Diritto dei Prodotti Digitali | IT Law

Icon

COMUNICAZIONE DIGITALE | Università degli Studi di Milano

European Court of Justice: privacy, diritto all’oblio e “right to be forgotten”

An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data has the objective of protecting the fundamental rights and freedoms of natural persons (in particular the right to privacy) when personal data are processed, while removing obstacles to the free flow of such data. The Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. The Court further holds that the operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing. So far as concerns, next, the extent of the responsibility of the operator of the search engine, the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. The Court points out in this context that processing of personal data carried out by such an operator enables any internet user, when he makes a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet. The Court observes, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, the Court holds that a fair balance should be sought in particular between that interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court observes in this regard that, whilst it is true that the data subject’s rights also override, as a general rule, that interest of internet users, this balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life. Finally, in response to the question whether the directive enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time, the Court holds that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. Read the full judgment  eng | ita

Google: nuovi termini di servizio e possibili conflitti in materia di protezione dei dati personali

Using your favourite Google services these days, you may have seen the notification that Google is consolidating its 60 privacy guidelines into a single policy that will function across all its services, including YouTube, Gmail and Google+. The EU data protection authority calls for Google to halt the new policy’s March 1 implementation. Regulators are concerned that Google may share personal data across all of its platforms without giving users the chance to give their prior consent. The Article 29 Working Party, an independent body that brings together data protection authorities from each of the EU’s 27 countries and the EU’s executive European Commission, said it needed to examine Google’s plans more thoroughly before the search group’s policy comes into effect on March 1. “Given the wide range of services you offer, and the popularity of these services, changes in your privacy policy may affect many citizens in most or all of the EU member states,” the group wrote to Google Chief Executive Larry Page on February 2. The European commissioner in charge of data protection, Viviane Reding, welcomed the move, saying it was a necessary to establish that EU data rules were being firmly applied. The relationship between Google+ (Google social networking site) and the search engine is widely regarded as one of the most controversial theme, considering Google’s plans to include photos and posts from users’ Google+ accounts in search results. Google is not obliged to wait for the conclusion of the Article 29 Working Group’s investigation before adopting its new policy, but has in the past sought to work with European authorities when they have raised concerns.