CASE OF BIANCARDI v. ITALY
(Application no. 77419/16)

JUDGMENT

Art 10 • Freedom of expression • Civil judgment against newspaper editor for refusal over long period to de-index article on criminal case against private individuals, easily accessible by typing names into Internet search engine • Obligation to de-index material applicable not only to Internet search engine providers but also to administrators of newspaper or journalistic archives accessible via Internet • Information on sensitive data easily accessible online for eight months after formal request to remove it by persons concerned • Sanction not excessive • No requirement to permanently remove article from Internet or to anonymise it

STRASBOURG
25 November 2021

FINAL
25/02/2022

This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision.

In the case of Biancardi v. Italy,
The European Court of Human Rights (First Section), sitting as a Chamber composed of:
Ksenija Turković, President, Péter Paczolay,
Krzysztof Wojtyczek,
Alena Poláčková,
Gilberto Felici,
Erik Wennerström, Raffaele Sabato, judges,
and Renata Degener, Section Registrar,
Having regard to:
the application (no. 77419/16) against the Italian Republic lodged with
the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by an Italian national, Mr Alessandro Biancardi (“the applicant”), on 7 December 2016;
the decision to give notice to the Italian Government (“the Government”) of the complaint concerning Article 10 of the Convention;
the observations submitted by the respondent Government and the observations in reply submitted by the applicant;
the comments submitted by the Reporters Committee for Freedom of the Press, the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights, the Media Lawyers Association and the Media Legal Defence Initiative, who were granted leave to intervene by the President of the Section;
Having deliberated in private on 2 November 2021,
Delivers the following judgment, which was adopted on that date:

INTRODUCTION

• 1. The applicant, the editor-in-chief of an online newspaper, was held liable under civil law for having kept on his newspaper’s website and not having de-indexed an article reporting the facts of a criminal case instituted against private individuals. The applicant alleged the violation of his freedom of expression under Article 10 of the Convention.

THE FACTS

• 2. The applicant was born in 1972 and lives in Pescara. He was represented by Mr M. Franceschelli, a lawyer practising in Pescara.
• 3. The Government were represented by their Agent, Mr Lorenzo D’Ascia.
• 4. The facts of the case, as submitted by the parties, may be summarised as follows.
• 5. The applicant was the editor-in-chief of an online newspaper. On 29 March 2008 he published an article concerning a fight, followed by a stabbing, which had taken place in a restaurant.
• 6. The article was headlined “Fight in the restaurant – the head of the police authority closes the W and Z restaurants [which belonged to the persons involved in the fight]”. The “standfirst paragraph” under the headline read as follows: “Pescara – Reputational damage and financial repercussions sustained by the W and Z restaurants belonging to the X family”.
• 7. The article noted the head of the police authority’s decision to close the restaurants for twenty days. It mentioned the names of the persons involved (two brothers, V.X. and U.X., and their respective sons, A.X and B.X.), as well as the possible motive for the fight, which probably related to a financial quarrel about the ownership of a building. The article reported on the line taken during part of the police questioning of V.X., U.X., A.X and B.X., and noted that U.X. and A.X. had been placed under house arrest, that B.X. had been taken to a detention facility and that a house arrest order issued in respect of V.X. had been lifted.
• 8. On 6 September 2010, V.X. and the W restaurant sent a formal notice (diffida stragiudiziale) to the applicant asking that the article be removed from the Internet, but to no avail.
• 9. On 26 October 2010, V.X. and W lodged two claims with the District Court of Chieti against, respectively, Google Italy S.r.l. and the applicant, pursuant to Article 152 of Legislative Decree no. 196 of 30 June 2003 (hereinafter “the Personal Data Protection Code” – see paragraphs 15 et seq. below) and Article 702 bis of the Code of Civil Procedure (Formal requirements regarding the bringing of proceedings before a court and the parties thereto).
• 10. At the hearing of 23 May 2011, the applicant indicated that he had de-indexed the article in question, with a view to settling the case1. By a decision of 28 March 2012, the court excluded Google Italy S.r.l. from the proceedings following V.X.’s withdrawal of his claim against this party.
• 11. By a decision of 16 January 2013, the District Court of Chieti observed at the outset that, in the light of the information that the applicant had supplied on 23 May 2011, there was no need to examine the part of V.X.’s complaint regarding the request for the article to be removed from the Internet.
• 12. As for the remainder of the complaint, concerning the breach of the claimants’ right to respect for their reputation, the court awarded to each claimant 5,000 euros (EUR) in compensation for non-pecuniary damage and EUR 2,310 for costs and expenses.
• 13. The court referred to the applicable legislation on the matter – namely, Articles 7, 11, 15 and 25 of the Personal Data Protection Code. It noted in particular that the information concerning the claimants had been published on 29 March 2008 and had remained accessible on the Internet until 23 May 2011, notwithstanding V.X.’s formal notice to the applicant asking that the article in question be removed from the Internet (see paragraph 8 above). In the court’s view, the public interest in the right to provide information had then been satisfied and, at least from the date of V.X. sending the above-mentioned formal notice, the processing of his personal data had not been in compliance with Articles 11 and 15 of the Personal Data Protection Code. The court then concluded that there had been a breach of the claimants’ reputation and right to respect for their private life. The court also noted that the information at issue was easily accessible (much more than any information published in print newspapers, taking into account the large local dissemination of the online newspaper at issue) by simply inserting the claimants’ names into the search engine, and that the nature of the relevant data, as regards judicial proceedings, was sensitive.
• 14. The applicant lodged an appeal on points of law; by a judgment of 24 June 2016, the Supreme Court upheld the first-instance decision on all grounds and dismissed the applicant’s appeal. The Supreme Court noted that the processing of the plaintiffs’ personal data had been unlawful inasmuch as the article, published on 29 March 2008, had remained accessible on the Internet, despite the above-mentioned formal notice sent (to the applicant asking that the article in question be removed from the Internet) by V.X. on 6 September 2010, and that the possibility to access the article had been easy and direct. The Supreme Court excluded the possibility that in this case the unlawfulness of the way in which the personal data had been processed had been linked either to the content of the said article, to its online publication and dissemination, or to its conservation and digital archiving.

