idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
Information and Data Protection Commissioner
CDP/COMP/144/2022
vs
# COMPLAINT
1. On the \(6^{\text{th}}\) May 2022, (the "complainant" or the "data subject"), through his legal counsel, lodged a complaint with the Information and Data Protection Commissioner (the "Commissioner") pursuant to article 77(1) of the General Data Protection Regulation$^{1}$ (the "Regulation"), alleging that (the "controller"), failed to comply with the complainant's request to delist online search results pursuant to article 17 of the Regulation.
2. For the purpose of this complaint, the Commissioner assessed the relevant facts surrounding the complaint:
Summary of Events
a. that the complainant requested the delisting of an article published by the controller$^{2}$, which recounts criminally relevant events that have affected the complainant;
b. that "the event of interest is narrated, [...] in a completely distorted and false way, thus resulting in defamation through dubious, insinuating, allusive, implied, ambiguous and suggestive expressions that, individually or as a whole, both directly and indirectly, give
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Airways House, Second Floor
High Street, Sliema SLM 1549
MALTA.
(+356) 2328 7100
[email protected]
www.idpc.org.mt
Page 1 of 18
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
rise to a plausible belief in the reader on the actual correspondence to the truth of the facts narrated, which means that [the complainant] was involved in the illegal activities of a mafia-type criminal association, such as the 'Ndrangheta';
c. that while it is accurate that in July 2015, he was part of an investigation conducted by the Public Prosecutor's Office of Reggio Calabria against one hundred and fifty (150) individuals and various companies, whereby a number of individuals were charged with mafia association, specifically in connection to various gambling-related crimes, the complainant clarified that he was not charged with mafia-type criminal association. In actuality, the sole charge against him pertained to criminal association, aimed at the commission of crimes related to the illicit management of businesses dedicated to gaming platforms. These operations were purportedly in violation of industry regulations, including taxation and anti-money laundering measures;
d. that the complainant referred to the accusation made against him, and explained that "the terms "mafia" and "ndrangheta" are typical terms of a different offence under Article 416 bis of the Criminal Code";
e. that from July 2015 onwards the complainant "was subjected to pre-trial detention in prison which was later transformed into house arrest and subsequently into a ban on expatriation, the preventative seizure of all his assets and those belonging to his business complex both in Italian and Maltese territory, and the suspension of the remote gaming license granted by the Malta Gaming Authority as well as of the activity by [REDACTED], all of these measures have failed in the course of the legal proceedings, without yet any definitive sentences against our client (the complainant), as evidenced by the judicial records and pending charges certificates";
f. that the lack of commitment to update the update articles in light of evolving facts and news events demonstrates a blatant disregard for legal responsibilities. The complainant argued that integration and updating constitute real duties for those engaged in journalistic activities, as they serve to restore the integrity of the information system by providing accurate, up-to-date reporting. The complainant noted that it's imperative to acknowledge that incomplete and inaccurate news cannot be deemed as true, as it lacks the essential element of objective truth necessary for published information, and this leads to a conclusion regarding the defamatory nature of the overall conduct;
Page 2 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
g. that although it is true that the complainant “has been involved in an investigation, it was - and is even more so today - totally defamatory the profile outlined in the publication, since there hasn’t been yet any conviction by the competent authorities, no accusation for the typical criminally relevant case of association with mafia organizations and, finally, since the news has never been updated”;
h. that “in recent years, with the gradual development of this judicial case, most of the articles and publications on the internet referred to the alleged involvement of [the complainant] in illicit activities or to his alleged links with the criminal association of mafia-type as the ‘Ndrangheta have been deleted or de-indexed by the same editors”;
i. that “[f]ollowing this premise on the truthfulness of the news, it is possible to develop the subsequent considerations on privacy. It is known that the processing of personal data is lawful if intended for specific purposes and the data are accurate, updated, relevant, and not excessive in relation to the purposes. So, it is clear the illegitimate treatment carried out by the [the controller] which, in the absence of these requirements, cannot invoke a right to information that has been indeed wrongly exercised. In any case, even if we admit the existence of a properly exercised right to report the news, the right to be forgotten, which our client, through us, hereby intends to assert, undoubtedly prevails”;
