Oblivion, Erasure and Forgetting in the Digital Age

Since the announcement of an EU-wide right to be forgotten by the EC, discussions have circled around the rationale and scope of such a right. In 2012, the EC stated that all data must be deleted whenever the data subjects no longer want “their data to be processed and there are no legitimate grounds for retaining it”.  [22] In a speech given in early 2013, Vice-President of the EC Redingclarified that “the right to be forgotten cannot be absolute just as the right to privacy is not absolute. There are other fundamental rights with which the right to be forgotten needs to be balanced – such as freedom of expression and freedom of the press.”  [23]

As the legislative background of the right to be forgotten (even if now re-labelled as a “traditional” right of erasure, cf. B.III.2) implies, its creation resulted from the increased concern regarding how especially the younger generation makes use of social networking platforms. These concerns have not only been raised in Europe but have also found advocates in California, where a so-called “Erasure Bill” is been debated for teens and children using social networking sites.  [24]

Defining the scope and boundaries of the right to be forgotten has proven to be a difficult task not only at a political level but also among legal scholars. According to Koops,Reding’s speech indicates that the right to be forgotten is already part of the current data protection law in Europe, but it still needs to be reinforced. This argument is based on the Vice-President’s statement that the right to be forgotten shall “strengthen” the rights of individuals. Therefore, the right to be forgotten is seen as a mere support of the right to erasure, which is already established in the current Directive 95/46/EC.  [25] However, according to Koops, two main dimensions, encompassing perspectives on the right to be forgotten in the literature, must be distinguished: these comprise, first, Mayer-Schönberger’s pioneering vision of expiration dates for personal data, or a right to have data deleted in due time and, second, the dimension of oblivion, granting individuals a “fresh start” when news seem no longer newsworthy, and enabling the individuals self-development and freedom to speak, write and act.  [26]

Another approach to distinguish the right to be forgotten has been taken by Weber, who outlines the difference between the active – right to forget – and passive – right to be forgotten – verb tense. Weber states that the difference lies in the time component: while the right to forget requires a past event that has occurred a long time ago, the right to be forgotten allows any data subject to claim the deletion of their data regardless of the length of time elapsed.  [27]

Less focused on the wording and grammatical distinction itself, Rouvorydifferentiates between the perspectives of the parties involved in the act of forgetting. While the right to be forgotten is directed at third parties and their duty to forget, the right to forget is needed for the individual itself, to be able to forget his own past.  [28]

Conceptually, we agree with Ausloos’s and Ambrose’s claim that the right of oblivion and the right to erasure are “two interpretations of the right to be forgotten”.  [29] The authors maintain that the right to be forgotten can be interpreted as a combination of both concepts.  [30]

By reinforcing the idea that “individuals should have control of their personal data”, Art. 17 of the proposed General Data Protection Regulation  [31] (Regulation) can be seen as a step towards a more user-control-based approach in data protection and an attempt to reinforce the principle of informational self-determination in the digital age. Art. 17 (1) of the Regulation states that the “data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child” when the grounds listed in littera (a) to (d) apply. However, the subordinate clause “especially in relation to personal data which are made available by the data subject while he or she was a child” was deleted by the Rapporteur, Albrecht, in his Draft Report, 2012/0011(COD), 17.12.2012 as he feared that such a sub-clause would imply limitations on the applicability of the right to be forgotten with respect to adults.

On the basis of a compromised text by the Irish Presidency, on May 31 and June 21, 2013, the Council of the European Union published an amended version of its initial proposal.  [32] The long-awaited vote of the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE Committee) was held on October 21, 2013. These compromised amendments of the Draft Regulation were almost unanimously approved by the Parliament on March 14, 2014. The Council of the EU will negotiate the final text with the Parliament and the EC (trilog) and await the final approval by the Parliament once a text is agreed upon.

The Regulation subsumes under theterm right to be forgotten the data subject’s right – on a number of grounds – to delete personal data. One of those grounds is the “withdrawal of consent by which the data controller holds the data”.  [33] This right is currently enacted in Art. 17 (1b) of the Regulation. Even though already today Art. 14 Directive 95/46/EC obliges Member States to provide the data subject with a right to object to the procession of data, this does not embrace scenarios in which consent is withdrawn in retrospect.  [34] Since the Directive 95/46/EC mainly sets the minimal standard for data protection in the EU, the national legislations of Member States can differ in this respect. In other words, the withdrawal of consent as a ground for erasure can be established by national data protection acts.