1 The relevant extract of the Supreme Court’s judgment reads as follows:
“By a declaration reported in the minutes of the hearing of the 23 May 2011, the representative of the [defendant online newspaper, belonging to the applicant] indicated that the newspaper had proceeded to the cancellation of the indexing [l’avvenuta cancellazione dell’indicizzazione] of the article, for the sole purpose of settling the case.”

RELEVANT LEGAL FRAMEWORK AND PRACTICE

I. RELEVANT DOMESTIC LAW

Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code)

• 15. The relevant provisions of the Personal Data Protection Code read as follows:
  Article 7: Right to access personal data, and other rights
  “…
  3. (a) The data subject has the right to obtain the removal, the anonymisation or the interruption of the processing of data that are being used illegally. …
  Article 11: Arrangements for the processing and categorisation of data
  “1. Personal data undergoing processing are:
  …
  (e) kept, in a form that allows the identification of the person concerned, for a period not exceeding the time necessary to achieve the objectives for which the data have been collected and subsequently processed. …”
  Article 15: Damage arising from data processing
  “A person causing damage to a third person as a consequence of the processing of his or her personal data must compensate the person concerned under Article 2050 of the Civil Code. The person concerned is also entitled to obtain compensation for non- pecuniary damage resulting from the breach of Article 11.”
  Article 25: Prohibition of communication and dissemination
  “Communication and dissemination are prohibited in respect of …:
  (a) personal data whose removal has been ordered, after the period of time indicated in Article 11 § (1) (e) has elapsed …”
  Article 99: Compatibility of the objectives and the length of processing
  “1. The processing of personal data for historical, scientific or statistical research purposes is considered to be compatible with the different objectives for which the data was initially collected or processed.
  2. The processing of personal data for historical, scientific or statistical research purposes may be carried out also upon the expiry of the period that is necessary for achieving the different purposes for which the data was initially collected and processed. …”
  Article 136: Journalistic purposes …
  “1. The provision contained in this paragraph [Journalism and Literary and Artistic Expression] are applicable to the processing of data:
  (a) carried out in the exercise of journalistic activities and for the exclusive pursuit of the inherent objectives. …”
  Article 139: Code of ethics concerning journalistic activities
  “The Data Protection Authority encourages the adoption by the National Council of Journalists of a code of ethics in respect of the processing of the [type of] data referred to in Article 136, which [would provide] protective measures … in respect of …, in particular, data that could reveal information regarding [a person’s] state of health or sexual life. …”
  Article 152: Ordinary judicial authorities
  “1. An ordinary judicial authority [autorità giudiziaria ordinaria] has jurisdiction to settle all disputes concerning the application of the provisions contained in the present code …
  2. In order to institute proceedings concerning all disputes mentioned in paragraph 1 above, an appeal shall be lodged with the registry of the court serving the place of residence of the person whose (personal data) are being processed.
  3. The court will decide [a case] sitting in a single-judge formation.
  …
  13. A judgment may not be subject to an appeal on the merits before a second- instance court; however, it may be subject to an appeal on points of law before the Court of Cassation. …”

II. INTERNATIONAL LAW MATERIAL

A. Recommendation CM/Rec(2012)3 of the Council of Europe’s Committee of Ministers to member States on the protection of human rights with regard to search engines