j. that to conclude his points of argumentation, the complainant stated that given “the lack of notoriety or public relevance of the figure of [the complainant], the fact that in the present [the complainant] does not maintain any relationship with the company [REDACTED] nor carries out his professional activity in the same field of activity (gambling), the strong spreading component of the web and the indexing of news on google associating, in the action of the search, the name of [the complainant] to words such as “gambling”, “mafia”, or “mob” and “Ndrangheta”, and the lack of peculiar profiles otherwise able to denote the permanent interest of the community, the need for information or news must be considered, we repeat, unequivocally recessive with respect to the fundamental rights to be forgotten and confidentiality” [emphasis has been added by the complainant];
k. that “the EU Regulation no. 679/16 establishes that the provisions on the processing of personal data, including confidentiality, also apply to the processing for journalistic purposes. The recital no. 66 of Reg. (EU) 2016/679 provides an interpretative address
Page 3 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
of the rule in art. 17, stating that the right to erasure should be “(...) extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data.(...)”;
l. that “in this case, the requirements are fulfilled for the application of the right to cancellation, transformation into anonymous form, or blocking of data processed in violation of the law (including those in which it is not necessary to preserve in relation to the purposes for which the data were collected or subsequently processed). Besides this, any reference to legal provisions concerning the lawful processing of data for historical purposes is invalid, due to the persistence of public interest in the news and journalistic purposes. In conclusion, since there is no prevailing legitimate interest in this case, the right to be forgotten must be recognized to [the complainant]” [emphasis has been added by the complainant]; and
m. that in terms of article 17 of the Regulation, the complainant has the right to request the erasure of personal data pertaining to him. The complainant noted that this right arises when the data processing is no longer deemed necessary for its intended purposes, when there is no overriding legitimate reason to proceed with the processing, and when the data has been handled unlawfully, potentially leading to conceivable criminal and administrative sanctions.
3. Together with the complaint, the complainant submitted documentation, including a list of websites links for which the complainant requested delisting of, preliminary rulings issued by the tribunal of Calabria, notices, court orders and judgements issued by the Maltese Courts regarding the seizure of assets, a copy of an article issued by the Malta Gaming Authority titled ‘Licence Suspended for [REDACTED] the complainant’s criminal record certificate, certificate of pending charges, and the correspondence with Google regarding the delisting of various links.
### INVESTIGATION
4. Pursuant to article 58(1)(a) of the Regulation, the Commissioner provided the controller with a copy of the complaint, and requested the controller to put forward its submissions in order to defend itself against the allegations raised by the complainant.
Page 4 of 18
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
5. By means of an email dated the 26th August 2022, the controller submitted the following principal arguments for the Commissioner to consider in the legal analysis of the case:
i. that “this information is a news story that is supplied to the general public with the implied right of freedom of expression and information that is necessary in a democratic society, published a notice issued by a government authority, the Malta Gaming Authority – please see notice here, https://www.mga.org.mt/licence-suspended-for
ii. that “at the time of suspension, [the complainant] was listed as a executive, as is clearly visible in his LinkedIn profile bearing both his name and a associated company.
iii. that “[t]he suspension of these betting licences were the subject of Maltese court cases, the reporting of which enjoys journalistic privilege as per the Laws of Malta. By September 2015, the MGA suspended six gaming licences over suspected links to Italian organised crime – three companies were challenging the decision and holding the MGA liable for damages”;
iv. that the controller submitted “that erasure of this information, a regulatory event, would be incompatible with the purpose of exercising the right of expression and information, more especially processing for journalistic purposes”; and
v. that “[i]n line with the right for freedom of expression, the imparting of publicly-available information from government authorities and regulators, this kind of journalist processing is proportionate necessary and justified for reasons of substantial public interest”.
