Italy

[IT] The Italian Court of Cassation allows global delisting/removal orders against search engines

IRIS 2023-1:1/17

Ernesto Apa & Eugenio Foco

Portolano Cavallo

On 15 November 2022 through decision no. 34658/2022 (the Decision), the Italian Court of Cassation confirmed the legitimacy of global delisting/removal orders against search engines.

The case originated in 2017 when the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali – Garante) ordered a search engine to delist from its services the URLs that were the object of the proceedings, and also referred to the non-European versions of the same search engine, thereby issuing a de facto global delisting order. The search engine appealed the Garante’s decision before the Court of Milan which, through a decision of 21 September 2020, accepted the search engine’s arguments and stated that Italian law does not allow an extraterritorial and global application of the Italian Data Protection Law (at the time, Legislative Decree No. 196/2003 prior to the amendments introduced in compliance with Regulation EU 2016/679) or of the resolutions adopted by the Garante.

The decision rendered by the Court of Milan was appealed by the Garante before the Court of Cassation. The Court of Cassation is called upon to ensure the correct interpretation and application of Italian law, rather than consider the merits of a case.

In reaching its conclusions, the Court of Cassation analysed, in particular, two judgments rendered by the Court of Justice of the European Union: Case C-507/2017, Google v. CNIL (the CNIL Case) and Case C-18/18, Eva Glawischnig-Piesczek v. Facebook Ireland Limited (the Glawischnig Case).

The Court of Cassation noted that, while in the CNIL Case, the CJEU had held that the data subject could request and obtain delisting from a search engine only in the versions of that search engine available in the territory of the European Union, on the contrary, in the Glawischnig Case, the CJEU had allowed a delisting order with global reach. Of relevance, the Court of Cassation also noted, however, that in the CNIL Case the CJEU had affirmed that while EU law did not require that the delisting granted in that case apply to all versions of the search engine, it also did not prohibit such a practice in general. Accordingly, the CJEU noted that “a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights […] a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine” (paragraph 72).

By analysing the aforementioned judgments, the Court of Cassation affirmed that although EU law does not require member states to ensure that data subjects availing themselves of the right to delisting are granted this on a global scale, it equally does not prohibit member states from affording such level of protection.

In the light of the foregoing, the Italian Court of Cassation set down the following groundbreaking principle: “With reference to the processing of personal data, the protection afforded to the data subject, which is closely related to confidentiality and personal identity and preordained to guarantee the personal dignity of the individual, pursuant to Articles 3(1) and Article 2 of the Italian Constitution, and expressed through the. “right to be forgotten” allows, in compliance with the law of the European Union, Italian authorities, i.e. the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) and judges, to order the operator of a search engine to carry out a delisting on all versions, including non-European versions, of the search engine, subject to balancing the right of the person concerned to the protection of his or her privacy and the protection of his or her personal data and the right to freedom of information, to be operated in accordance with the protection standards of the Italian legal framework” (paragraph 27).