• 16. In its relevant parts, Recommendation CM/Rec(2012)3 of the Council of Europe’s Committee of Ministers to member States on the protection of human rights with regard to search engines, adopted by the Committee of Ministers on 4 April 2012, reads as follows:
  “7. The Committee of Ministers …, under the terms of Article 15.b of the Statute of the Council of Europe, recommends that member States, in consultation with private sector actors and civil society, develop and promote coherent strategies to protect freedom of expression, access to information and other human rights and fundamental freedoms in relation to search engines in line with the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No. 5, hereinafter referred to as the ‘Convention’), especially Article 8 (Right to respect for private and family life) and Article 10 (Freedom of expression) and with the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108, hereafter referred to as ‘Convention No. 108’), in particular by engaging with search engine providers to carry out the following actions:
  – enhance transparency regarding the way in which access to information is provided, in order to ensure access to, and pluralism and diversity of, information and services, in particular the criteria according to which search results are selected, ranked or removed;
  – review search ranking and indexing of content which, although in the public space, is not intended for mass communication (or for mass communication in aggregate). This could include listing content sufficiently low in search results so as to strike a balance between the accessibility of the content in question and the intentions or wishes of its producer (for example having different accessibility levels to content which is published seeking broad dissemination as compared to content which is merely available in a public space). Default settings should be conceived taking account of this objective;
  …
  III. Filtering and de-indexing

Context and challenges

• 12. A prerequisite for the existence of effective search engines is the freedom to crawl and index the information available on the Internet. The filtering and blocking of Internet content by search engine providers entails the risk of violation of freedom of expression guaranteed by Article 10 of the Convention in respect to the rights of providers and users to distribute and access information.
• 13. Search engine providers should not be obliged to monitor their networks and services proactively in order to detect possibly illegal content, nor should they conduct any ex ante filtering or blocking activity, unless mandated by court order or by a competent authority. However, there may be legitimate requests to remove specific sources from their index, for example in cases where other rights outweigh the right to freedom of expression and information; the right to information cannot be understood as extending the access to content beyond the intention of the person who exercises her or his freedom of expression.
• 14. In many countries, search engine providers de-index or filter specific websites at the request of public authorities or private parties in order to comply with legal obligations or at their own initiative (for example in cases not related to the content of websites, but to technical dangers such as malware). Any such de-indexing or filtering should be transparent, narrowly tailored and reviewed regularly subject to compliance with due process requirements.Action
• 15. Member States should:
  – ensure that any law, policy or individual request on de-indexing or filtering is enacted with full respect for relevant legal provisions, the right to freedom of expression and the right to seek, receive and impart information. The principles of due process and access to independent and accountable redress mechanisms should also be respected in this context.
• 16. In addition, member States should work with search engine providers so that they:
  …
  – explore the possibility of allowing de-indexation of content which, while in the public domain, was not intended for mass communication (or mass communication in aggregate). …”B. Council of Europe Convention for the Protection of Individuals with Regard to the Processing of Personal Data of 18 May 2018
  
