With Judgement No. 34658/2022 (the “Judgement”) of November 15, 2022, the Italian Court of Cassation rendered a groundbreaking ruling that opened the door to the possibility of issuing global delisting/removal orders against search engines. Basically, in interpreting the case law of the Court of Justice of the European Union (“CJEU”) on the territorial scope of application of delisting/removal orders, the Court of Cassation conceded that national supervisory and judicial authorities can require search engines to delist/remove content on a global scale. The implications of this decision are far-reaching and groundbreaking and, therefore, need to be studied closely.
Background
The case originated from a decision of the Italian Data Protection Authority (Garante per la Protezione dei dati Personali—“Garante”) on October 26, 2017. In that decision, the Garante ordered a well-known search engine to remove from its search results the URLs subject to the proceedings. Specifically, while the search engine had already removed the URLs on all EU versions of its service, the Garante expanded the territorial scope for removal, making it global. The data subject had complained before the Garante that his “right to be forgotten” was being impaired by ongoing dissemination on the web of outdated news about a legal affair in which he had been involved that was dismissed due to lack of grounds for the crime. The data subject argued that he suffered damaged when this outdated news was disseminated outside of Italy due to the fact that he had professional interests outside of Europe. Therefore, he asked that the URLs be removed from non-European versions of the search engine as well.
The search engine appealed the Garante’s decision before the Court of Milan, contesting the global reach of the removal order. On September 21, 2020, the Court of Milan partially upheld the arguments raised by the search engine and limited the territorial scope of application of the Garante’s order to the versions of the search engine service available in the territories of EU Member States. According to the Court of Milan, the Italian Data Protection Code,[1] in the version applicable at that time, as well as the Garante’s orders and decisions, do not apply globally.
The Garante appealed the decision of the Court of Milan before the Italian Court of Cassation.
The Judgement
The Court of Cassation basically was asked to decide on the admissibility of an extraterritorial delisting/removal order (known as global delisting or global removal) issued against a search engine by a national supervisory authority.
After briefly recalling Case C-131/12, Google Spain SL, Google Inc. v. Agencia Espanola de Proteccion de Datos (known as the Costeja Case), the Court of Cassation focused on two cornerstone judgements: Case C-507/2017, Google v. CNIL (the “CNIL Case”) and Case C-18/18, Eva Glawischnig-Piesczek v. Facebook Ireland Limited (the “Glawischnig Case”).
The Court of Cassation then proceeded to analyze both the CNIL Case and the Glawischnig Case. Even though the CJEU reached different conclusions on the territorial scope of application of removal/delisting orders, certain fundamental principles on the subject were outlined.
A brief summary: In the CNIL Case, the CJEU affirmed that the data subject could request and obtain delisting from a search engine only on the EU level; in the Glawischnig Case, the CJEU opened the door to the possibility of delisting orders with global reach.
Notwithstanding the above, the Court of Cassation also noted that in the CNIL Case the CJEU limited the territorial scope of the removal/delisting order to the territory of the Member States, but it did not do so on a peremptory basis. Indeed, the Court of Cassation argued that the CJEU affirmed that EU law did not prohibit delisting from applying to all versions of the search engine. Accordingly, the CJEU noted that “a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights […] data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.” (para. 72)
In other words, while EU law does not oblige Member States to ensure that data subjects availing themselves of the right to delisting are afforded results on a global scale, EU law also does not prohibit Member States from providing such an extended level of protection if, based on the circumstances, global delisting is needed to effectively protect data subjects’ rights.
In light of the above, the Italian Court of Cassation confirmed that the protection afforded to data subjects under Article 3(1) and (2) of the Italian Constitution and the “right to be forgotten” empower Italian authorities to issue global delisting/removal orders. Obviously, this judgement is important in part because it opens the door for Italian authorities to issue globally applicable removal/delisting orders.
[1] Legislative Decree No. 196/2003.