If erasure on the grounds of Art. 17 (1) of the Regulation is demanded, the data controller has to carry out the erasure without delay.  [35] An exception is granted (inter alia) to the data controller in cases where retention is necessary for exercising the right of freedom of expression, reasons of public interests or for compliance with a legal obligation to retain the personal data by EU provisions or national law of a Member State to which the controller is subject.  [36] Furthermore, Art. 17 (1) (b) explicitly states, that “other legal grounds for the processing” can restrict the data subject’s right to erasure. Of special interest is also Art. 17 (1) (c), which, in combination with Art. 19, strengthens the individual’s rights by allowing the data subject to object at any time to the processing of personal data, unless the controller is able to demonstrate a compelling legitimate ground for such processing.  [37]

The pressing question with respect to the right to be forgotten is to what extent the intensive lobbying has altered the original scope and outreach of Art. 17 of the Regulation. One striking alteration is that the term “right to be forgotten” has been erased and replaced by the previously already used terminology “right of erasure”.  [38] Yet, except for the change of terminology, Art. 17 remains mostly true to its draft versions of 2013. Especially the core provisions that strengthen the position of users remained unchanged. The same holds true for Art. 17 (1b), which allows individuals to withdraw consent to the data processing at any time. However, Art. 17 (2), concerning the data controller’s responsibility to take reasonable steps to inform third parties to follow the demand of erasure when data has been made public without proper justification has been slightly defused. [39] The major amendment concerns the deletion of the last sentence of the original paragraph, which stated that data controllers are responsible for publications by third parties when they authorized the third party to do so. Furthermore, the altered provision does not request data controllers to take all reasonable steps to inform the third party about the erasure request but only reasonable steps. Howthose amendments will affect the data controllers’ responsibilities,especially in light of the mostly unchanged Recital 54, is unclear.

At the European level, privacy is an essential human right and is protected in Art. 8 (1) of the European Convention of Human Rights (ECHR)  [40] and the more recent Art. 7 of the Charter of Fundamental Rights of the European Union (CFREU). Both articles provide a right to respect of one’s private life, home and communication. Art. 8 ECHR regulates the relationship between individuals and public authorities and does not establish a direct obligation for private parties.  [41] The recent ECJ ruling (cf. C.I.2.) gave some clarity with regards to the impact of those rights on oblivion, erasure and forgetting in the digital age.

Those fundamental rights safeguarding privacy must be weighed against the fundamental rights to freedom of expression and information,  [42] as they are provided for inter alia in Art. 10 and Art. 11 ECHR.

Next to the protection of personal life in Art. 7 CFREU, the CFREU also explicitly protects personal data in Art. 8 (1). Already Art. 16 (1) Treaty on the Functioning of the European Union (TFEU) states that everybody has a right to protection of his personal data. With regard to the processing of personal data, the principles and conditions under which erasure can be demanded are defined in the Directive 95/46/EC. Especially relevant in this regard are Art. 12 (b) and Art. 14. The former article states that every data subject has the right to obtain from the controller – if appropriate – the erasure of processed data, which does not comply with the provisions established in the Directive, in particular if the data is incomplete or inaccurate.

A data subject’s right to erasure will depend on (1) whether the processing of the personal data was legitimate, i.e. in accordance with the requirements set forth in Art. 7 and 8; (2) whether the principles with respect to data quality of Art. 6 were adhered to; and (3) the availability of other corrective measures that would make the processing legitimate.  [43] If these requirements are fulfilled, the data subject can have its personal data erased. Erasure in this sense equals every measure that results in making the personal data unavailable to the data controller.  [44] Information can be erased by physically destroying the medium that carries the personal data, by overwriting the “to-be-erased” data with other information, or by removing the link between the information and the person and therewith altering the character of the data from personal to non-personal.  [45]

Further, the provisions of Directive 2002/58/EC  [46] and Directive 2000/31/EC  [47] apply as lexspecialis with respect to the electronic processing of data. Art. 6 of the Directive 2002/58/EC states that “data (…) must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication”.  [48] The Directive 2000/31/EC seeks to implement a differentiated system of intermediate service provider’s liability for illicit content in its Arts. 12-15. While not accounting for erasure or oblivion rights, as will be shown, the latter provisions do play an important role with regard to online privacy protection.

On May 13, 2014, theECJ brought some clarity regarding the practical impact of some of the aforementioned provisions. The Spanish DPA had ordered Google to de-index parts of a newspaper’s archive concerning a data subject’s attachment proceedings back in the 1990s. During appeal proceedings, the High Court of Spain (“Audiencia Nacional”) demanded that the ECJ determine whether Google can be deemed a data controller regarding the contested archives, whether Art. 12 (b) and 14 Directive 95/46/EC oblige Google to de-index third-party-generated web pages and if these provisions provide for a “right to be forgotten”.  [49]

As to whether search engines are to remove certain results that were provided when typing the data subject’s name according to Art. 12 and 14 Directive 95/46/ECthe question was affirmed. Interestingly, the court emphasized that whenever a search is performed by typing a person’s name, the engine establishes “a more or less detailed profile” of such a person, and the interference of this occurrence is catalysed by the role search engines play in today’s society. In Recital 81 and 97, the ECJ then established the general rule that, due to the potential seriousness of such an offence, the data subject’s right to privacy as provided for in Art. 7 and 8 CFREU overrides the interest of Internet users in having access to information as well as the economic interest of the search engine. The impact of this obiter dictum will have to be subject to further research.