• 17. The relevant provisions of the Convention of 18 May 2018 – updating the previous Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, which was opened for signature on 28 January 1981 and came into force on 1 October 1985, ETS 108 – read as follows:
  Article 5: Legitimacy of data processing and quality of data
  “1. Data processing shall be proportionate in relation to the legitimate purpose pursued and reflect at all stages of the processing a fair balance between all interests concerned, whether public or private, and the rights and freedoms at stake.
  2. …
  3. Personal data undergoing processing shall be processed lawfully.
  4. Personal data undergoing processing shall be:
  …
  b. collected for explicit, specified and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is, subject to appropriate safeguards, compatible with those purposes;
  c. adequate, relevant and not excessive in relation to the purposes for which they are processed;
  d. accurate and, where necessary, kept up to date;
  e. preserved in a form which permits identification of data subjects for no longer than is necessary for the purposes for which those data are processed.”
  Article 6: Special categories of data
  “1. The processing of:
  …
  – personal data relating to offences, criminal proceedings and convictions, and related security measures;
  …
  shall only be allowed where appropriate safeguards are enshrined in law, complementing those of this Convention.
  2. Such safeguards shall guard against the risks that the processing of sensitive data may present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.”Article 9: Rights of the data subject
  “1. Every individual shall have a right:
  …
  e. to obtain, on request, free of charge and without excessive delay, rectification or erasure, as the case may be, of such data if these are being, or have been, processed contrary to the provisions of this Convention; …”Article 11: Exceptions and restrictions
  “1. No exception to the provisions set out in this Chapter shall be allowed except to the provisions of Article 5 paragraph 4, Article 7 paragraph 2, Article 8 paragraph 1 and Article 9, when such an exception is provided for by law, respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for:
  …
  b. the protection of the data subject or the rights and fundamental freedoms of others, notably freedom of expression.”III. EUROPEAN UNION LAW MATERIALA. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
• 18. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995 L 281, p. 31 (“Directive 95/46/EC”) was designed to protect individuals’ fundamental rights and freedoms (including their right to privacy) in the processing of personal data, while at the same time removing obstacles to the free flow of such data. The relevant Articles read as follows.Article 8: The processing of special categories of data“…
  5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.Member States may provide that data relating to administrative sanctions or judgements in civil cases shall also be processed under the control of official authority.”Article 9: Processing of personal data and freedom of expression“Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.”Article 12: Right of access
  “Member States shall guarantee every data subject the right to obtain from the controller:
  …
  (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
  …”Article 14: The data subject’s right to object
  “Member States shall grant the data subject the right:(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
  …”B. Relevant case-law of the Court of Justice of the European Union relating to Directive 95/46/EC1. Google Spain and Google (Case C-131/12)
• 19. In its Grand Chamber judgment of 13 May 2014 in Google Spain and Google, C-131/12, EU:C:2014:317, the Court of Justice of the European Union (CJEU) was called upon to interpret Directive 95/46/EC. It found that the “activity” of an Internet search engine was to be classified as the “processing of personal data” within the meaning of Directive 95/46/EC, and held that such processing of personal data by the operator of a search engine was liable to affect significantly the fundamental rights to privacy and to the protection of personal data (as guaranteed under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, OJ 2007/C 303/01) when a search by means of that engine was carried out on the basis of an individual’s name, since such processing enabled any Internet user to obtain (through the list of search results thus attained) a structured overview of the information relating to that individual that could be found on the Internet and thereby to establish a more or less detailed profile of him or her.
• 20. Furthermore, the effect of such interference on the rights of a data subject would be heightened on account of the important role played by the Internet and search engines in modern society, which rendered the information contained in such a list of results ubiquitous. In the light of the potential seriousness of that interference, it could not be justified merely by the economic interest of the operator.
• 21. The CJEU held that a fair balance had to be sought between the legitimate interest of Internet users in having access to such information and the data subject’s fundamental rights. It deemed that a data subject’s fundamental rights, as a general rule, overrode the interests of Internet users, but that that balance might, however, depend on (i) the nature of the information in question and its sensitivity as regards the data subject’s private life and (ii) the interest of the public in having that information.
• 22. The CJEU held that in certain cases the operator of a search engine was obliged to remove from the list of results displayed (following a search made on the basis of a person’s name) any and all links to Internet pages published by third parties and containing information relating to that person, even when the publication of that information on the Internet pages in question was in itself lawful. That was so in particular where the data in question appeared to be inadequate, irrelevant or no longer relevant, or excessive, given the purposes for which they had been processed and in the light of the time that had elapsed since the date of the processing in question (see Delfi AS v. Estonia [GC], no. 64569/09, § 56, ECHR 2015).2. GC and Others (De-referencing of sensitive data) (Case C-136/17)
• 23. In a judgment of 24 September 2019 in GC and Others (De- referencing of sensitive data), C-136/17, EU:C:2019:773, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning four decisions delivered by the National Commission on Data Processing and Civil Liberties (Commission nationale de l’informatique et des libertés – CNIL) refusing to serve formal notices on Google requiring it to de-reference various links appearing in the lists of results displayed following searches of their names and leading to Internet pages published by third parties.
• 24. The CJEU decided, inter alia, that information relating to legal proceedings brought against an individual (and information relating to any ensuing conviction) constituted data relating to “offences” and “criminal convictions” within the meaning of Article 8 § 5 of Directive 95/46/EC. The CJEU also ruled that the operator of a search engine was required to accede to a request for de-referencing in respect of links to Internet pages displaying such information, in the event that the information in question (i) related to an earlier stage of the legal proceedings in question and, (ii) having regard to the progress of the proceedings, no longer corresponded to the current situation; however, the search engine operator in question would be required to accede to a request for de-referencing only if – in the course of verifying whether there were reasons of substantial public interest, as listed in Article 8 § 4 of Directive 95/46/EC – it had been established that, in the light of all the circumstances of the case, the data subject’s fundamental rights – as guaranteed in the Charter of Fundamental Rights of the European Union by its Article 7 (“Respect for private and family life”) and Article 8 (“Protection of personal data”) – overrode the rights of potential Internet users who might have an interest that was protected by the Charter’s Article 11 (“Freedom of expression and information”).3. Google (Territorial scope of de-referencing) (Case C-507/17)
• 25. In a judgment of 24 September 2019 in Google (Territorial scope of de-referencing), C-507/17, EU:C:2019:772, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning the imposition by CNIL on Google of a penalty of EUR 100,000 because of that company’s refusal, when granting a de-referencing request, to apply it to all of its search engine’s domain name extensions. The CJEU was then requested to clarify the territorial scope of the requested de- referencing and to determine whether the provisions of Directive 95/46/EC required de-referencing at the national, European or worldwide level.
• 26. The CJEU ruled that in the event that a search engine operator granted a request for de-referencing (pursuant to Article 12(b) and sub- paragraph (a) of the first paragraph of Article 14 of Directive 95/46/EC and of Article 17 § 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council – see paragraph 28 below), that operator would not be required to carry out that de-referencing on all versions of its search engine, but only on the versions of that search engine corresponding to all the European Union States, using, where necessary, measures which, while meeting the legal requirements, effectively prevented (or, at the very least, seriously discouraged) an Internet user from (i) conducting a search from one of the European Union member States on the basis of a data subject’s name, and (ii) gaining access, via the list of results displayed following that search, to the links that were the subject of that request.C.EU national data protection authorities’ guidelines of 26 November 2014
• 27. On 26 November 2014 the domestic data protection authorities of all the European Union member States – meeting within the Article 29 Working Party (an independent European working party dealing with issues relating to the protection of privacy and personal data) – adopted a set of guidelines designed to ensure the harmonised implementation of the CJEU’s judgment of 13 May 2014 (Guidelines on the implementation of the Court of Justice of the European Union judgment on “Google Spain and Inc. v. Agencia Española de protección de datos (AEPD) and Mario Costeja González” C-131/12, adopted on 26 November 2014 by the Article 29 Data Protection Working Party, WP 225). The second part of the guidelines concerns common criteria which the data protection authorities were invited to apply when handling complaints following refusals by search engines to de-list search results. The thirteenth criterion reads as follows:

“Does the data relate to a criminal offence?
EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. DPAs will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the de-listing of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis.”