6. On the 29th August 2022, the Commissioner provided the complainant with the opportunity to rebut the arguments submitted by the controller. Accordingly, on the 31st August 2022, the complainant submitted:
Page 5 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
i. that any reference made to the Malta Gaming Authority communication published on https://www.mga.org.mt/³ is manifestly irrelevant. The Malta Gaming Authority's communication does not mention any connection between the complainant or [REDACTED] and mafia-type criminal organisations, such as the 'Ndrangheta. In fact, no accusation has been made against the complainant by the competent Italian or Maltese authorities;
ii. that the article published by the controller misleads the reader, explicitly and without foundation, into believing that the complainant is associated with or belongs to a mafia-type organisation. Therefore, the content of the article is manifestly defamatory;
iii. that since the content is defamatory in nature, the controller has failed in its journalistic duty to report the objective truth of the facts, without it being appropriate in this case to invoke the freedom of the press and freedom of speech;
iv. that the invocation of the freedom of the press and freedom of speech is only relevant at the time of publishing, and not applicable after a period of seven (7) years has elapsed from the initial publication; and
v. that given the current lack of public interest in the news report, particularly in view of the fact that the complainant is no longer a member of [REDACTED] and has never been accused of being part of or linked to any mafia-type criminal organisation, his right to be forgotten should prevail.
7. In line with the Office's complaint-handling procedure, the Commissioner provided the controller with the final opportunity to rebut the arguments made by the complainant. On the 28th September 2022, the Commissioner informed the controller via email, that this Office has not received a reply from it within the stipulated deadline, and shall thus proceed with the information it has in its possession.
8. The Commissioner attempted to reach an amicable settlement, however this step did not prove to be successful.
³ Malta Gaming Authority's website: https://www.mga.org.mt/
Page 6 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# LEGAL ANALYSIS AND DECISION
# General Considerations
9. As a preliminary point, the Commissioner establishes that the publication of the article on the controller's news portal contains 'personal data' within the meaning of article 4(1) of the Regulation as the information relates directly to the complainant. The Commissioner notes that the information is made available to indefinite number of people, and thus, this amounts to a processing activity in terms of article 4(2) of the Regulation.
10. The Commissioner refers to the complaint dated \(6^{\text{th}}\) May 2022, in which the complainant held that "the event of interest is narrated, for the reasons indicated below, in a completely distorted and false way, thus resulting in defamation through dubious, insinuating, allusive, implied, ambiguous and suggestive expressions" [emphasis has been added by the complainant]. In this regard, the Commissioner analysed the contents of the article subject to the complaint and established that the controller published the news article in the exercise of his fundamental right to freedom of expression, and solely intended to impart information considered to be in the public interest.
11. In the own words of the complainant, if this information resulted to be of a defamatory nature, the complaint should have resorted to the legal remedy provided under article 15(1) of Media and Defamation Act (Chapter 579 of the Laws of Malta), which sets out that "any person whose actions or intentions have been misrepresented or who has been the victim of defamation or who has had his private life intruded into through a publication is entitled to demand to have published forthwith, free of charge, in the same medium, a statement by way of contradiction or explanation" [emphasis has been added]. Therefore, the Commissioner does not consider the journalistic report in this case as effectively tantamount to inaccurate personal data.
12. For the purpose of this legal analysis, the Commissioner sought to establish whether the processing by the controller of an online article consisting of the publication of information relating to the complainant, is exercising the right to freedom of expression and information and therefore the processing activity falls within the derogations contemplated under article 9 of the Data Protection Act (Chapter 586 of the Laws of Malta).
Page 7 of 18
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
13. Whereas a search on the website of the controller⁴ using the name and surname of the complainant as key words, displays the personal data of the complainant, it is however the inclusion in the list of results generated by the search engines when a user conducts a search using the same key words, which undoubtedly exposes the personal data of the complainant to individuals on the world wide web and thus creates an intrusion in the rights and freedoms of the data subject.
