CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 25 novembre 2021

.s800EAC49 { font-size:12pt } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sBB9EE52A { font-family:Arial } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .sE207830C { margin-top:54pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .s34DFC730 { margin-top:0pt; margin-bottom:0pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s2D726B78 { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s88D564B { margin-top:0pt; margin-bottom:0pt; text-align:justify; border:0.75pt solid #000000; padding:1pt 4pt } .s6477A72F { margin-top:0pt; margin-bottom:6pt; text-indent:14.2pt; text-align:justify } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .sE208486F { font-family:Arial; color:#ff0000 } .s8229ABDD { margin-top:0pt; margin-bottom:12pt; text-align:center } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s9793A85B { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sB9D5CABB { width:28.35pt; display:inline-block } .s3AAE10DF { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .s434D37A9 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s7ED160F0 { text-decoration:none } .s33165EBA { font-family:Arial; font-size:8pt; vertical-align:super; color:#0069d6 } .s6B505E72 { margin:0pt; padding-left:0pt } .sCBF2D345 { margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:8.18pt; font-family:Arial; text-transform:uppercase } .s715E7C6D { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s3A692EA6 { margin-top:14pt; margin-bottom:6pt; text-align:center; page-break-after:avoid; font-size:10pt } .s9D48DD53 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .sD0489F03 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sCD7D0356 { margin-top:14pt; margin-left:15pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:4.85pt; font-family:Arial; text-transform:uppercase } .s743F3A55 { margin-right:0pt; margin-left:0pt; padding-left:0pt } .s8C49A017 { margin-left:5.65pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-weight:bold; text-transform:none } .s2EAAAA4F { margin-top:6pt; margin-bottom:6pt; text-align:justify } .s4BAE41EE { font-family:Arial; font-size:11pt } .sE6D27FD { margin-top:0pt; margin-bottom:0pt; text-indent:28.35pt; text-align:justify; font-size:10pt } .sE5273FBD { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:center; font-size:10pt } .s5E8F5A28 { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-weight:bold } .sC47DA4E2 { margin-top:14pt; margin-left:18.34pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.51pt; font-family:Arial; text-transform:uppercase } .s2044A09A { margin-left:6.51pt; margin-bottom:6pt; page-break-inside:avoid; page-break-after:avoid; padding-left:1.99pt; font-weight:normal; font-style:italic } .sC7F250FD { font-style:normal } .sAE6FB95D { margin-top:14pt; margin-left:32.01pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.99pt; font-family:Arial; font-style:italic } .sB25A0399 { margin-top:14pt; margin-left:24.84pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.66pt; font-family:Arial; font-weight:bold } .s4E036C5F { margin-top:14pt; margin-left:19.85pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sF54F3725 { margin-top:0pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sDBC81028 { width:4.83pt; font:7pt 'Times New Roman'; display:inline-block } .s65DDED6B { margin-top:14pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s7AE800C3 { width:4.28pt; font:7pt 'Times New Roman'; display:inline-block } .s599F5480 { margin-top:0pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s3970C00F { width:8.17pt; font:7pt 'Times New Roman'; display:inline-block } .s4B52A9A9 { margin-top:14pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s320E5A8E { width:5.95pt; font:7pt 'Times New Roman'; display:inline-block } .sD051EF8 { width:3.72pt; font:7pt 'Times New Roman'; display:inline-block } .s4196892D { width:3.17pt; font:7pt 'Times New Roman'; display:inline-block } .s448F0C15 { margin-top:14pt; margin-left:18pt; margin-bottom:12pt; text-indent:-18pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .sD11CFAB7 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:1.99pt; font-family:Arial } .sFBC99493 { font-style:italic } .s7CB9076 { margin-top:36pt; margin-bottom:0pt; page-break-inside:avoid; page-break-after:avoid } .sA2F50EB2 { width:188.27pt; display:inline-block } .s7602FED2 { width:18.21pt; display:inline-block } .sC1AC44A4 { width:228.11pt; display:inline-block } .sF6A12959 { width:33%; height:1px; text-align:left } .s85226119 { margin-top:0pt; margin-bottom:0pt; text-align:justify; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 } .s2EB42ED2 { margin-top:0pt; margin-bottom:0pt; font-size:10pt }   FIRST SECTION CASE OF BIANCARDI v. ITALY (Application no. 77419/16)     JUDGMENT   Art 10 • Freedom of expression • Civil judgment against newspaper editor for refusal over long period to de-index article on criminal case against private individuals, easily accessible by typing names into Internet search engine • Obligation to de-index material applicable not only to Internet search engine providers but also to administrators of newspaper or journalistic archives accessible via Internet • Information