Two judgments redefine the “right to be forgotten” and search engine obligations creating more confusion than certainty (originally published in Italian by PC Professionale)
In two judgments published in September 2019, the European Court of Justice ruled that the de-indexing of information from a search engine’s database can only be ordered within the country of the person concerned (Case C-507/17) and that a search engine operator is obliged, albeit with certain limitations, to de-list regardless of who originally published the information then indexed (Case C-136/17).
The first decision, the one on the “right to be forgotten”, is important because it curbs the tendency of the data protection authorities to apply the legislation in question outside national borders. The “jurisdiction” (as it is called in legal language) is, in fact, an essential instrument for the management of the relations between sovereign Countries and serves to avoid that the decisions are taken by a subject (perhaps, economically or politically stronger) automatically have effect in another Country.
In practice, before a decision of the authority, for example, Italian, can take effect abroad, it must be evaluated by a judge in the receiving country and only in the positive case can it be applied. The need for such a mechanism is evident because if there were no authority in any country, it could “invade” any other.
The problem is that the concept of “jurisdiction” was conceived for a world in which the circulation of data took place at radically different times, ways and speeds than today. And, understandably, the Italian Data Protection Authority commented on the sentence, sustaining that “in a structurally interconnected world and in an immaterial reality such as that of the network, the territorial barrier appears increasingly anachronistic”.
But precisely to maintain our freedom, it is necessary to reaffirm the existence of legal and political borders, because supporting the futility of territorial barriers is a thesis that can be supported by those who are (or think they are) the strongest and are convinced that they can apply their rules to anyone, resisting the attempt to be regulated.
In other words: without the territorial borders and the powers that the State has to protect them, who would prevent China from invoking the direct application of its rules and believe that Huawei has the right to compete for the creation of the Italian 5g infrastructure?
If therefore, the decision of the European Court is acceptable with regard to the issue of the importance of borders, it is less convincing when it climbs into a reasoning to annul the effect of the principle it has just stated.
The principle that it does not matter that a search engine is outside the EU, because if the company that operates it has subsidiaries even if only commercial ones in Europe, then they can also be punished if they do not manage the data processed by the search engine.
It may also be true that the advertising activity is aimed at “pushing” users to use a service. Still, it is also true that the material and technical fruition of the service itself takes place when the user sends the data to the USA and that, therefore, the processing starts outside the EU. Thus, in terms of the processing of personal data, the direct obligations of those who provide the service only start later and that is, for example, when information about the user is actively collected through cookies.
However, the fact remains that the legislation on the processing of personal data regulates the collection and not the “contest” or the mere “support” to the collection of data. Therefore, if the European subsidiaries do not develop (even partially) autonomous activities in the technical process of data collection and further processing, it cannot be argued that the Community legislation should also apply to them.
It is clear that the ruling of the European Court is more political than legal in nature because it forces – at least in the first instance – American multinationals to fight legal battles on this side of the ocean. But if the conflict were to escalate economically and no longer legally, for example, by imposing duties on European products, it would be a Pyrrhic victory to prevail in court.
Equally questionable is the other decision, which dictates the rules for de-listing not only to Google (direct addressee of the judgment) but also to all platforms of aggregation and sharing of third-party content.
The ruling has not spent a single word on the role and duties of those who originally published the information to make it no longer accessible. In other words: a search engine retrieves what has been made public by someone else. If this content needs to be updated to meet the “correctness” requirement, this should be primarily a legal obligation for the content creator. Imposing, on the contrary, duties on a search engine instead of forcing those who release information online to update it send the wrong message: do what you want, because someone else will be responsible for your actions.
As strong as this statement may sound, it is yet another iteration of the legal theory of “intermediary liability” that aims to shift the burden and sanctions onto the provider of electronic communications services rather than hitting the real culprit of a violation: the user.