IDPC (Malta) - CDP COMP 144 2022
| IDPC - CDP_COMP_144_2022 | |
|---|---|
 | |
| Authority: | IDPC (Malta) |
| Jurisdiction: | Malta |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | CDP_COMP_144_2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | CDP_COMP_144_2022 (in EN) |
| Initial Contributor: | sh |
The Maltese DPA ordered a media company to add a no-index metatag to a news article within 20 days. This act fulfils a data subject's right to be forgotten under Article 17 GDPR.
English Summary
Facts
A data subject asked the Maltese DPA to order a media company (the controller) to remove a published article from its website. The article linked his name (as the executive of a gambling company at the time) to organised crime syndicates and the subsequent removal of betting licenses for gambling companies. This meant that when people searched for terms like 'mafia,''mob,' or 'gambling,' his name was likely to come up. The controller responded to the complaint, arguing to the DPA that the data was processed for journalistic purposes. The removal of the aforementioned article would jeopardize the right to free expression and information. Furthermore, the suspension of betting licenses has been the subject of Maltese court cases. Case reporting is also afforded journalistic privileges under national law.
Holding
The Maltese DPA saw its task as balancing the right of the data subject to be forgotten (Article 17 GDPR) with the right to freedom of expression and information. This requirement to strike a fair balance between the two is also specifically required by Article 9 of Malta's Data Protection Act.
First, the Maltese DPA made a distinction between search engines like Google and the Controller, a media company. A democratic society requires the media to disseminate information that is in the public interest. The latter is an online search engine that crawls the web in order to look up kex words entered by the user and returns results in the form of a list. As the complaint was only lodged against the controller, the DPA's investigation was strictly limited to them.
Second, the DPA used case law to inform its choice. It concluded that the CJEU judgements of Lindqvist, Satamedia and Buivids do not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In abscence of this, the DPA turned to ECHR case law which throughout the years has developed a standard set of criteria. These include, among others, the controbution to the debate of public interest, the degree of notoriety of the person affect and the consequence of the publication. As the publication in question contained sensitive data about criminal proceedings and had not been updated despite developments in the case, the DPA deemed the right to be forgotten to be more important than the controller's right to disseminate information.
More importantly for the DPA, the ECHR recently distinguished between de-indexing and the permanent removal of an article under the right to be forgotten in Biancardi v Italy. As a result, the DPA was not required to order the deletion of the article in order to comply with the right to be forgotten. The DPA also considered the case Hurbain vs. Belgium, in which the ECHR emphasized the importance of digital archives in today's world. These must be upheld in order for the press to fulfill its role as a public watchdog. As a result, the press must be able to keep public archives containing previously reported news.
Taking these two recent decisions into account, the DPA ordered the media company to add a no-index metatag to the content head HTML of the case's online page. In this way, the complainant's fundamental rights were respected because his name was removed from the search engines' index, which meant that his name would no longer appear alongside the related key words about which he complained. At the same time, the controller's journalistic freedom is preserved because the article's original content remains unaltered. The controller was given 20 days to comply.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