With regards to the merits of the case, the court acknowledged the duty of Google to erase such links when demanded to do so by a Data Protection Authority (DPA). It argued that even if the content on the corresponding web page, to which the Google search results linked, was lawful, Google could still be forced to de-index specific results relating to a subject’s name. In particular, the court reasoned that the appearance of the contested data did violate the data relevancy principle as well as the principle of limited retention (Art. 6 (1) c and e Directive 95/45/EC) and therefore was unlawful in the meaning of Art. 12 (b) Directive 95/46/EC. Furthermore, since Google only could justify further processing by invoking Art. 7 (f) Directive 95/46/EC – since the data subject never consented to Google processing his personal data – the court reminded Google that a data subject has a right to object to such processing of personal data pursuant to Art. 14 Directive 95/46/EC.

The French constitution does not provide for a fundamental right to privacy or personality but rather makes a reference to the Declaration of Human and Civic Rights of August 1789 (1789 Declaration) in its preamble. Nevertheless, Art. 9 of the French Civil Code (CC), which guarantees everybody a general right to privacy, can be seen as the codification of the protective standards courts have drawn in the past from Art. 12 of the 1789 Declaration.  [50] Even if some legal scholars deem Art. 29 of the Act on the Freedom of the Press  [51] as the establishment of the right to privacy, the latter is merely a libel action that prohibits defamation.  [52] Additionally, the scope of Art. 1382 et seq. CC (the basic provision of French tort law) has traditionally been very broad, which has led to quite an effective protection of personality rights in France.  [53] The right of oblivion – having personal data deleted when it is no longer newsworthy –is seen as a particular right of personality.  [54] However, up to today the right is not explicitly provided by statute but rather is derived from “judicial reasoning” when applying the aforementioned provisions.  [55]

The effectiveness of the French legislation is also reflected in the country’s extensive case law. In different instances the French jurisdiction has elaborated on the conditions under which an individual can claim his right of oblivion. The High Court of Paris (“Courd’appel”) initiated the discussion, in 1967 in the case DelleSegret v. Soc Rome Film.  [56] In its decision, Mme. S’s demand for damages against a movie company that had produced a docu-fiction movie on the serial killer Henri Landru, to whom she had been a mistress, was rejected, based on the argument that she had previously made the story public in her published memories.

In1981 the High Court of Paris ruled that the disclosure of personal information relating to an individual who had been involved in a tragedy fifteen years back could not be justified because there was no necessity to disclose such information. The court thereby acknowledged a right to oblivion.  [57] In 1983 in the well-known Papon decision,  [58] the Regional Court of Paris (“Tribunal de grande instance”) defined the boundaries of the right of oblivionthathad been acknowledged two years earlier. In Papon the court stated that it is neither the duty nor the competence of French judges to decide how a special episode of history should be remembered or characterized in history. The court argued that a historian could only be liable if he was disclosing inaccurate or twisted facts, or when the disclosure of the facts was not justified by any historical interest when the person concerned was still alive.  [59]

Nevertheless, it seemed to have become the accepted opinio juris amongst French Regional and High Courts that “a public event, after the passing of a sufficiently long time, can become, for the person who was its protagonist, a fact of private life again, which may remain secret or forgotten”.  [60] However, and somewhat surprisingly, when a woman requested the suppression of publications on her activities during the occupation of 1940-45, the Supreme Court’s first civil chamber (“Cour de Cassation”) dismissed the notion that a right of oblivion may be invoked when the information had been lawfully disclosed in the local press and therefore no longer belonged to the private sphere.  [61]

The judicial reasoning in France shows the delicate balance between the personality rights of an individual,the freedom of the press and the freedom of information depending on the specifics of the case. Today, in particular search engines – or Googleasthe dominant search engine in Europe – also face accusations of infringement of personality rights. In 2010, the Regional Court of Paris had to decide whether the plaintiff could, based on Art. 29 Freedom of the Press Act, demand erasure of the autocomplete suggestions “rapist”, “sentenced”, and “satanist” when inserting his name in the search box.  [62] The court qualified the autocomplete suggestionsas allegations or imputations that undermine the honour or reputation of the plaintiff. The court argued that since the algorithms are based on human thought, Google must prove why the search results they provide should not be viewed as a statement from the company. Since Google failed to do so, they were ordered to delete these autocomplete suggestions.

