The Google Case C 507/17: Right to be forgotten is Limited to Eu

Lawyer Vincenzo Colarocco

By decision of 21 May 2015, the President of the French Commission nationale de l’informatique et des libertés (CNIL’) served formal notice on Google that, when acceding to a request from a natural person for the removal of links to web pages from the list of results displayed following a search performed on the basis of that person’s name, it must apply that removal to all of its search engine’s domain name extensions. By adjudication of 10 March 2016, the CNIL, after finding that Google had failed to comply with that formal notice by the prescribed time limit, imposed on it a penalty, which was publicised, of €100 000. By an application lodged before the Conseil d’État (Council of State, France), Google seeks to have that adjudication annulled. The Conseil d’État decided to refer several questions to the Court of Justice for a preliminary ruling. Advocate General Maciej Szpunar, in his Opinion, stating that the Community provisions on the subject do not expressly regulate the question of the territoriality of deindexing and that a differentiation is necessary according to the place from which the research is carried out, proposes that the Court should declare that the “search engine operator is not required, when acceding to a request for de-referencing, to carry out that de-referencing on all the domain names of its search engine in such a way that the links in question no longer appear, irrespective of the location from which the search on the basis of the requesting party’s name is performed”. However, the Advocate General underlines that “once a right to de-referencing within the EU has been established, the search engine operator must take every measure available to it to ensure full and effective de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an IP address deemed to be located in one of the Member States, irrespective of the domain name used by the internet user who performs the search.” In conclusion, dealing with the specific case Advocate General Szpunar had the opportunity to point out that the fundamental right to be forgotten must be balanced against other fundamental rights, such as the right to data protection and the right to privacy, as well as the legitimate public interest in accessing the information sought, stating that, if worldwide de-referencing were permitted, the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and to privacy.

Ruling of the Italian Supreme Court in the Mediaset vs Yahoo! Case

Lawyers Alessandro La Rosa

Mediaset has sued Yahoo Inc. and Yahoo! Italy for the illegal broadcasting of more than 200 videos extracted from television programs broadcast by its television networks. The Civil Court of Milan, at first instance, had recognized the liability of Yahoo! Italy as operator of the Yahoo! Video service, for not having prevented the publication of the videos of Mediaset despite having been warned not to do so with an injunction containing the titles of the television programs in question and some URLs by way of example. For the first time in Italy, the Civil Court of Milan had taken on board the lessons of the EU Court of Justice on the concept of “active role” providers. At a later time, the Milan Court of Appeal overturned the decision of the first judge, denying the same configurability as the figure of the hosting provider “with an active role” and excluded the liability of Yahoo! Italy. With its decision of March 19, 2019, the Court of Cassation accepted the motivational approach of the Civil Court of Milan and asked the Court of Appeal of Milan to modify its decision on the basis of the following principles.

With ruling n. 7708 of March 19, 2019 the Italian Supreme Court upheld the action filed by RTI (Mediaset Group) and intentionally clarified the responsibility of the hosting providers (i.e. the service provider which memorises the information provided by the users, as provided by art. 14 Directive 2000/31/CE) towards the affected rightholders.

The Court has provided fundamental guidance that will have to be followed by national jurisprudence. The principles established by the Court can be summarized as follows:

a) the hosting provider must be defined “active” when his conduct has the effect to complete and enrich the consumption of illegal online advertising content by third parties. In this case there is a direct support (notably, active) to the illegal act carried out by these third parties with full civil responsibility towards the rightholders and the inapplicability of the Legislative Decree 70/2003 (the Italian legislative transposition of Directive 2000/31/CE) as the general rules are to be followed: the ruling identifies thoroughly also a number of useful indexes for which the hosting provider must be considered active, such as the activity of filtering, indexing, organizing and so on; or the adoption of a behavioral evaluation technique of the users to increase their loyalty to the service.

b) when such an active conduct is not recognized, the service provider must be qualified as “passive” and Article 16 of the Legislative Decree 70/2003 applies. This however doesn’t mean that such entity is entitled of an absolute liability exemption: In fact, according to these rules the provider is still liable towards the rightholders of content illegally published online by third parties when, he is aware of the illegal nature of the content (illegality that arises when, as in this case, rights of others related to copyright are violated) and nevertheless doesn’t remove it nor blocks access to it.

c) Especially in the actions for damages, responsibility arises when there is manifest illegality of this same content and, although the hosting provider is aware of it, he doesn’t impede its availability, omitting to remove or to disable access to such content. The knowledge arises not only when the rightholder informs about the illicit act and related damage, which can also be done in oral form (without the need of a written warning), but also when the provider has acquired such information by other means or became aware of it after its own verification. In fact, the ruling specifies that, when the communication is done by the affected rightholder, it does not necessarily have to be in written form (writing is advisable for practical need of evidence, but is not required by legislation). Practically speaking, the communication only has to allow hosting providers to understand and identify the illegal content (the Court of Cassation adds that, when videos extracted from TV programmes are concerned, it is to be assessed on a case by case basis if, for this purpose, only the title of the programme is needed or if other descriptive elements or other elements are necessary, with the possibility for the judge to require a technical advice).