on sensitive data easily accessible online for eight months after formal request to remove it by persons concerned • Sanction not excessive • No requirement to permanently remove article from Internet or to anonymise it   STRASBOURG 25 November 2021   FINAL   25/02/2022   This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Biancardi v. Italy, The European Court of Human Rights (First Section), sitting as a Chamber composed of:   Ksenija Turković, President ,   Péter Paczolay,   Krzysztof Wojtyczek,   Alena Poláčková,   Gilberto Felici,   Erik Wennerström,   Raffaele Sabato, judges , and Renata Degener, Section Registrar , Having regard to: the application (no.   77419/16) against the Italian Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by an Italian national, Mr   Alessandro Biancardi (“the applicant”), on 7 December 2016; the decision to give notice to the Italian Government (“the Government”) of the complaint concerning Article 10 of the Convention; the observations submitted by the respondent Government and the observations in reply submitted by the applicant; the comments submitted by the Reporters Committee for Freedom of the Press, the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights, the Media Lawyers Association and the Media Legal Defence Initiative, who were granted leave to intervene by the President of the Section; Having deliberated in private on 2 November 2021, Delivers the following judgment, which was adopted on that date: INTRODUCTION 1.     The applicant, the editor-in-chief of an online newspaper, was held liable under civil law for having kept on his newspaper’s website and not having de-indexed an article reporting the facts of a criminal case instituted against private individuals. The applicant alleged the violation of his freedom of expression under Article 10 of the Convention. THE FACTS 2.     The applicant was born in 1972 and lives in Pescara. He was represented by Mr M. Franceschelli, a lawyer practising in Pescara. 3.     The Government were represented by their Agent, Mr Lorenzo D’Ascia. 4.     The facts of the case, as submitted by the parties, may be summarised as follows. 5.     The applicant was the editor-in-chief of an online newspaper. On 29   March 2008 he published an article concerning a fight, followed by a stabbing, which had taken place in a restaurant. 6 .     The article was headlined “Fight in the restaurant – the head of the police authority closes the W and Z restaurants [which belonged to the persons involved in the fight]”. The “standfirst paragraph” under the headline read as follows: “Pescara – Reputational damage and financial repercussions sustained by the W and Z restaurants belonging to the X family”. 7.     The article noted the head of the police authority’s decision to close the restaurants for twenty days. It mentioned the names of the persons involved (two brothers, V.X. and U.X., and their respective sons, A.X and B.X.), as well as the possible motive for the fight, which probably related to a financial quarrel about the ownership of a building. The article reported on the line taken during part of the police questioning of V.X., U.X., A.X and B.X., and noted that U.X. and A.X. had been placed under house arrest, that B.X. had been taken to a detention facility and that a house arrest order issued in respect of V.X. had been lifted. 8.     On 6 September 2010, V.X. and the W restaurant sent a formal notice ( diffida stragiudiziale ) to the applicant asking that the article be removed from the Internet, but to no avail. 9.     On 26   October 2010, V.X. and W lodged two claims with the District Court of Chieti against, respectively, Google Italy S.r.l. and the applicant, pursuant to Article 152 of Legislative Decree no. 196 of 30 June 2003 (hereinafter “the Personal Data Protection Code” – see paragraphs 15 et seq. below) and Article 702 bis of the Code of Civil Procedure (Formal requirements regarding the bringing of proceedings before a court and the parties thereto). 10 .     At the hearing of 23 May 2011, the applicant indicated that he had de-indexed the article in question, with a view to settling the case [1] . By a decision of 28 March 2012, the court excluded Google Italy S.r.l. from the proceedings following V.X.’s withdrawal of his claim against this party. 11.     By a decision of 16 January 2013, the District Court of Chieti observed at the outset that, in the light of the information that the applicant had supplied on 23 May 2011, there was no need to examine the part of V.X.’s complaint regarding the request for the article to be removed from the Internet. 12.     As for the remainder of the complaint, concerning the breach of the claimants’ right to respect for their reputation, the court awarded to each claimant 5,000 euros (EUR) in compensation for non-pecuniary damage and EUR 2,310 for costs and expenses. 13.     