not provided sufficient elements to be able to carry out a complete assessment of his requests;

that the interested party did not in fact communicate any information regarding the alleged acquittal relating to the crime of fraud, also taking into account the fact that on the basis of the contents connected to some of the URLs of complaint it would appear that the same has been tried for the different crime of abusive exercise of one's reasons;

that the profession currently carried out by Mr. is not even indicated in the complaint. XX which could play a publicly relevant role considering the participation of the same in the XX held in the city of XX and in the XX;

HAVING REGARD to the note of 22 November 2022 with which the data subject provided feedback on what was deduced by the data controller, noting:

to have been acquitted with regard to all the charges reported in the URLs subject to the complaint, of which only one bears the accusation of arbitrary exercise of one's reasons, and that therefore no specific reasons are considered to exist by virtue of which they must remain available in association with your name and surname;

with reference to the alleged public role, to have participated in the XX exclusively in the XX years without being elected in either circumstance;

to carry out his professional activity for several years in the XX, asking to accept his request also with regard to said country in reference to the two URLs subject to de-indexing by Google as the same, in some cases, would continue to remain visible;

CONSIDERING, first of all, that:

towards Google LLC, due to the activities carried out in Europe through its offices, the principle of establishment is applied and therefore the related treatments are subject to the provisions of the Regulation by virtue of the provisions of art. 3, par. 1;

the processing of personal data connected to the use of the Google search engine is however directly managed, also for the EU territory, by Google LLC, based in the United States;

this circumstance is suitable to establish, pursuant to art. 55, par. 1, of the Regulation, the competence of the Italian Guarantor to decide the complaints proposed to it with reference to its national territory;

CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor";

HAVING ACKNOWLEDGED, with reference to the URLs indicated with nos. 1 and 2 of the first page of the feedback provided by Google, that:

the data controller declared during the proceedings that he could not take any action regarding the aforementioned URLs as the related web pages are not displayed among the search results associated with the name of the complainant;

for the same reason it is not possible to evaluate the further request aimed at obtaining the removal of the same two URLs also from the non-European versions of the search engine, also taking into account that, in any case, the excessive generality of the circumstances inferred by the interested party basis of the same does not appear in any case suitable to allow the Authority to be able to carry out the balancing required by the Court of Justice of the European Union in the judgment C-507/2017 of 24 September 2019 (see par. no. 72) and to recently referred to by the Court of Cassation in order no. 34658 of 15 November 2022;

CONSIDERING therefore that, with respect to them, there are no conditions for the adoption of provisions in this regard by the Authority;

CONSIDERED, with regard to the request for removal of the additional URLs indicated in the introductory deed brought against Google LLC, which, for the purpose of assessing the existence of the conditions for the recognition of the right to be forgotten pursuant to articles 17, par. 1, lit. c), and 21, par. 1 of the Regulation, it is necessary to take into account, in addition to the element constituted by the passage of time, also the additional criteria expressly identified by the WP Art. 29 - Article 29 Group on the protection of personal data through the specific "Guidelines" adopted on 26 November 2014 following the aforementioned judgment of the Court of Justice of the European Union, as well as the most recent "Guidelines" no. 5/2019 adopted by the European Data Protection Board (EDPB) on 7 July 2020, containing the criteria for the application of the right to be forgotten by search engines in the light of the Regulation;

NOTING that:

the articles linked to the URLs whose removal by the interested party has been requested are linked to comments, published more than ten years ago, containing information that refers to conduct with respect to which the interested party has been acquitted, as proven by the sentences produced during the proceedings;

the pages in which the aforesaid comments are published do not contain any data useful for providing an update referring to the events involving the complainant and are therefore suitable for providing an overall picture of the same which does not perfectly correspond to what happened in reality;

on the basis of these elements, the reasons inferred by the complainant as the basis of his request are deemed prevalent, taking into account the fact that the processing of such data through the search engine is in contrast with the principles of accuracy and updating of data expressly provided for by the Regulation (cf. art. 5, par. 1, letter d)), as well as with what is stated by the aforementioned "Guidelines" (cf. point 4 of Part II) and that therefore the continued availability on the net of these articles in association with the name of the interested party is likely to create a disproportionate impact on the legal sphere of the same (see point 8 part II of the Guidelines);

CONSIDERING, therefore, that the complaint must be considered founded in relation to the request for removal of the aforementioned URLs and that, as a result, it must order Google LLC, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, to order its removal as a search result available in association with the name of the interested party within twenty days of receipt of this provision;

CONSIDERING, pursuant to art. 17 of the Guarantor's regulation n. 1/2019, that the conditions are met for proceeding with the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, in relation to the measures adopted in the specific case against Google LLC in accordance with art. 58, par. 2, of the same Regulation;

NOTING, however, that the measure adopted in the case in question against the aforesaid company derives from an assessment carried out by the Authority on the basis of the specifics of the individual case and that, therefore, its entry in the aforementioned internal register cannot be held, in any future proceedings against the same data controller, as a relevant precedent for the purposes set out in art. 83, par. 2) lit. c), of the Regulation;

NOTING that, in the event of non-compliance with the provisions of the Guarantor, the administrative sanction pursuant to art. 83, par. 5, letter. e), of the Regulation;

HAVING REGARD to the documentation in the deeds;

GIVEN the observations made pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER Dr. Agostino Ghiglia;

ALL THIS CONSIDERING THE GUARANTOR

pursuant to art. 57, par. 1 lit. f), of the Regulation:

a) takes note of what has been declared by Google regarding the fact that the web pages linked to the URLs nos. 1 and 2 on the first page are not displayed among the Google search results associated with the name of the complainant and therefore believes that there are no grounds for the Authority to adopt measures in this regard, extending a similar assessment also to request to remove the aforementioned URLs from the non-European versions of the search engine for the reasons mentioned in the justification;

a) declares the complaint founded with regard to the remaining URLs and as a result, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, enjoins Google LLC to order their removal as search results available in association with the name of the interested party within twenty days of receiving this provision;

b) has, pursuant to art. 17 of the Guarantor's regulation n. 1/2019, the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, of the measures taken against Google LLC in accordance with art. 58, par. 2, of the Regulation itself, without however attributing to this annotation - for the reasons mentioned in the introduction - the value of precedent in any future proceedings against the same data controller, for the purposes set out in art. 83, par. 2), lit. c), of the Regulation.

Pursuant to art. 157 of the Code, invites Google LLC to communicate, within thirty days from the date of receipt of this provision, what initiatives have been undertaken in order to implement the provisions therein. Please note that failure to respond to the above request is punished with the administrative sanction pursuant to art. 166 of the Code.

Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 23 March 2023

PRESIDENT
station

THE SPEAKER
guille

THE SECRETARY GENERAL
Matthew