14. Consequently, the Commissioner considers that it is indeed important to make a clear distinction between the primary publisher of the information, namely the controller, and the search engines, namely Bing and Yahoo, where the pivotal difference is that the former is a media house whose function in a democratic society is to impart information in the public interest in pursuit of exercising its fundamental right pursuant to article 11 of the Charter of Fundamental Rights of the European Union⁵, while the latter is an online search engine which makes use of web crawlers to conduct searches on websites available on the world wide web to look up the key words selected by the user and generates results in the form of a list. The Court of Justice of the European Union (the “CJEU”) in the judgment Google Spain explained in detail the difference in treatment between the operator of a search engine and the publisher of a web page, as follows:
“Indeed, since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page”⁶.
15. The Commissioner emphasises that the complaint was lodged against the media house, which is the original publisher of the information, and therefore, the investigation of the complaint is strictly limited to determine whether the processing carried out by controller is proportionate,
⁵ Official Journal of the European Communities, Charter of Fundamental Rights of the European Union (2000/C 364/01), available at: https://www.europarl.europa.eu/charter/pdf/text_en.pdf
⁶ Case C-131/12, ‘Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González’, decided on the 13th May 2014.
Page 8 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
necessary and justified for reasons of substantial public interest after reconciling the right to freedom of expression and information with the right to the protection of personal data.
# Article 17 of the Regulation
16. Article 17(1) of the Regulation provides that the “data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ...”. In this regard, the data subject has the right to demand from the controller the erasure of personal data and in certain instances, the controller has the obligation to erase personal data. The relationship of the corresponding right and obligation becomes relevant when determining the burden of proof for the existence of the right to erasure.
17. Article 17 of the Regulation provides for six (6) grounds which the data subject may invoke to request the controller to erase his personal data. However, the same legal provision sets out the situations, or more specifically the exemptions, where the right to erasure does not apply.
18. The judgment ‘GC and Others v Commission nationale de l’informatique et des libertés’7 delivered by the CJEU examined the grounds listed in article 17(1) of the Regulation. In this regard, the Court explained that “[i]n accordance with Article 17(1) of the regulation, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those data without undue delay where one of the grounds set out in that provision applies. As grounds, the provision mentions the cases in which the personal data are no longer necessary in relation to the purposes for which they were processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing pursuant to Article 21(1) or (2) of the regulation, which replaces Article 14 of Directive 95/46; the data have been unlawfully processed; the data have to be erased for compliance with a legal obligation; or the data have been collected in relation to the offer of information society services to children.”.
19. However, article 17(3) of the Regulation lists down those instances where the right to erasure does not apply. The instances mentioned in article 17(3) of the Regulation apply regardless of the ground invoked by the data subject in terms of article 17(1) of the Regulation. In particular,
7 Case C-136/17, ‘GC and Others v Commission nationale de l’informatique et des libertés (CNIL)’, decided on the 24th September 2019.
Page 9 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
article 17(3)(a) of the Regulation provides that the right to erasure does not apply to the extent that the processing is necessary for exercising the right of freedom of expression and information [emphasis has been added]. Article 17(3)(a) and article 85 of the Regulation enable Member States to reconcile the right to protection of personal data with the right to freedom of expression and information.
# The Reconciliation of the Right to Protection of Personal Data with the Right to Freedom of Expression and Information
20. The Commissioner recognises that the right to data protection and the right to freedom of expression are both fundamental rights⁸, and further acknowledges that the rules governing the right to the protection of personal data should be reconciled with the freedom of expression and information. Notwithstanding this, these two rights are not absolute, and do not prevail over one another, as they are of equal importance.
21. Privacy and freedom of expression have equal weight in the case law of the ECHR, and hence, “[i]n cases which require the right to respect for private life to be balanced against the right to freedom of expression, […] these rights deserve equal respect”⁹. Therefore, a fair balance needs to be found between the two rights, which has also been recognised by the European legislator. Indeed article 85¹⁰ of the Regulation contemplates for exemptions or derogations when personal data are processed in the context of the right to the freedom of expression. The reconciliation of the right to freedom of expression with the right to the protection of personal data is a matter which has been left to be regulated by the respective Member State.