The court referred to the applicable legislation on the matter – namely, Articles 7, 11, 15 and 25 of the Personal Data Protection Code. It noted in particular that the information concerning the claimants had been published on 29 March 2008 and had remained accessible on the Internet until 23   May 2011, notwithstanding V.X.’s formal notice to the applicant asking that the article in question be removed from the Internet (see paragraph 8 above). In the court’s view, the public interest in the right to provide information had then been satisfied and, at least from the date of V.X. sending the above-mentioned formal notice, the processing of his personal data had not been in compliance with Articles 11 and 15 of the Personal Data Protection Code. The court then concluded that there had been a breach of the claimants’ reputation and right to respect for their private life. The court also noted that the information at issue was easily accessible (much more than any information published in print newspapers, taking into account the large local dissemination of the online newspaper at issue) by simply inserting the claimants’ names into the search engine, and that the nature of the relevant data, as regards judicial proceedings, was sensitive. 14 .     The applicant lodged an appeal on points of law; by a judgment of 24   June 2016, the Supreme Court upheld the first-instance decision on all grounds and dismissed the applicant’s appeal. The Supreme Court noted that the processing of the plaintiffs’ personal data had been unlawful inasmuch as the article, published on 29 March 2008, had remained accessible on the Internet, despite the above-mentioned formal notice sent (to the applicant asking that the article in question be removed from the Internet) by V.X. on 6   September 2010, and that the possibility to access the article had been easy and direct. The Supreme Court excluded the possibility that in this case the unlawfulness of the way in which the personal data had been processed had been linked either to the content of the said article, to its online publication and dissemination, or to its conservation and digital archiving. RELEVANT LEGAL FRAMEWORK AND PRACTICE relevant domestic law Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code) 15 .     The relevant provisions of the Personal Data Protection Code read as follows: Article 7: Right to access personal data, and other rights “... 3. (a)     The data subject has the right to obtain the removal, the anonymisation or the interruption of the processing of data that are being used illegally. ... Article 11: Arrangements for the processing and categorisation of data “1.     Personal data undergoing processing are: ... (e)     kept, in a form that allows the identification of the person concerned, for a period not exceeding the time necessary to achieve the objectives for which the data have been collected and subsequently processed. ...” Article 15: Damage arising from data processing “A person causing damage to a third person as a consequence of the processing of his or her personal data must compensate the person concerned under Article 2050 of the Civil Code. The person concerned is also entitled to obtain compensation for non-pecuniary damage resulting from the breach of Article 11.” Article 25: Prohibition of communication and dissemination “Communication and dissemination are prohibited in respect of ...: (a)     personal data whose removal has been ordered, after the period of time indicated in Article 11 § (1) (e) has elapsed ...” Article 99: Compatibility of the objectives and the length of processing “1.     The processing of personal data for historical, scientific or statistical research purposes is considered to be compatible with the different objectives for which the data was initially collected or processed. 2.     The processing of personal data for historical, scientific or statistical research purposes may be carried out also upon the expiry of the period that is necessary for achieving the different purposes for which the data was initially collected and processed. ...” Article 136: Journalistic purposes ... “1.     The provision contained in this paragraph [Journalism and Literary and Artistic Expression] are applicable to the processing of data: (a)     carried out in the exercise of journalistic activities and for the exclusive pursuit of the inherent objectives. ...” Article 139: Code of ethics concerning journalistic activities “The Data Protection Authority encourages the adoption by the National Council of Journalists of a code of ethics in respect of the processing of the [type of] data referred to in Article 136, which [would provide] protective measures ... in respect of ..., in particular, data that could reveal information regarding [a person’s] state of health or sexual life. ...” Article 152: Ordinary judicial authorities “1.     An ordinary judicial authority [ autorità giudiziaria ordinaria ] has jurisdiction to settle all disputes concerning the application of the provisions contained in the present code ... 2.     In order to institute proceedings concerning all disputes mentioned in paragraph   1 above, an appeal shall be lodged with the registry of the court serving the place of residence of the person whose (personal data) are being processed. 3.     The court will decide [a case] sitting in a single-judge formation. ... 13.     