Another decision of the High Court of Paris dealt with autocomplete suggestions and preliminary measures. The court found that the search suggestion “fraud” next to a company’s name was capable of libelling, especially because the average Internet user follows the suggestions. It concluded that the suggestion could be interpreted as Google’s opinion, in particular because it was presented as helpful input and it was not obvious that it was generated automatically.Therefore,requiringGoogle to take all necessary measures to eliminate those privacy-infringing results did not violate the company’s freedom of expression.  [63] In a later decision, the same court concluded again that it is appropriate to require Google to delete suggestions that were “obvious infringements of privacy”. The respondents’ objection that the suggestion was delivered by an algorithm was dismissed because the court ascertained that Google is able to filter racist or pornographic suggestions and therefore it should be feasible to do the same for defamatory suggestions.  [64]

France was among the first countries that enacted a law on data protection.  [65] The “Loi n°78/17 du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés” (Act 78/17), which had considerable influence on the drafting of the Directive 95/46/EC,  [66] was amended in 2004 according to EU standards.  [67] The two most relevant provisions with respect to erasure are Arts.38 and 40. While the former establishes a right to object to the personal data processing for legitimate reasons, the latter guarantees every individual, for any incomplete data, expired data or data for which processing is unlawful, a right to have it rectified, completed or deleted. Art. 40 Act 78/17 is seen as a procedural right which entitles the individual to have its data deleted whenever its right to privacy is infringed. It is interesting to note that most of the reviewed case law regarding the erasure of personal data has not been based on Art. 40 Act 78/17.  [68] Nevertheless, in the 2011 Mme. C. v. Google decision, the Regional Court of Montpellier elaborated that Google had an obligation under Art. 38 Act 78/17 to allow subsequent withdrawal of personal data by de-indexing webpages.  [69] With respect to de-indexation, the recent ruling by the Regional Court of Paris  [70] elaborates on the hosting provider’s liability with respect to erasure. The decision was based on Art. 6 Law for Confidence in the Digital Economy (LCEN),  [71] which establishes the notice and take down obligation on hosting providers, as laid out in the Directive 2000/31/EC (cf. C.I.1).  [72] Under this provision, the hosting provider will be held liable whenever the demanding party demonstrates the hosting provider’s actual knowledge of the contested content and his wrongdoing. Such a wrongdoing is seen in the continued distribution of the unlawful content or in not having reacted to the request immediately.  [73] Therefore, the Court of Paris held that Google had participated in the realization of the moral damage the plaintiff had suffered from having her name linked to pornographic webpages. Even though it is based on different legal norms, the case hassimilarities to the previously mentioned Mme. C. v. Google decision of the regional Court of Montpellier in 2011. In both cases, former porn actresses were demanding the de-indexation of webpages relating to their past activities.

The Regional Court of Paris dealt with explicit content once again when it ordered Google to block images depictingMax Mosley during a privately held Nazi-themed sex act. The British High Court of Justice as well as the Regional Court of Paris had recognized the unlawfulness of distributing such pictures and subsequently approved Mr. Mosley’s demand for erasure.  [74] Google also complied with the erasure notice and deleted several photographs from its image service. Nonetheless, the pictures reappeared, which led Mr. Mosley to demand that Google de-index the defamatory photographs from its search results. Based on Art. 6 LCEN, Mr. Mosley demanded that Google be ordered to remove and prohibit the future publication of those explicit photographs. When applying Art. 6 LCEN, such measures must be proportionate and limited in time. The illegality of the pictures confirmed by two European courts, and the fact that Google filters images automatically when uploading them to its services, led the court to affirm the proportionate nature of the request.  [75]

In Germany the Constitutional Court (“Bundesverfassungsgericht”) has interpreted the “right to personality” in Art. 2 (1) of the German Basic Law (GG) of 1949, which guarantees to everyone a “right to free development of his personality”. The introduction of Art. 1 (1) and Art. 2 (1) GG was crucial for the evolvement of personality protection.  [76] In the light of the latter two provisions, German courts interpreted § 823 (1) of the German Civil Code (BGB) – whose scope is not as wide as Art. 1382 CC in France  [77] – in a way that protects the individual’s right of integrity of his physical body and belongings as well as his right to privacy.  [78] However, many specific statutory provisions in private and criminal law further protect personal information –some of which were enacted long before the GG.  [79]