22. In this context, article 9 of the Data Protection Act (Cap. 586 of the Laws of Malta) lays down an exhaustive list of exemptions or derogations, which enable processing of personal data for the purpose of exercising the right to freedom of expression and information, specifically where such processing is proportionate, necessary and justified for reasons of substantial public interest. This provision does not give an automatic blanket exemption in every case and is
⁸ Article 8(1) of the Charter of Fundamental Rights of the European Union states that “Everyone has the right to the protection of personal data concerning him or her.”, and Article 11 of the Charter provides that “Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.”
⁹ Application no. 40454/07, ‘Couderc and Hachette Filipacchi Associés vs France’, decided on the 10th November 2015.
¹⁰ Article 85(1) of the Regulation reads as follow: “Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purpose of academic, artistic or literary expression.”.
Page 10 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
only intended to apply where necessary to strike a fair balance between the right to the protection of personal data and the freedom of expression [emphasis has been added].
23. For the purposes of this legal analysis, the Commissioner established that the placing of material on the internet could easily be considered to have the objective of disclosing information, opinions or ideas to the public¹¹, particularly in light of the fact that the right to freedom of expression is important and even considered to be the fourth pillar of a democratic society.
24. The Commissioner recognises that the public has a right to be informed about matters which are capable of contributing to a public debate. The decisive factor in balancing the right to the protection of personal data against the freedom of expression should lie in the contribution that the published information could make to a debate of “substantial public interest”. In fact, the wording used by the legislator, particularly the word ‘substantial’ is indicative that the public interest should be real and of substance. The ECHR in the judgment ‘Mosley vs the United Kingdom’¹² sheds further light on what is considered to be a matter of public interest, by stating that the “focus must be on whether the publication is in the interest of the public and not whether the public might be interested in reading it”.
25. In the Satamedia¹³ ruling, the CJEU had the occasion to clarify on the notions relating to the balancing exercise in relation to journalistic freedoms and the right to the protection of personal data. In this regard, the CJEU stated that “[i]n order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary, first, to interpret notions relating to that freedom, such as journalism, broadly. Secondly, and in order to achieve a balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so far as is strictly necessary.” [emphasis has been added].
26. After assessing the case-law of the CJEU, particularly the judgments Lindqvist¹⁴, Satamedia¹⁵ and Buivids¹⁶, it appears that the CJEU does not take a firm position on how to reconcile the right to data protection with the right to freedom of expression. In the absence of this, the
¹¹ Case C-345/17, ‘Sergejs Buivids vs Datu valsts inspekcija’, decided on the 14th February 2019.
¹² Application no. 48009/08, ‘Mosley vs the United Kingdom’, dated the 10th May 2011.
¹³ Case C-73/07, ‘Tietosuojavaltuatettu v Satakunnan Markkinapörssi Oy and Satamedia Oy’, decided on the 16th December 2008.
¹⁴ Case C-101/01, ‘Bodil Lindqvist vs Äklagarkammaren i Jönköping’ decided on the 6th November 2003.
¹⁵ Ibid No. 13
¹⁶ Ibid No. 11
Page 11 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
Commissioner examined the case law of the ECHR which, throughout the years, developed a standard set of criteria, which includes the following:
"contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, form and consequences of the publication, and, where appropriate, the circumstances in which the photographs were taken. Where it examines an application lodged under Article 10, the Court will also examine the way in which the information was obtained and its veracity, and the gravity of the penalty imposed on the journalists or publishers"¹⁷.