A judgment may not be subject to an appeal on the merits before a second-instance court; however, it may be subject to an appeal on points of law before the Court of Cassation. ...” International LAW MATERIAL Recommendation CM/Rec(2012)3 of the Council of Europe’s Committee of Ministers to member States on the protection of human rights with regard to search engines 16 .     In its relevant parts, Recommendation CM/Rec(2012)3 of the Council of Europe’s Committee of Ministers to member States on the protection of human rights with regard to search engines, adopted by the Committee of Ministers on 4 April 2012, reads as follows: “7.     The Committee of Ministers ..., under the terms of Article 15. b of the Statute of the Council of Europe, recommends that member States, in consultation with private sector actors and civil society, develop and promote coherent strategies to protect freedom of expression, access to information and other human rights and fundamental freedoms in relation to search engines in line with the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No. 5, hereinafter referred to as the ‘Convention’), especially Article 8 (Right to respect for private and family life) and Article 10 (Freedom of expression) and with the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108, hereafter referred to as ‘Convention No.   108’), in particular by engaging with search engine providers to carry out the following actions: –     enhance transparency regarding the way in which access to information is provided, in order to ensure access to, and pluralism and diversity of, information and services, in particular the criteria according to which search results are selected, ranked or removed; –     review search ranking and indexing of content which, although in the public space, is not intended for mass communication (or for mass communication in aggregate). This could include listing content sufficiently low in search results so as to strike a balance between the accessibility of the content in question and the intentions or wishes of its producer (for example having different accessibility levels to content which is published seeking broad dissemination as compared to content which is merely available in a public space). Default settings should be conceived taking account of this objective; ... III.     Filtering and de-indexing Context and challenges 12.     A prerequisite for the existence of effective search engines is the freedom to crawl and index the information available on the Internet. The filtering and blocking of Internet content by search engine providers entails the risk of violation of freedom of expression guaranteed by Article 10 of the Convention in respect to the rights of providers and users to distribute and access information. 13.     Search engine providers should not be obliged to monitor their networks and services proactively in order to detect possibly illegal content, nor should they conduct any ex ante filtering or blocking activity, unless mandated by court order or by a competent authority. However, there may be legitimate requests to remove specific sources from their index, for example in cases where other rights outweigh the right to freedom of expression and information; the right to information cannot be understood as extending the access to content beyond the intention of the person who exercises her or his freedom of expression. 14.     In many countries, search engine providers de-index or filter specific websites at the request of public authorities or private parties in order to comply with legal obligations or at their own initiative (for example in cases not related to the content of websites, but to technical dangers such as malware). Any such de-indexing or filtering should be transparent, narrowly tailored and reviewed regularly subject to compliance with due process requirements. Action 15.     Member States should: –     ensure that any law, policy or individual request on de-indexing or filtering is enacted with full respect for relevant legal provisions, the right to freedom of expression and the right to seek, receive and impart information. The principles of due process and access to independent and accountable redress mechanisms should also be respected in this context. 16.     In addition, member States should work with search engine providers so that they: ... –     explore the possibility of allowing de-indexation of content which, while in the public domain, was not intended for mass communication (or mass communication in aggregate). ...” Council of Europe Convention for the Protection of Individuals with Regard to the Processing of Personal Data of 18 May 2018 17 .     The relevant provisions of the Convention of 18   May 2018 – updating the previous Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, which was opened for signature on 28   January 1981 and came into force on 1 October 1985, ETS   108 – read as follows: Article 5: Legitimacy of data processing and quality of data “1.     Data processing shall be proportionate in relation to the legitimate purpose pursued and reflect at all stages of the processing a fair balance between all interests concerned, whether public or private, and the rights and freedoms at stake. 2.     ... 3.     Personal data undergoing processing shall be processed lawfully. 4.     