D. The General Data Protection Regulation

• 28. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation – hereinafter “the GDPR”), OJ 2016 L 119 p. 1, which entered into force on 24 May 2016 and repealed Directive 95/46/EC with effect from 25 May 2018. The relevant provision of the GDPR read as follows:

Article 17 – Right to erasure (“right to be forgotten”)
“1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
…
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
…
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing …”

E. The European Data Protection Board’s Guidelines on the criteria of the Right to be Forgotten in search engines cases under the GDPR

• 29. The Guidelines (5/2019) on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (adopted by the European Data Protection Board on 7 July 2020) read as follows in their relevant parts:

4. … this document aims to interpret the Right to be forgotten in the search engines cases in light of the provisions of Article 17 GDPR (the ‘Right to request de-listing’). Indeed, the Right to be forgotten has been especially enacted under Article 17 GDPR to take into account the Right to request de-listing established in the Costeja judgement [judgment of the CJEU of 13 May 2014 in Google Spain and Google, C-131/12, EU:C:2014:317]. …
18. According to Article 17.1.a GDPR, a data subject may request a search engine provider, following a search carried out as a general rule on the basis of his or her name, to delist content from its search results, where the data subject’s personal data returned in those search results are no longer necessary in relation to the purposes of the processing by the search engine.
19. This provision enables a data subject to request the de-listing of personal information concerning him or her that have been made accessible for longer than it is necessary for the search engine provider’s processing. Yet, this processing is notably carried out for the purposes of making information more easily accessible for internet users. Within the context of the Right to request de-listing, the balance between the protection of privacy and the interests of Internet users in accessing the information must be undertaken. In particular, it must be assessed whether or not, over the course of time, the personal data have become out-of-date or have not been updated. …”

THE LAW

ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION

• 30. Under Article 10 of the Convention, the applicant alleged that the interference in his freedom of expression – namely, his right to inform the public – had been unjustified. He also complained that the penalty imposed on him had been excessive. Article 10 of the Convention reads as follows:

“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. …
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”

A. Admissibility
31. The Court notes that the application is neither manifestly ill-founded nor inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible.

B. Merits
1. The parties’ submissions
(a) The applicant

• 32. The applicant pointed out that the criminal proceedings instituted against V.X. had still been pending at the date on which the Supreme Court’s judgment had been issued in respect of his case. Therefore, it could not be said that the period of time during which the information had remained published was excessive. Thus, V.X.’s “right to be forgotten” had never existed in the first place.
• 33. The applicant submitted that the domestic authorities had not taken into account Article 99 of Legislative Decree no. 196/2003, which provided that the processing of personal data for, inter alia, “historical research purposes” (scopi storici) could be carried out upon the expiry of the period allowed for achieving the different purposes for which the data had originally been collected and processed. He also referred to Articles 136 and 139 of the same decree and to the above-mentioned code of ethics, which contained specific provisions regarding the protection of journalists’ freedom of expression.
• 34. The applicant further submitted that he had been unjustly held liable for not having erased the article in question, since only the search engine provider (that is to say, Google Italy) had been technically capable of de- listing the article in question.
• 35. The applicant also pointed out that, in cases similar to the present one, the balance between the protection of individuals’ reputation under Article 8 and the freedom of expression provided by Article 10 had been easily secured by simply requiring the publications concerned to publish supplementary information or clarifications to the articles in question.
  (b) The Government
• 36. The Government submitted that an adequate balance between the applicant’s freedom of expression and the right of V.X. and his restaurant to respect for his private life (and the reputation of both) had been achieved in the instant case.
• 37. The Government added that the restriction in question had been prescribed by law – namely, Legislative Decree no. 196/2003, which clearly stated that the maintenance of personal data was subject to the continuing existence of the objective that had initially justified their collection and storage. The aim of journalism – namely, to contribute to public debate on matters of social, political and economic interest – should be deemed to be ongoing whenever the knowledge of certain events was still relevant to public discussion. In that regard, the Government submitted that the article had remained on the website of the online newspaper for a substantial period of time. Indeed, no information about the progress of the related criminal proceedings had been provided in the article, which had simply recounted the material events.
• 38. The Government emphasised that the fact that the applicant had been found guilty had been a consequence of the failure to de-index from the Internet search engine the tags to the article published by the applicant (which would have prevented anyone accessing the article by means of simply typing out the name of V.X. or of his restaurant). In other words, the decisions of the Italian courts had stated that the applicant should have de- indexed the article’s content, thereby making it more likely that only people who were genuinely interested in learning the facts of the matter in question would come across the article. However, the applicant had not been obliged actually to remove the article in question from the Internet archives.
• 39. Contrary to what the applicant had stated in his observations, the Government submitted that the obligation to de-index material could be imposed not only on Internet search engine providers, but also on the administrators of newspaper or journalistic archives accessible through the Internet.