27. In conclusion, the Commissioner analysed the judgement of 'Axel Springer AG vs Germany', wherein the ECHR held that "the Court must take account of a particularly important factor: the essential function the press fulfils in a democratic society. Although the press must not overstep certain bounds, regarding in particular protection of the reputation and rights of others, its duty is nevertheless to impart – in a manner consistent with its obligations and responsibilities – information and ideas on all matters of public interest. Not only does the press have the task of imparting such information and ideas; the public also has a right to receive them. Were it otherwise, the press would be unable to play its vital role of 'public watchdog'"¹⁸.
28. The Commissioner notes that this complaint calls for an examination of the fair balance to be struck, between, on the one hand, the applicant's right to the protection of his personal data and, on the other hand, the controller's right to freedom of expression and the readers' right and expectation to receive information in the public interest. As a decisive element, the Commissioner highlights the essential role played by journalists in a democratic society, which includes commenting on open court proceedings and reporting on judgments delivered by the judiciary. In the case of 'M.L. and W.W v. Germany'¹⁹, the ECHR held that:
"It is inconceivable that there can be no prior or contemporaneous discussion of the subject matter of trials, be it in specialised journals, in the general press or amongst the public at large. Not only do the media have the task of imparting such information and ideas; the public also has a right to receive them. Were it otherwise, the press would be unable to play its vital role of "public watchdog".
¹⁷ Application no. 40454/07, 'Couderc and Hachette Filipacchi Associés vs France', decided on the 10th November 2015.
¹⁸ Application no. 48311/10, 'Axel Springer AG v. Germany', decided on the 10th July 2014.
¹⁹ Applications nos. 60798/10 and 65599/10, 'M.L. and W.W v. Germany', decided on the 28th September 2018.
Page 12 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# Recent Rulings of the ECHR
29. In response to the emerging challenges imposed by the rapid advancements in technology, the ECHR has undertaken innovative approaches such as the implementation of de-indexing and de-listing procedures, to strike a delicate balance between the data protection rights of individuals and other existing fundamental rights. Until now, the concept of the 'right to be forgotten' primarily entailed the de-indexing (or delisting or de-referencing) an individual's name from search engine results, effectively concealing contested articles. In 'Biancardi vs Italy'²⁰ and 'Hurbain vs Belgium'²¹, the ECHR abandoned this pragmatic approach and established that it is legitimate to demand a news portal, as opposed to a search engine, to de-index the individual's personal data, so long as the information remains accessible in their internal paper and digital archives, and the public has the means to directly access it for the complete information. Therefore, recent rulings have expanded the scope, allowing complainants to approach the primary publisher directly, not the search engine. In this regard, the Commissioner analysed the case of 'Biancardi vs Italy'²² which is the first case in which the ECHR has considered the question of de-indexing of online newspaper archives. In this judgement, the First Section of the ECHR held that an order finding that the editor of an online newspaper liable for failing to de-index an article concerning criminal proceedings did not breach article 10 of the European Convention on Human Rights²³. In fact, the 'right to reputation' of a person accused of a criminal offence outweighed the right of the newspaper to continue to make available a story about the incident which had led to the arrests and charge.
30. The Commissioner carefully weighed the Court's considerations, particularly emphasising the "clear distinction between, on the one hand, the requirement to de-list (or "de-index", as in the present case) and, on the other hand, the permanent removal or erasure of news articles published by the press". It was strongly emphasised that there was "no requirement to permanently remove the article was at issue before the domestic courts. Nor was any
²⁰ Application no. 77419/16, 'Biancardi vs Italy', decided on the 25th February 2022.
²¹ Application no. 57292/16, 'Hurbain vs Belgium', decided on the 4th July 2023.
²² Ibid No. 20
²³ Article 10 of the European Convention on Human Rights: "(1) Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. (2) The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary".
Page 13 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
intervention regarding the anonymisation of the online article in question at issue in this case”²⁴.