Personal data undergoing processing shall be: ... b.     collected for explicit, specified and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is, subject to appropriate safeguards, compatible with those purposes; c.     adequate, relevant and not excessive in relation to the purposes for which they are processed; d.     accurate and, where necessary, kept up to date; e.     preserved in a form which permits identification of data subjects for no longer than is necessary for the purposes for which those data are processed.” Article 6: Special categories of data “1.     The processing of: ... –     personal data relating to offences, criminal proceedings and convictions, and related security measures; ... shall only be allowed where appropriate safeguards are enshrined in law, complementing those of this Convention. 2.     Such safeguards shall guard against the risks that the processing of sensitive data may present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.” Article 9: Rights of the data subject “1.     Every individual shall have a right: ... e.     to obtain, on request, free of charge and without excessive delay, rectification or erasure, as the case may be, of such data if these are being, or have been, processed contrary to the provisions of this Convention; ...” Article 11: Exceptions and restrictions “1.     No exception to the provisions set out in this Chapter shall be allowed except to the provisions of Article 5 paragraph 4, Article 7 paragraph 2, Article 8 paragraph 1 and Article 9, when such an exception is provided for by law, respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for: ... b.     the protection of the data subject or the rights and fundamental freedoms of others, notably freedom of expression.” European Union law material Directive   95/46/EC of the European Parliament and of the Council of 24   October 1995 18.     Directive 95/46/EC of the European Parliament and of the Council of 24   October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995 L   281, p.   31 (“Directive 95/46/EC”) was designed to protect individuals’ fundamental rights and freedoms (including their right to privacy) in the processing of personal data, while at the same time removing obstacles to the free flow of such data. The relevant Articles read as follows. Article 8: The processing of special categories of data “... 5.     Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgements in civil cases shall also be processed under the control of official authority.” Article 9: Processing of personal data and freedom of expression “Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.” Article 12: Right of access “Member States shall guarantee every data subject the right to obtain from the controller: ... (b)     as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; ...” Article 14: The data subject’s right to object “Member States shall grant the data subject the right: (a)     at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data; ...” Relevant case-law of the Court of Justice of the European Union relating to Directive 95/46/EC Google Spain and Google (Case C-131/12) 19 .     In its Grand Chamber judgment of 13 May 2014 in Google Spain and Google , C-131/12, EU:C:2014:317, the Court of Justice of the European Union (CJEU) was called upon to interpret Directive 95/46/EC. It found that the “activity” of an Internet search engine was to be classified as the “processing of personal data” within the meaning of Directive 95/46/EC, and held that such processing of personal data by the operator of a search engine was liable to affect significantly the fundamental rights to privacy and to the protection of personal data (as guaranteed under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, OJ 2007/C 303/01) when a search by means of that engine was carried out on the basis of an individual’s name, since such processing enabled any Internet user to obtain (through the list of search results thus attained) a structured overview of the information relating to that individual that could be found on the Internet and thereby to establish a more or less detailed profile of him or her. 20.     Furthermore, the effect of such interference on the rights of a data subject would be heightened on account of the important role played by the Internet and search engines in modern society, which rendered the information contained in such a list of results ubiquitous. In the light of the potential seriousness of that interference, it could not be justified merely by the economic interest of the operator. 21 .     The CJEU held that a fair balance had to be sought between the legitimate interest of Internet users in having access to such information and the data subject’s fundamental rights. It deemed that a data subject’s fundamental rights, as a general rule, overrode the interests of Internet users, but that that balance might, however, depend on (i) the nature of the information in question and its sensitivity as regards the data subject’s private life and (ii) the interest of the public in having that information. 22 .     