The German case law dealing with the right to personality – and in particular the right of oblivion – is extensive.  [80] Important leading cases  [81] in this respect are the Lebach I and Lebach II decisions. In the German Constitutional Court’s Lebach Idecision, the airing of the ZDF produced docu-drama on a criminal gang who had killed five soldiers in 1969 was prohibited because it showed C’s name and picture (C had been an actual member of the gang and at the time was still in prison). It was reasoned that the airing would have affected his privacy as well as public interest, in regard to putting his rehabilitation in danger.  [82] While the Lebach I verdict was rendered in 1973, the Lebach IIcase dates to 1999. Another TV station wanted to air a TV documentation on the gang’s deeds. This time, however, the gang members were neither named nor were pictures of them shown during the documentary.The German Constitutional Court therefore argued that the right to personality does not entitle criminals with a claim of not being confronted with their deeds in public ever again. Such an interpretation of the Lebach I decision was deemed to be misleading.  [83]

The Hooligan decision of the High Court of Berlin (“Kammergericht”) in 2001  [84] was an interesting one with respect to the digital storage of information. The decision concerned a news article reporting on the tragic incident at the FIFA World Cup 1998 when a hooligan almost killed a policeman by kicking him in the head. The article reported the story (including a picture of the hooligan), rendered a psychological analysis of the hooligan’s character and stated that he was an international drug lord (which turned out to be wrong). The hooligan demanded deletion of the article from the newspaper’s online archive by invoking the tort of privacy infringements in connection with the libel action and his right to personality. The court acknowledged that after a certain amount of time, the criminal’s interest in anonymity could outweigh the public interest in the information. Yet the court got around balancing the right to privacy with the right to information by clarifying that an online archive is a “pull service”, which is not to be confused with a publication. The archive therefore enjoys a right to store any article based on the freedom of speech (Art. 5 (1) GG).  [85]

In 2006 theHigh Court of Frankfurt (“Oberlandesgericht”) also dealt with issues resulting from online newspaper archives and balanced the right of oblivion in light of the benefits of rehabilitation. The court acknowledged a general right of oblivion, but denied it in the particular case due to the plaintiff’s lifetime imprisonment and thus a lack of interest in rehabilitation. The court stated that freedom of speech requires an unrestricted access to information and doubted whether an archive should be ordered to “change history”.  [86] One year later, the High Court of Hamburg did not seem to have such reservations. In its decision, it argued that based on § 823 (1) BGB in connection with Art. 1 (1) and Art. 2 (1) GG, the interest in rehabilitation did outweigh the interest of the archive in being complete. It therefore had to delete the plaintiff’s name from its publications. Furthermore, concerning the potential harm articles on convicted persons can have on their rehabilitation, the court found that monitoring its archives in order to prevent infringements of the right of oblivion seems to be a reasonable obligation for an online archive.  [87]

The so-called Sedlmayr case has gained much attention. Two brothers had killed the famous actor Walter Seldmayr in 1990. Thoughthey had been sentenced to lifetime imprisonment in 1993, one brother was released on probation in 2008. He filed several claims against media webpages, inter alia one against a German radio. The latter had stored an online report dating from 2000in its web archive, in which the 10-year anniversary of the killing was remembered. While the High Court found this case comparable to the Lebach I case, the Supreme Court (“Bundesgerichtshof”) came to a different interpretation of § 823 BGB, Art. 1 (1), Art. 2 (1) GG and Art. 8 ECHR when it weighed them against statutes protecting the freedom of speech and information (Art. 5 GG andArt. 10 ECHR). Even though data protection law was invoked,it was considered not applicable due to reservations resulting from international public law. The Supreme Court stated that whencurrent events are reported,the public interest in the information generally outweighs other individual interests, but that such reports could become unjustified during time. The court subsequently weighed different factors against each other, such as the time elapsed between the event and the report, the correctness of the report and its impact. Since thecontested report was found to be based on true facts and not stigmatizing as well as – unlike Lebach I – not of broad public impact, the Supreme Court decided in favour of the plaintiff.Further it was reasoned that an imperative of deleting identifying reports on criminal conduct would eventually lead to deleting history and the media would not be able to fulfil its purpose of informing the public – as they are ordered by the GG.  [88] Note that the court had similar reservations with regard to “erasing” history as they could be seen in the Regional Court of Paris’ Papon decision (cf. C.II.1). It also must be mentioned that there were several Sedlmayrdecisions, and all media companies defeated the claimant.  [89]

In sum, German jurisdiction has been reluctant to grant the right of oblivion on grounds of infringement of the individual’s right to personality. German courts have balanced (in different instances) the interest in having “historical news” deleted versus the freedom of the press. Especially in light of the potential endangerment of the rehabilitation into society, an interest in oblivion has been acknowledged. As illustrated by the cases presented, the right of oblivion is only granted when the benefits of rehabilitation outweigh the censorship of the press.