(c) Third-party interveners

(i) Reporters Committee for Freedom of the Press

• 40. This intervener reiterated that the “right to be forgotten”, as recognised by the CJEU in Google Spain and Google and as stipulated by the GDPR (see, respectively, paragraphs 19 et seq. and 28 et seq. above) is aimed at providing users with the ability to request that search engines de- list or de-index the results of searches conducted on the basis of a person’s name. Within the Convention system, this right has to be weighed against the right to freedom of expression and the right to publish information – in particular when it would result in the permanent removal of news articles published by the press (see Węgrzynowski and Smolczewski v. Poland, no. 33846/07, 16 July 2013).
• 41. This third-party intervener also pointed out the essential role played by the press in a democratic society, including through media websites and its establishment of digital archives. It also pointed out that the Court had found that the public’s right to be informed outweighed the “right to be forgotten” in the case of two individuals who had sought to have online media reports about their past criminal convictions anonymised (it referred to M.L. and W.W. v. Germany, nos. 60798/10 and 65599/10, 28 June 2018).
  • (ii) UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights
• 42. This third-party intervener argued that there was a significant distinction between de-listing and the outright erasure of content under international standards regarding freedom of expression. The conclusion that the “right to be forgotten” encompassed the right to demand the erasure of certain news content (as opposed to its mere de-listing) would almost certainly lead to censorship worldwide, and the “right to be forgotten” would be inappropriately expanded to the extent of severely jeopardising press freedom.
  • (iii) Media Lawyers Association
• 43. The Media Lawyers Association contended that online media archives played a fundamental role in protecting and developing the rights and values enshrined in Article 10 of the Convention. The erasure of accurate information from the record ran directly contrary to the values protected by Article 10 and amounted to press censorship. Accordingly, any attempt to erase such information had to be genuinely exceptional and only justifiable where strictly necessary.
  • (iv) Media Legal Defence Initiative
• 44. The Media Legal Defence Initiative argued that the scope of the “right to be forgotten” should not include the right to secure the erasure or the anonymisation of newspaper articles containing the personal information of individuals. In the intervener’s view, articles published by individuals or entities engaged in journalistic activities or by governments should not be de-listed.
• 45. This third party also submitted that in the evaluation of the balance between the right to respect for one’s reputation and the right to freedom of expression, other elements came into play, such as whether the complainant had suffered substantial harm, how recent the information in question was and whether it remained of interest to the public. Individuals should not be empowered to restrict access to information concerning themselves and published by third parties, except when such information had an essentially private or defamatory character or when the publication of such information was not justified for other reasons.