The CJEU held that in certain cases the operator of a search engine was obliged to remove from the list of results displayed (following a search made on the basis of a person’s name) any and all links to Internet pages published by third parties and containing information relating to that person, even when the publication of that information on the Internet pages in question was in itself lawful. That was so in particular where the data in question appeared to be inadequate, irrelevant or no longer relevant, or excessive, given the purposes for which they had been processed and in the light of the time that had elapsed since the date of the processing in question (see Delfi AS v. Estonia [GC], no. 64569/09, § 56, ECHR 2015). GC and Others (De-referencing of sensitive data) (Case C-136/17) 23 .     In a judgment of 24 September 2019 in GC and Others (De-referencing of sensitive data) , C-136/17, EU:C:2019:773, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning four decisions delivered by the National Commission on Data Processing and Civil Liberties ( Commission nationale de l’informatique et des libertés – CNIL) refusing to serve formal notices on Google requiring it to de-reference various links appearing in the lists of results displayed following searches of their names and leading to Internet pages published by third parties. 24 .     The CJEU decided, inter alia , that information relating to legal proceedings brought against an individual (and information relating to any ensuing conviction) constituted data relating to “offences” and “criminal convictions” within the meaning of Article   8 §   5 of Directive 95/46/EC. The CJEU also ruled that the operator of a search engine was required to accede to a request for de-referencing in respect of links to Internet pages displaying such information, in the event that the information in question (i)   related to an earlier stage of the legal proceedings in question and, (ii)   having regard to the progress of the proceedings, no longer corresponded to the current situation; however, the search engine operator in question would be required to accede to a request for de-referencing only if – in the course of verifying whether there were reasons of substantial public interest, as listed in Article   8 §   4 of Directive 95/46/EC – it had been established that, in the light of all the circumstances of the case, the data subject’s fundamental rights – as guaranteed in the Charter of Fundamental Rights of the European Union by its Article   7 (“Respect for private and family life”) and Article   8 (“Protection of personal data”) – overrode the rights of potential Internet users who might have an interest that was protected by the Charter’s Article   11 (“Freedom of expression and information”). Google (Territorial scope of de-referencing) (Case C ‑ 507/17) 25.     In a judgment of 24 September 2019 in Google (Territorial scope of de-referencing) , C-507/17, EU:C:2019:772, the CJEU was called upon to interpret Directive 95/46/EC following a request for a preliminary ruling concerning the imposition by CNIL on Google of a penalty of EUR   100,000 because of that company’s refusal, when granting a de-referencing request, to apply it to all of its search engine’s domain name extensions. The CJEU was then requested to clarify the territorial scope of the requested de-referencing and to determine whether the provisions of Directive 95/46/EC required de-referencing at the national, European or worldwide level. 26.     The CJEU ruled that in the event that a search engine operator granted a request for de-referencing (pursuant to Article   12(b) and sub-paragraph   (a) of the first paragraph of Article   14 of Directive 95/46/EC and of Article   17 §   1 of Regulation (EU) 2016/679 of the European Parliament and of the Council – see paragraph 28 below), that operator would not be required to carry out that de-referencing on all versions of its search engine, but only on the versions of that search engine corresponding to all the European Union States, using, where necessary, measures which, while meeting the legal requirements, effectively prevented (or, at the very least, seriously discouraged) an Internet user from (i) conducting a search from one of the European Union member States on the basis of a data subject’s name, and (ii)   gaining access, via the list of results displayed following that search, to the links that were the subject of that request. EU national data protection authorities’ guidelines of 26   November 2014 27 .     On 26 November 2014 the domestic data protection authorities of all the European Union member States – meeting within the Article 29 Working Party (an independent European working party dealing with issues relating to the protection of privacy and personal data) – adopted a set of guidelines designed to ensure the harmonised implementation of the CJEU’s judgment of 13 May 2014 (Guidelines on the implementation of the Court of Justice of the European Union judgment on “ Google Spain and Inc. v. Agencia Española de protección de datos (AEPD) and Mario Costeja González ” C ‑ 131/12, adopted on 26 November 2014 by the Article 29 Data Protection Working Party, WP 225). The second part of the guidelines concerns common criteria which the data protection authorities were invited to apply when handling complaints following refusals by search engines to de-list search results. The thirteenth criterion reads as follows: “Does the data relate to a criminal offence? EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. DPAs will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the de-listing of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis.” The General Data Protection Regulation 28 .     Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation – hereinafter “the GDPR”), OJ 2016 L   119 p.   1, which entered into force on 24 May 2016 and repealed Directive   95/46/EC with effect from 25 May 2018. The relevant provision of the GDPR read as follows: Article 17 – Right to erasure (“right to be forgotten”) “1.     The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a)     the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; ... 2.     Where the controller has made the personal data public and is obliged pursuant to paragraph   1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3.     Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a)     for exercising the right of freedom of expression and information; ... (d)     for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph   1 is likely to render impossible or seriously impair the achievement of the objectives of that processing ...” The European Data Protection Board’s Guidelines on the criteria of the Right to be Forgotten in search engines cases under the GDPR 29 .     The Guidelines (5/2019) on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (adopted by the European Data Protection Board on 7   July 2020) read as follows in their relevant parts: 4.     ... this document aims to interpret the Right to be forgotten in the search engines cases in light of the provisions of Article 17 GDPR (the ‘Right to request de-listing’). Indeed, the Right to be forgotten has been especially enacted under Article   17 GDPR to take into account the Right to request de-listing established in the Costeja judgement [judgment of the CJEU of 13 May 2014 in Google Spain and Google , C ‑ 131/12, EU:C:2014:317]. ... 18.     According to Article 17.1.a GDPR, a data subject may request a search engine provider, following a search carried out as a general rule on the basis of his or her name, to delist content from its search results, where the data subject’s personal data returned in those search results are no longer necessary in relation to the purposes of the processing by the search engine. 19.     This provision enables a data subject to request the de-listing of personal information concerning him or her that have been made accessible for longer than it is necessary for the search engine provider’s processing. Yet, this processing is notably carried out for the purposes of making information more easily accessible for internet users. Within the context of the Right to request de-listing, the balance between the protection of privacy and the interests of Internet users in accessing the information must be undertaken. In particular, it must be assessed whether or not, over the course of time, the personal data have become out-of-date or have not been updated. ...” THE LAW ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION 30.     Under Article 10 of the Convention, the applicant alleged that the interference in his freedom of expression – namely, his right to inform the public – had been unjustified. He also complained that the penalty imposed on him had been excessive. Article 10 of the Convention reads as follows: “1.     Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. ... 2.     The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.” Admissibility 31.     The Court notes that the application is neither manifestly ill-founded nor inadmissible on any other grounds listed in Article   35 of the Convention. It must therefore be declared admissible. Merits The parties’ submissions (a)    The applicant 32.     The applicant pointed out that the criminal proceedings instituted against V.X. had still been pending at the date on which the Supreme Court’s judgment had been issued in respect of his case. Therefore, it could not be said that the period of time during which the information had remained published was excessive. Thus, V.X.’s “right to be forgotten” had never existed in the first place. 33.     The applicant submitted that the domestic authorities had not taken into account Article 99 of Legislative Decree no. 196/2003, which provided that the processing of personal data for, inter alia , “historical research purposes” ( scopi storici ) could be carried out upon the expiry of the period allowed for achieving the different purposes for which the data had originally been collected and processed. He also referred to Articles 136 and   139 of the same decree and to the above-mentioned code of ethics, which contained specific provisions regarding the protection of journalists’ freedom of expression. 34.     The applicant further submitted that he had been unjustly held liable for not having erased the article in question, since only the search engine provider (that is to say, Google Italy) had been technically capable of de-listing the article in question. 35.     