Furthermore, one should mention the Kannibale von Rothenburg ruling by the German Supreme Court in 2009, in which a known cannibal was unsuccessful in trying to stop the airing of a horror movie that was an adaption of his disturbing deeds. His case was dismissed because he himself had exposed details of his crime and person to the public and therefore failed to prove that his rehabilitation was endangered by the movie.  [90] Similar to the above-mentioned 1967 Paris Appellate Court’sDelleSegret v. Soc. Rome Paris Film decision,  [91] the conclusion may be drawn that a right of oblivion can also be waived if the subject itself reminds the public of its deeds.

The fundamental legal ground for privacy protection when personal data is being processed lies in the German Federal Data Protection Act (BDSG). This law incorporates the principles of data processing laid out in the Directive 95/46/EC.  [92]

§ 35 BDSG lays out the foundation of the right of erasure of personal data when this data is being processed by non-state entities. In particular, § 35, (2) BDSG distinguishes four general situations in which personal data may be erased; these arise whenever (1) the data is unlawfully recorded, (2) the data is sensitive, (3) the purpose of the collection of the data is fulfilled or (4) further retention is unnecessary. Moreover, personal data may not be collected, processed or used if the data subject lodges an objection with the controller and an examination indicates that legitimate interests of the data subject due to its particular situation outweigh the interest of the data controller in such collection, processing or use.  [93]

One case that dealt with § 35 BDSG was decided atthe dawn of the new millennium by the High Court of Hamm. The defendant, a business information agency, had stored information on the plaintiff’s number of employees, business routine, mode of payment, assets and liabilities. Most data was compiled from public sources, except the assets and liabilities which had been estimated. The plaintiff filed a lawsuit against the business information agency in which it demanded erasure. The court acknowledged that § 35 BDSG guarantees a right to erasure, except when consent was given to the processing (and that this was not the case was uncontested) or the law allows the processing. § 29 BDSG allows commercial collection from public sources as long as there are no legitimate overruling interests of the data subject. Because the information was not sensitive and there was, to a certain degree, a public interest in such data, its collection was legal. Accordingly, the request for erasure was rejected. Nevertheless, the agency had to rectify that the data on assets and liabilities were only estimated.  [94]

With regards to the admissibility of online rating platforms the Supreme Court’s 2009 spickmich.de ruling was expected to be a landmark decision. The issue concerned a rating platform which allowed pupils to anonymously rate their teachers with regards to several criteria by using pre-fixed attributessuch as “competent” and “well prepared”. Theseratings were combinedto an overall grade. One teacher (she had received a 4.3, which is equivalent to a barely acceptable performance) sued the platform for forbearance. The court found that the respondent’s processing of data could be justified by Art. 29 BDSG (collection from public sources for commercial reasons) as far as there are no legitimate overruling interests of the data subject. In order to assess this question, the court weighed the “right to informational self-determination as provided for in Art. 1 (1) and Art. 2 (1) GG” against the freedom of speech and information as provided for in Art. 5 (1) GG. The court qualified the data in question as belonging to the professional social sphere, meaning that they were neither private nor even intimate. On the other hand, it found the platform to be designed in a manner that prevented libelling statements (e.g. besides the possibility to rate a teacher with pre-fixed attributes, there was no possibility to leave comments) and acknowledged pupils and their parents’ legitimate interests in comparing teachers. The claim was therefore dismissed.  [95] Yetthe Supreme Court’s judgment highlights that there is nogeneral rule regarding the admissibility of online rating platforms; rather, each case must be assessed individually.

It is further interesting to note that in Germany, the “well-known” claims against the autocomplete function of Google were not based on data protection law. In 2011, the High Court of Hamburg had to decide, on the grounds of defamation and general tort law,  [96] whether the claim of a real estate company was legitimate or not. The claimant demanded that Google delete the autocomplete suggestion “fraud”. In addition, he demanded that various pages and snippets, in which the real estate company was accused of betraying its customers, be de-indexed from the search results. According to the claimant, the snippets were an expression of Google’s opinion and therefore were capable of being a violation of personal rights. Yet the High Court of Hamburg found that an algorithm – without human intervention – had produced the search results and that these were not the opinion of Google as the search engine would only provide results that are already available on the Internet. Additionally, the court held that Google had no duty to examine and filter the source of search results beforehand, and that its participation in the alleged violation of privacy rights was neither voluntary nor of appropriate causality. The High Court of Hamburg thereby rejected the claim for forbearance.  [97]