d) Although the passive hosting provider is not required to carry out a general, anticipated and constant monitoring and therefore is not responsible for cases where he omitted to monitor in a preventive and continuous manner the content uploaded by the users of the service, it is likewise true that he is responsible for the damages when he acquires knowledge of the content and didn’t act for its immediate removal. There is no obligation to carry out an active search of the illegal material uploaded and distributed online, this obligation arises subsequently to the above knowledge, as legislation hasn’t completely annulled, but only limited, the control over the uploaded content which could be included in an illicit telematic act.

e) upon receiving communication of the illegal act from the rightholder, the hosting service provider can’t, in any case, stay inactive. On the contrary, he is required to evaluate, in accordance with common experience criteria and professional diligence, the notice received (and, if made by the damaged party, the reasonable grounds of the communication) and in case this evaluation is positive, to act expeditiously to remove the identified content. The Court of Cassation adds that, in cases of actions for damages, the illegal act must result “evident” to the operator, meaning it should be identifiable with no major difficulties as experience, knowledge and professional diligence allows. In such cases the hosting provider is liable for cases of intent or serious negligence (without prejudice to the fact that, also in cases of non-manifest illegal acts the provider can’t be inactive, as he should at least inform the competent authorities).

f) the passive hosting provider, when aware of the manifest illegal content uploaded, becomes liable when he doesn’t act. This arises unless he proves, once his knowledge of the illegal act is ascertained and after the elements that make the illegality evident have been included in the actions for damages, that he has never had the chance to effectively take action (but this possibility always arises when the hosting providers has the technical and legal instruments to impede the violations, as the Court of Cassation explains in the ruling).

g) ultimately, pursuant art. 16 of the Legislative Decree 70/2003 (corresponding to art. 14 Directive 2000/31/CE), even when the hosting provider is “passive” and not “active” he is liable for the damages against the affected rightholders when he doesn’t provide for the immediate removal of the illegal content or continues to upload it, if the following three conditions occur: i) the hosting provider becomes legally aware of the illegal act carried out by the user of the service, having known this from the affected rightholder or by other means; ii) the unlawfulness of the conduct of others is reasonably evident and therefore, the operator is in serious negligence for not noticing it, as such diligence is to be reasonably expected from a professional online operator in a given moment in history; iii) the hosting service provider has the possibility to usefully take action as he was made aware, in a sufficiently specific manner, of the illegal content to be removed.

h) in any case, apart from the claims for damages for the established violations, once the passive hosting provider becomes aware of illegal content of the same type, the reasons that exclude an obligation of constant and preventive monitoring no longer apply. Therefore, the judge can decide to impose injunction measures to the provider for the future, not only in order to put an end to the ongoing violations but also to prevent future ones (the ruling also specifies that nothing prevents a Court from requiring the hosting provider to block, not only access to content illegally published online, but also access to any other illegal content of the same type, about which the provider could become aware in the future – also for cases in which this implies a significant cost).

Media: any information that can identify a victim of sexual violence, even indirectly, is prohibited

Lawyer Vincenzo Colarocco

The Italian Data Protection Authority has reiterated, with some recent decisions (see inter alia No. 906580790657829065800 in Italian language) the principle that prohibits the media to publish information that can make identifiable, even indirectly, a victim of sexual violence.

Article. 137 of the Privacy Code provided -and still provide in the new text of Article 12, paragraph 1(c) of Legislative Decree 101/2018– that in the event of disclosure or communication of personal data for journalistic purposes the limitations imposed on freedom of the press, to protect the rights and freedoms of persons, shall be left unprejudiced, and, in particular, the limit of materiality of the information with regard to facts of public interest.

The Authority stated that this limit must be interpreted with particular strictness when are considered data suitable for identifying victims of crimes, even more so with reference to news concerning episodes of sexual violence, given the special protection afforded by the law to the confidentiality of the persons injured by such crimes.

The diffusion within an article of information suitable to make identifiable, even if indirectly, the victim, is in contrast with the requirements of protection of the dignity of the same, also according to the Article 8, paragraph 1, of the code of practice concerning the processing of personal data in the exercise of journalistic activities.

The Authority reminded that in the event of non-compliance with the prohibition, the data controller, in this case the publisher, may also incur the new administrative sanctions introduced by the GDPR, in Article 83, paragraph 5(e), which can reach up to 20 million of euro or 4% of the total annual turnover in the previous year.