2. The Court’s assessment

(a) Preliminary remarks

(i) The scope of the case

• 46. The Court notes at the outset that it has dealt with Article 10 cases concerning Internet publications in which the subject matter was an article or a post with defamatory or offensive content (see Delfi AS v. Estonia [GC], no. 64569/09, §§ 131-39, ECHR 2015; Savva Terentyev v. Russia, no. 10692/09, 28 August 2018; and Kablis v. Russia, nos. 48310/16 and 59663/17, 30 April 2019). Moreover, it has previously examined the requirement to publish – where appropriate – supplementary information or clarifications to an article contained in Internet archives (see Times Newspapers Ltd v. the United Kingdom (nos. 1 and 2), nos. 3002/03 and 23676/03, §§ 40-43, ECHR 2009, which concerned the requirement to append a notice to the articles at stake in that case to the effect that they were subject to libel litigation).
• 47. With regard to Article 8, the Court has already examined cases in which the domestic courts refused to remove personal data from public Internet archives (see Węgrzynowski and Smolczewski, cited above, § 65) or to oblige media to anonymise online archived material concerning a crime (see M.L. and W.W. v. Germany, cited above, § 116).
• 48. The Court observes, however, that the present case diverges from all the Article 10 and 8 cases cited above. Its crux is indeed not related to the content of an Internet publication, nor to the way information is published (as for instance, its anonymisation or classification); rather, it relates to the applicant’s failure to de-index information concerning V.X. and his restaurant and to his decision to keep the article easily accessible, despite the fact that the claimant had asked that the article be removed from the Internet.
• 49. The scope of the case, as defined above, was also emphasised by the Supreme Court, which ruled out the possibility that the unlawfulness of the processing of V.X.’s personal data arose from either (i) the content of the said article, (ii) its online publication and dissemination, or (iii) its conservation and digital archiving (see paragraph 14 above).
• 50. The Court also notes that what is at stake in the present case is the length and ease of access to the data concerned and not their mere retention on the Internet. In this regard, the Court observes that the applicant claimed that he could not be attributed responsibility for de-indexing the article in question, such a possibility being open, in his view, only to the relevant Internet search engine provider. The Court notes, however, that this assertion is contradicted by the fact that the applicant eventually did de- index the impugned article on 23 May 2011 (see paragraph 10 above). Indeed, de-indexing can be carried out by an editor, “noindexing” being a technique used by website owners to tell a search engine provider not to let the content of an article appear in the search engine’s search results².
  (² See “Control what you share with Google”, available at: https://developers.google.com/search/docs/advanced/crawling/control-what-you-share.)
• 51. In this respect, the Court shares the Government’s position that the finding of the applicant’s liability had been a consequence of the failure to de-index from the Internet search engine the tags to the article published by the applicant (which would have prevented anyone accessing it by simply typing out the name of V.X. or of his restaurant), and that the obligation to de-index material could be imposed not only on Internet search engine providers, but also on the administrators of newspaper or journalistic archives accessible through the Internet (see paragraphs 38 and 39 above).
• 52. The Court will therefore keep in mind the scope of the case, as described above, as it now proceeds to examine the applicant’s complaint.
  • (ii) Relevant terminology
• 53. The Court acknowledges that the terms “de-indexing”, “de-listing” and “de-referencing” are often used interchangeably in different sources of EU and international law and that their specific meaning can often only be drawn from the context in which they are used (see paragraph 16 above for Recommendation CM/Rec(2012)3 of the Council of Europe’s Committee of Ministers to member States on the protection of human rights with regard to search engines, in particular its part III entitled “Filtering and de-indexing”, points 13 and 14; the European Data Protection Board’s Guidelines on the criteria of the Right to be Forgotten in search engines cases under the GDPR in paragraph 29 above; and the CJEU’s judgment in GC and Others (De- referencing of sensitive data), in paragraphs 23-24 above).
• 54. Within the above-mentioned sources, the terms “de-indexing”, “de- listing” and “de-referencing” indicate the activity of a search engine consisting of removing, on the initiative of its operators, from the list of results displayed (following a search made on the basis of a person’s name) Internet pages published by third parties that contain information relating to that person (see paragraph 22 above).
• 55. Instead, in the instant case, the subject to whom was addressed the request to limit access to personal data – namely, the applicant – was not a search engine but an editor, journalist and owner of an online newspaper website.
• 56. For the sake of consistency, the Court emphasises that in this judgment it will use the term “de-indexing” to indicate the measure that the applicant was asked to carry out in order to guarantee V.X.’s and W’s right to respect for their reputation.