Similar reasoning led to denying a right to erasure by the High Court of Munich. The claimant, an address register provider, demanded the deletion of Google’s search results which accused him of fraud. Furthermore, he demanded the deletion of the search suggestions “fraud” and “rip-off” associated with his name. The court argued that Google provides results – in the form of snippets and search suggestions – which are automatically generated. Thereby, Google does not make a statement of its own but rather re-organizes pre-existing content. As this was considered an obvious fact to the average user, Google could not be considered an offender, accomplice or assistant to any privacy-infringing action. Furthermore, the court reasoned that a notice and take down obligation would require a so-called “duty to secure fair competition”. Such an obligation would only arise when being notified of an obvious privacy infringement. Privacy infringements, however, were deemed to be far from obvious because they involve a complex balancing of interests and therefore a notice and take down obligation was denied.  [98]

These decisions showed that German courts highly valued the right to information and therefore were reluctant to impose any liability on a search engine for its results or autocomplete suggestions.  [99] Surprisingly, the German Supreme Court overthrew this approach in its Scientology decision in 2013. In this case, the plaintiffs, an online drugstore and its founder and chairman R.S., sued Google for the search suggestions “Scientology” and “fraud” and demanded forbearance. By invoking the above-mentioned arguments, the High Court of Cologne dismissed the claim.  [100] However, the Supreme Court reasoned that “Scientology” and “fraud” are both words with negative associations and since the average user expects that these suggestions are helpful inputs, they are capable of invading privacy rights. In the present case, such a privacy infringement was acknowledged, in particular because the suggestions created untrue associations. The court concluded that even if generated by an algorithm, the search engine is accountable for its suggestions. In particular, the notion that search engines could be considered as mere hostingproviders was dismissed. However, in the court’s view, search engines should not be obliged to check all suggestions in advance, but should take measures to prevent their suggestions from infringing privacy rights. The significance of this is that if someone notifies the search engine that the suggestions are infringing upon his or her privacy rights, this notification creates an obligation to check whetherthis is the case and eventually delete the contested suggestion.  [101] Therefore, as in France, search engines face accountability for autocomplete suggestions generated by algorithms and qualify as content providers in this respect. Nevertheless – as opposed to France, where obvious privacy infringements must be taken down in advance – the German Supreme Court merely established a notice and take down obligation for a content provider based on the general privacy tort action.

According to Art. 2 of the Italian Constitution, “the Republic recognizes and guarantees the inviolable rights of a person, as individual and in the community where he expresses its personality (…)”. In combination with Art. 15, which protects the secrecy of correspondence, those constitutional norms lay out the foundation for protecting an individual’s privacy.  [102] Yet in civil law there is no statutory provision protecting a general right to personality or privacy; rather, only certain aspects of personality (such as name and physical integrity) enjoy protection.  [103]

On a base level, the protection of personal data is seen as a subjective right that strengthens the individual’s right to defence against actions that adversely affect his right of privacy. [104] The Italian Data Protection Act  [105] (Legislative Decree 2003/196) incorporates in Art. 7 (3) the right of the data subject to demand erasure or anonymization of personal data if the processing is illegitimate or if the maintenance of the data is no longer necessary in relation to the purpose for which they were specifically collected. Furthermore, the data subject has the right to update, rectify or complete the data with additional data.  [106] These tools allow the rectification of the data after its collection and mutation.  [107] Art. 11 (1e) states that identifiable personal data shall not be processed over a certain amount of time necessary for the purposes for which they have been collected. According to Italian scholars, once the purposes are attained or no longer of interest, the data subject has the right “ad esseredimenticato”,  [108] i.e. the “right to be forgotten”. Thereby, Italian law prohibits the maintenance of personal data as soon as it fulfils its purpose of collection.  [109]

It should first be mentioned that Italian literature distinguishes between privacy and reservation, yet states that these two concepts are overlapping and intermingled. While privacy is understood as a guaranteed freedom to determine for oneself how to shape one’s private life, reservation protects the integrity of the individual’s private sphere.  [110] Those rights were further developed by courts and include, among others, the right of reputation, the right to rectification, the right to be let alone and the right of image and name.  [111] In their core, these rights protect the personality and identity of the individual.  [112] Since the personality of an individual consists of different aspects varying over time, the right of oblivion balances the conflict between an accurate story (at the time it occurred) and an actual person’s identity at the time being. In this regard, the right of oblivion guarantees a right to reservation.  [113] Therefore, Italian jurisprudence and legal scholars define the right of oblivion as the individual’s right to prevent the publishing of old news concerning him or her, even if the reported events had once been newsworthy and legitimately published.  [114] Special focus lies on the role of time and the balance between public and individual interests.  [115]