31. In the judgement, the ECHR makes reference to the ‘Axel Springer AG vs Germany’²⁵ ruling, which sets out the relevant criteria for the balancing exercise between the right to freedom of expression against the right to respect for private life. However, the Court observed that there are factual differences between the case of ‘Axel Springer AG vs Germany’²⁶ and ‘Biancardi vs Italy’²⁷. The former case concerned the publication, by the applicant company, of print articles reporting the arrest and conviction of a well-known television actor whereas, as noted above, the present case deals with the retention online, for a certain period of time, of an Internet article concerning a criminal case against private individuals. There were two main features that characterised the present case “one is the period for which the online article remained on the Internet and the impact thereof on the right of the individual in question to have his reputation respected; the second feature relates to the nature of the data subject in question – that is to say a private individual not acting within a public context as a political or public figure”²⁸. Therefore, the Court acknowledged that the strict application of the criteria set out in ‘Axel Springer AG vs Germany’²⁹ would be inappropriate in the present circumstances, and thus, special attention was given to: (i) the length of time for which the article was kept online – particularly in the light of the purposes for which V.X.’s data was originally processed; (ii) the sensitiveness of the data at issue; and (iii) the gravity of the sanction imposed on the applicant.
32. The Commissioner noted that, after taking into account a number of factors, mainly that the information in the article had not been updated since the occurrence of the events in question, the relevance of the applicant’s right to disseminate information decreased over the passage of time compared to the individual’s right to respect for his reputation and the information published concerned sensitive data, as it related to criminal proceedings, the Court concluded that “the finding by the domestic courts that the applicant had breached V.X.’s right to respect for his reputation by virtue of the continued presence on the Internet of the impugned article and by his failure to de-index it constituted a justifiable restriction of his freedom of expression (see, mutatis mutandis, Times Newspapers Ltd, cited above, § 47) – all the more so as no
²⁴ Ibid No. 20
²⁵ Ibid No. 18
²⁶ Ibid No. 18
²⁷ Ibid No. 20
²⁸ Ibid No. 20
²⁹ Ibid No. 18
Page 14 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
requirement was imposed on the applicant to permanently remove the article from the Internet”³⁰.
33. On the same grounds, the Commissioner carefully considered the recent case of ‘Hurbain vs Belgium’³¹, handed down by the Grand Chamber of the ECHR on the 4th of July 2023. This case revolved around the pivotal question of whether the Belgian court’s decision, which mandated the applicant to anonymise an online article on a news website, on the grounds of upholding the ‘right to be forgotten’, amounted to a violation of freedom of expression under article 10 of the European Convention on Human Rights. It was not disputed that the anonymisation order constituted an interference with article 10 of the European Convention on Human Rights, as the Grand Chamber agreed with the Chamber that “[t]he interference in question had been prescribed by law and had pursued the legitimate aim of protecting the reputation or rights of others, in this case [the individual’s] right to respect for his private life”³².
34. The Commissioner noted that in terms of terminology, the Court used the phrase ‘delisting’ to refer to measures taken by search engine operators, while ‘de-indexing’ was used to describe measures implemented by the news publisher responsible for the website hosting the aforementioned article.
35. The ECHR emphasised the importance of freedom of expression recognising that in today’s digital age, the scope of press freedom encompasses more than traditional print and broadcast media, in fact the Court noted that “[n]owadays, the content of freedom of the press must be assessed in the light of developments in information technology, as journalistic information no longer consists solely of news coverage in the printed press and broadcasting media. The Court has repeatedly held that, in addition to its primary function as a “public watchdog”, the press has a secondary but nonetheless valuable role in maintaining archives containing news which has previously been reported and making them available to the public. In that connection the Court has held that Internet archives make a substantial contribution to preserving and making available news and information. Digital archives constitute an important source for education and historical research, particularly as they are readily accessible to the public and are generally free (see Times Newspapers Ltd, cited above, §§ 27 and 45; Węgrzynowski and Smolczewski, cited above, § 59; and M.L. and W.W. v. Germany, cited above, § 90), although the Court observes that press archives tend increasingly to be behind a paywall. This function
³⁰ Ibid No. 20
³¹ Ibid No. 21
³² Ibid No. 21
Page 15 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
of the press, like the corresponding legitimate interest of the public in accessing the archives, is undoubtedly protected by Article 10 of the Convention (see M.L. and W.W. v. Germany, cited above, § 102)³³.