(b) The Court’s assessment

• 57. The Court notes that it was not in dispute between the parties that the applicant’s freedom of expression, as guaranteed under Article 10 of the Convention, was interfered with by the domestic courts’ decisions of 16 January 2013 and 24 June 2016; neither was it in dispute between the parties that such interference was “prescribed by law” – namely, by Legislative Decree no. 196 of 2003. The Court sees no reason to hold otherwise. Furthermore it is satisfied that the interference in question was intended to protect “the reputation or rights of others” and thus pursued a legitimate aim under Article 10 § 2 of the Convention.
• 58. As to the question whether the said interference was “necessary in a democratic society”, the Court would draw attention at the outset to the specificity and scope of the case at issue (see paragraphs 46 et seq. above): the applicant was held liable not for failing to remove the article, but for failing to de-index it (thus allowing the possibility – for a period whose length has been deemed to be excessive – of typing into the search engine the restaurant’s or V.X.’s names in order to access information relating to the criminal proceedings involving V.X.).
• 59. In this connection, and with reference to the above considerations concerning the scope of the case, the Court endorses the observations of the third-party interveners (see paragraphs 40 et seq. above), which draw a clear distinction between, on the one hand, the requirement to de-list (or “de- index”, as in the present case) and, on the other hand, the permanent removal or erasure of news articles published by the press. In the instant case, the Court acknowledges that the applicant was found to be liable solely on account of the first requirement – that is to say no requirement to permanently remove the article was at issue before the domestic courts. Nor was any intervention regarding the anonymisation of the online article in question at issue in this case.
• 60. In the Court’s view, this is an important starting-point from which to define the interference with the applicant’s freedom of expression and to identify, accordingly, the applicable principles in order to assess the proportionality of that interference.
• 61. As to this last point, the Court has laid down relevant principles to guide its assessment of whether or not an interference in this area is necessary and has identified a number of criteria in the context of balancing freedom of expression against the right to reputation. These criteria are the following: (i) contribution to a debate of general interest; (ii) the extent to which the person concerned is well known and the subject of the report in question; (iii) the prior conduct of the person concerned towards the media; (iv) the method of obtaining the information in question, and its veracity; (v) the content, form and consequences of the publication in question; and (vi) the severity of the sanction imposed on the applicant (see Axel Springer AG v. Germany [GC], no. 39954/08, §§ 89-95, 7 February 2012).
• 62. However, the Court observes that there are factual differences between Axel Springer AG (cited above) and the present case. The former case concerned the publication, by the applicant company, of print articles reporting the arrest and conviction of a well-known television actor whereas, as noted above, the present case deals with the retention online, for a certain period of time, of an Internet article concerning a criminal case against private individuals. There are therefore two main features that characterise the present case: one is the period for which the online article remained on the Internet and the impact thereof on the right of the individual in question to have his reputation respected; the second feature relates to the nature of the data subject in question – that is to say a private individual not acting within a public context as a political or public figure. Indeed, anyone – well known or not – can be the subject of an Internet search, and his or her rights can be impaired by continued Internet access to his or her personal data.
• 63. In the light of the above, the Court acknowledges that the strict application of the criteria set out in Axel Springer AG (cited above) would be inappropriate in the present circumstances. What the Court must examine is whether, in the light of the fundamental principles established in its case- law, the domestic courts’ finding of civil liability on the part of the applicant was based on relevant and sufficient grounds, given the particular circumstances of the case (see, among other authorities, Times Newspapers Ltd, §§ 40-43, and Delfi AS, §§ 131-39, both cited above; see also the more recent case of Big Brother Watch and Others v. the United Kingdom [GC], nos. 58170/13 and 2 others, §§ 442 et seq., 22 May 2021).
• 64. Special attention should be paid in this case to: (i) the length of time for which the article was kept online – particularly in the light of the purposes for which V.X.’s data was originally processed; (ii) the sensitiveness of the data at issue; and (iii) the gravity of the sanction imposed on the applicant.
• 65. Regarding the first point, the Court acknowledges that, as pointed out by the applicant, the criminal proceedings against V.X. and other members of his family were still pending at the time that the Supreme Court adopted its judgment in the applicant’s case. However, it should be noted that the information contained in the article had not been updated since the occurrence of the events in question. Moreover, notwithstanding the formal notice that V.X. sent to the applicant requesting the removal of the article from the Internet, it remained online and was easily accessible for eight months.
• 66. In this connection, the applicable domestic law (see Article 11 of Legislative Decree no. 196/2003), read in the light of the international legal instruments (see Article 5 (e) of the updated Convention ETS no. 108, quoted in paragraph 17 above, and Article 17 § 1 (a) of the GDPR, quoted in paragraph 28 above) supports the idea that the relevance of the applicant’s right to disseminate information decreased over the passage of time, compared to V.X.’s right to respect for his reputation (in this connection, compare and contrast Éditions Plon v. France, no. 58148/00, §§ 53-57, ECHR 2004-IV, where as time elapsed, the public interest in discussing the history of President Mitterrand’s time in office increasingly prevailed over any rights with regard to medical confidentiality; in that case, the Court considered in particular that, in any event, the duty of medical confidentiality had already been breached).
• 67. With regard to the sensitiveness of the data in question in the instant case, the Court is mindful that the subject matter of the article in question related to criminal proceedings instituted against V.X. As can also be seen from several Council of Europe and EU sources (Article 6 of the updated Convention ETS no. 108 – see paragraph 17 above and the judgment of the CJEU in Google Spain and Google – see paragraphs 19-21 above, and in GC and Others (De-referencing of sensitive data) – see paragraphs 23-24 above), the Court is of the belief that the circumstances in which information concerning sensitive data is published constitutes a factor to be taken into account when balancing the right to disseminate information against the right of a data subject to respect for his or her private life.
• 68. Concerning the gravity of the sanction, the Court reiterates that the applicant was held liable under civil and not criminal law (contrast Tuomela and Others v. Finland, no. 25711/04, § 62, 6 April 2010, and Savva Terentyev, cited above, § 83). Although the amount of compensation that the applicant was ordered to pay to the claimants for the breach of their right to have their reputations respected was not negligible, the Court is of the view that the severity of the sentence and the amount of compensation awarded in respect of non-pecuniary damage (EUR 5,000 to each claimant) cannot be regarded as excessive, given the circumstances of this case.
• 69. Where the balancing exercise between, on the one hand, freedom of expression protected by Article 10, and, on the other, the right to respect for one’s private life, as enshrined in Article 8 of the Convention, has been carried out by the national authorities, in conformity with the criteria laid down by the Court’s case-law, the Court would require strong reasons to substitute its view for that of the domestic courts (see, among other authorities, Palomo Sánchez and Others v. Spain [GC], nos. 28955/06 and 3 others, § 57, ECHR 2011, and Delfi AS, cited above, § 139).
• 70. The foregoing considerations are sufficient to enable the Court to conclude that the finding by the domestic courts that the applicant had breached V.X.’s right to respect for his reputation by virtue of the continued presence on the Internet of the impugned article and by his failure to de- index it constituted a justifiable restriction of his freedom of expression (see, mutatis mutandis, Times Newspapers Ltd, cited above, § 47) – all the more so as no requirement was imposed on the applicant to permanently remove the article from the Internet.
• 71. Accordingly, there has been no violation of Article 10 of the Convention.

 

FOR THESE REASONS, THE COURT, UNANIMOUSLY,

1. Declares the application admissible;
2. Finds that there has been no violation of Article 10 of the Convention. Done in English, and notified in writing on 25 November 2021, pursuant
to Rule 77 §§ 2 and 3 of the Rules of Court.
Renata Degener Registrar
Ksenija Turković President