In 1984 the Italian Court of Cassation (“Corte di Cassazione”) established three criteria determining the boundaries of the freedom of the press. The dispute before the court involved different reports published in a monthly newspaper concerning the common funds of two real estate companies. The plaintiffs claimed that these reports published in 1972/1973 were denigrating and demanded, based on Art. 2043 of the Italian Civil Code, the subsequent prohibition of the reports and damages for the loss suffered. In its decision, the court debated the limits of the freedom of the press, a right guaranteed in Art. 21 of the Italian Constitution, and regulated in the Press Act.  [116] The court established three criteria limiting the freedom of the press: first, the reported information needs to be of social or public interest; second, the coverage needs to be correct (or at least the result of a serious investigation towards finding the truth); and third, the information must be presented in an objective, civilized manner. The decision balanced arguments such as the social utility of the information, newsworthiness, need for completeness of the information, intrusions in the private sphere of the individual and the potential harm to his image, honour and reputation.  [117]

Later in 2012, the Court of Cassationdealt with the right of oblivion in online newspapers. [118]A politician who had been arrested and charged with corruption in 1993 and subsequently acquitted, requested that a news article regarding his arrest be removed from the archive of the “Corrieredella Sera”, which was still indexed by search engines. Even though the event of his arrest and charges were true, the Court of Cassation acknowledged that the information in the article was incomplete, since the charge had been dropped. Balancing the freedom of the press and the individual’s right to privacy and oblivion, the court ruled that the newspaper had an obligation to equip its archives with “an appropriate system designed to provide information (in the body of the text or in the margin) on whether there exists a follow-up or any development to news items and if so what the content is [...] allowing users swift and easy access to the updated information.”  [119] Therefore, it is necessary to amend information  [120] on the development of the case so that the users are presented with an accurate picture of the events. However, search engines were viewed as mere intermediaries and hence not responsible for the information or obliged to de-link the contested webpages.

Prior to this ruling, the Italian data protection authority issued two decisions in 2005 and 2008 concerning online archives. The first ruling dealt with the online retrieval of a decision issued in 1996 by the Italian Antitrust Authority against a company on account of misleading advertising.  [121] The data protection authority stated that such an online retrieval on external search engines should be restricted. Next to the establishment of a restricted-access section to old decisions on the antitrust authority website, which must not be retrievable by standard search engines, the Italian DPA ordered the Antitrust Authority to define the time period during which the posting of free decisions seemed proportionate. Thus, access must be granted to decisions that are still relevant for fulfilling their purpose; respectively, access to decisions that have already achieved their purpose should be restricted. The Antitrust Authority complied by applying robot-meta tags  [122] to decisions that were more than five years old (sanctions against offenders were statute-barred after this time). In the second decision, DPA v. Google Inc. and RcsQuotidianiS.p.Aof 2008, the data protection authority balanced the individual right of oblivion with the freedom of expression, the freedom to exercise free historical research, the right to education and information as well as with the rules on protection of personal data. The DPA held that there were legitimate grounds for publishing the contested publication – at that time an undisputed depiction of facts of public interest. Nevertheless, the DPA argued that there were no legitimate grounds for personal data in online archives being retrievable through external search engines. In other words, an archive’s web page that exhibits personal data must be de-linked from the external search engine function by the company that acts as the content provider.  [123]

In 2011 theRegional Court of Milan (“TribunaleOrdinario di Milano”)dealt with a matter concerning autocomplete suggestions by Google. The plaintiff demanded that the suggested search result “fraud” or “crook” next to his name be erased. The court ruled in the plaintiff’s favour: auser seeing such a suggested search result would be suspicious and assume illicit activities by the plaintiff; the user would therewith be more likely to stop his further search enquiry. Therefore, the court stated that such an autocomplete suggestion infringes the honour and reputation of the person it relates to. Simultaneously, the court specified that the search suggestions are based on a “neutral” algorithm that does not differentiate between good and bad. The association between the applicant's name and the words “scam” and “crook” was considered the work of the software specially developed and adopted by the claimant to optimize access to its database. While Google itself was considered a hosting provider under Directive 2000/31/EC (and its implementation into Italian law in Legislative Decree 70/2003), Google’s “autocomplete function” was deemed to fulfil characteristic functions of a content provider, namely by choosing which information to provide to its users. The court found that Google was liable for autocomplete defamatory suggestionsthataverage individual users are unable to distinguish from truthful facts.  [124]

Two years later, the same Regional Court of Milan decided a case in which it excluded Google from liability for defamation with respect to the autocomplete suggestions.  [125] The court reasoned that notwithstanding the qualification of Google as a caching, hosting or content provider, the company would still be responsible under Art. 15 and 16 Legislative Decree No. 70/2003 to remove defamatory content from its autocomplete function on an urgent basis. The court concluded, however, that even though Google had thus no general obligation to monitor the information and in casu autocomplete keywords, it did have a duty to remove illicit content if required to do so by a competent judicial authority.  [126]