36. The ECHR elaborated on the multifaceted nature of the concept of the 'right to forgotten'. Initially, it arose in the context of press republication of previously disclosed judicial information, however, as news articles became digitised and widely accessible through search engines, a new dimension of this right emerged. In fact, the ECHR highlighted that "a new aspect of this "right to be forgotten" emerged in national judicial practice in the context of the digitisation of news articles, resulting in their widespread dissemination on the websites of the newspapers concerned. The effect of this dissemination was simultaneously magnified by the listing of websites by search engines. In judicial practice this aspect, known as the "right to be forgotten online", has concerned requests for the removal or alteration of data available on the Internet or for limitations on access to those data, directed against news publishers or search engine operators. In such cases, the issue is not the resurfacing of the information but rather its continued availability online"³⁴. It was further noted that "from the standpoint of the Convention, the "right to be forgotten online" has been linked to Article 8, and more specifically to the right to respect for one's reputation, irrespective of what measures are sought for that purpose (the removal or alteration of a newspaper article in the online archives or the limitation of access to the article through de-indexing by a news outlet). In the Court's view, a claim of entitlement to be forgotten does not amount to a self-standing right protected by the Convention and, to the extent that it is covered by Article 8, can concern only certain situations and items of information. In any event, the Court has not hitherto upheld any measure removing or altering information published lawfully for journalistic purposes and archived on the website of a news outlet"³⁵.
37. The Grand Chamber underlined that when considering the request to alter archived journalistic content online, it is crucial to carefully balance these rights of equal importance, whilst taking into account the following criteria: (i) the nature of the archived information; (ii) the time that has elapsed since the events and since the initial and online publication; (iii) the contemporary interest of the information; (iv) whether the person claiming entitlement to be forgotten is well known and his or her conduct since the events; (v) the negative repercussions of the continued availability of the information online; (vi) the degree of accessibility of the information in the
³³ Ibid No. 21
³⁴ Ibid No. 21
³⁵ Ibid No. 21
Page 16 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
digital archives; and (vii) the impact of the measure on freedom of expression and more specifically on freedom of the press.
On the basis of the foregoing considerations, and in the light of the recent jurisprudence of the European courts, whereas the Commissioner fully subscribes to the fact that media houses and journalists have a right to retain in their digital archives, or in any other form of archives, articles published in the public interest, on the other hand, the Commissioner equally understands that data subjects enjoy other fundamental rights and freedoms which are designed to protect their private life and reputation.
Consequently, the Commissioner sought to put in the balance these two rights and, after taking into account the criteria which has been developed over the years by the European courts, concludes that, for the purpose of ensuring that the complainant's fundamental rights are respected while at the same time entirely preserving the controller's journalistic freedoms by leaving untouched the contents of the article as originally published, in terms of article 58(2) of the Regulation, the Commissioner is hereby ordering the controller to introduce a 'no-index' metatag to the content head HTML of the online page subject to this decision³⁶, in a manner to block search engines from indexing such page and make it appear in search results.
The controller is requested to comply with this order within twenty (20) days from receipt of this legally-binding decision and inform the Commissioner of the action taken immediately thereafter. Failure to comply with the Commissioner's order shall make the controller liable to the appropriate enforcement action, which may include an administrative fine.
Today, the 11th day of October 2023
³⁶ Ibid No. 2
Page 17 of 18
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
## Right of Appeal
In terms of article 26(1) of the Data Protection Act (Chapter 586 of the Laws of Malta), “any person to whom a legally binding decision of the Commissioner is addressed, shall have the right to appeal in writing to the Tribunal within twenty days from the service of the said decision as provided in article 23”.
An appeal to the Information and Data Protection Appeals Tribunal shall be made in writing and addressed to:
The Secretary
158,
Merchant’s Street
Valletta.
Page 18 of 18