The applicant also pointed out that, in cases similar to the present one, the balance between the protection of individuals’ reputation under Article   8 and the freedom of expression provided by Article 10 had been easily secured by simply requiring the publications concerned to publish supplementary information or clarifications to the articles in question. (b)    The Government 36.     The Government submitted that an adequate balance between the applicant’s freedom of expression and the right of V.X. and his restaurant to respect for his private life (and the reputation of both) had been achieved in the instant case. 37.     The Government added that the restriction in question had been prescribed by law – namely, Legislative Decree no. 196/2003, which clearly stated that the maintenance of personal data was subject to the continuing existence of the objective that had initially justified their collection and storage. The aim of journalism – namely, to contribute to public debate on matters of social, political and economic interest – should be deemed to be ongoing whenever the knowledge of certain events was still relevant to public discussion. In that regard, the Government submitted that the article had remained on the website of the online newspaper for a substantial period of time. Indeed, no information about the progress of the related criminal proceedings had been provided in the article, which had simply recounted the material events. 38 .     The Government emphasised that the fact that the applicant had been found guilty had been a consequence of the failure to de-index from the Internet search engine the tags to the article published by the applicant (which would have prevented anyone accessing the article by means of simply typing out the name of V.X. or of his restaurant). In other words, the decisions of the Italian courts had stated that the applicant should have de-indexed the article’s content, thereby making it more likely that only people who were genuinely interested in learning the facts of the matter in question would come across the article. However, the applicant had not been obliged actually to remove the article in question from the Internet archives. 39 .     Contrary to what the applicant had stated in his observations, the Government submitted that the obligation to de-index material could be imposed not only on Internet search engine providers, but also on the administrators of newspaper or journalistic archives accessible through the Internet. (c)    Third-party interveners (i)       Reporters Committee for Freedom of the Press 40 .     This intervener reiterated that the “right to be forgotten”, as recognised by the CJEU in Google Spain and Google and as stipulated by the GDPR (see, respectively, paragraphs 19 et seq. and 28 et seq. above) is aimed at providing users with the ability to request that search engines de-list or de-index the results of searches conducted on the basis of a person’s name. Within the Convention system, this right has to be weighed against the right to freedom of expression and the right to publish information – in particular when it would result in the permanent removal of news articles published by the press (see Węgrzynowski and Smolczewski v. Poland , no.   33846/07, 16   July 2013). 41.     This third-party intervener also pointed out the essential role played by the press in a democratic society, including through media websites and its establishment of digital archives. It also pointed out that the Court had found that the public’s right to be informed outweighed the “right to be forgotten” in the case of two individuals who had sought to have online media reports about their past criminal convictions anonymised (it referred to M.L. and W.W. v.   Germany , nos. 60798/10 and 65599/10, 28   June 2018). (ii)     UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression and the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights 42.     This third-party intervener argued that there was a significant distinction between de-listing and the outright erasure of content under international standards regarding freedom of expression. The conclusion that the “right to be forgotten” encompassed the right to demand the erasure of certain news content (as opposed to its mere de-listing) would almost certainly lead to censorship worldwide, and the “right to be forgotten” would be inappropriately expanded to the extent of severely jeopardising press freedom. (iii)    Media Lawyers Association 43.     The Media Lawyers Association contended that online media archives played a fundamental role in protecting and developing the rights and values enshrined in Article 10 of the Convention. The erasure of accurate information from the record ran directly contrary to the values protected by Article 10 and amounted to press censorship. Accordingly, any attempt to erase such information had to be genuinely exceptional and only justifiable where strictly necessary. (iv)   Media Legal Defence Initiative 44.     The Media Legal Defence Initiative argued that the scope of the “right to be forgotten” should not include the right to secure the erasure or the anonymisation of newspaper articles containing the personal information of individuals. In the intervener’s v