By: Maura Migliore
It seems that the “right to be forgotten” doesn’t want us to forget about it soon. An important sequel of the Court of Justice of the European Union (CJEU) judgment in the case Google Spain v. AEPD and Mario Costeja González (Google Spain case) comes from Italy, one of the most pro-privacy countries in the European Union (EU).
The Italian Data Protection Authority (Autorità Garante per la Protezione dei Dati Personali – Italian DPA) has recently decided a case concerning the so called “right to be forgotten” (diritto all’oblio) not only in relation to links listed by Google as search results but also in relation to “snippets”, i.e. short abstracts which often appear below such links. The snippet is a tool that helps the web user when choosing which links to click on after doing a search on Google. It thus gives a hint of the searched subject matter even before the user accesses the websites resulting in the search page from the user’s search terms.
The Italian RTBF case facts
In the case in question, an Italian citizen (his name is unknown, so let’s call him Mr. Rossi) asked Google to de-list from the results of online searches based on his name the link to a local newspaper’s article (http://www.tarantobuonasera.it), which reported investigations of a criminal case. Following Google’s refusal to comply with his request, Mr. Rossi complained to the Italian DPA. In addition, he claimed that, had his request of de-listing not to be met, he was at least entitled to the removal or rectification of the short extract of the newspaper article (snippet) that appeared in the search results page, which associated Mr. Rossi’s name to the above mentioned criminal investigation carried out against a third party (this investigation also led to the application of precautionary measures).
According to Mr. Rossi, the snippet – resulting from a search based on his name – was “extremely misleading and highly detrimental to him” since he had an “absolutely marginal position” in that criminal proceeding. In other words, the snippet could mislead people into believing that Mr. Rossi was under investigation for those “serious crimes”, which were actually associated by the investigative authority only to the third party.
Unfortunately the decision of the Italian DPA does not provide further details of the case. In particular, it does not specify which criminal allegations were brought against the third party and which ones (if any) were brought against the claimant. These factual details could be helpful to understand to what extent the snippet could have been inaccurate and therefore misleading. In any case, it seems that the local newspaper’s article focused on the third party, who was suspected of being in charge for the main crime, rather than on Mr. Rossi, who was suspected of having played a much minor role. In fact, Mr. Rossi’s role was only incidentally reported in the published article.
Google defended its refusal to de-list the link to the newspaper article by asserting that the facts reported were still news, namely they were recent facts and it was in the public interest to inform people about such an important criminal investigation.
With regard to the snippet, Google claimed that it is generated automatically by a specific algorithm using the information contained in the webpage that better meets the web user’s query (among all the search results). Therefore, there is absolutely no human intervention within Google searches, particularly in the choice and editing of the snippets’ contents.
However, the argument of “automated decision” does not seem to be a valid reason for refusing to rectify the snippet, since data protection precisely covers partly or wholly automated data processing, regardless of any human intervention (and the CJEU has clearly recognized Google Search as data controller in the Google Spain case). Anyway, Google voluntarily removed the snippet in question at a later stage – but prior to the DPA’s decision. Did they realize the weakness of their argument? Or did they simply prefer to meet the claimant’s wish, since they had nothing to gain from refusing to do so?
The Italian DPA’s decision
“[the news reported by the local newspaper was] absolutely recent and in the public interest, since it concerns an important investigation on many persons, although it is limited to a local area.” (free translation)
With regard to the snippet, the Italian DPA decided to pronounce on Mr. Rossi’s request of removal/rectification, notwithstanding Google’s voluntary removal of the snippet. In this sense, it stated that the snippet must be treated separately from the indexed link to which it refers.
According to article 7 of the Italian Data Protection Code (Codice per la Protezione dei Dati Personali, D.Lgs. n. 196/2003), the data subject has the right to ask for rectification, integration or update of data relating to him, to the extent that he provides the reasons for such request. In light of this provision, the Italian DPA declared that Mr. Rossi was entitled to demand that:
“[the snippet] does not generically associate – by means of the automatic elaborations of the search engine – his name to the main facts of the article (summarized in the title of the article), regardless of the facts reported within the article and specifically concerning [Mr. Rossi].” (free translation)
Therefore, the snippet must report information in an accurate manner. The fact that algorithms instead of humans generate it does not justify its untruthfulness or deceptiveness and does not exempt the search engine from the obligation to rectify it upon specific request from the data subject, on the ground of inaccuracy or incompleteness.
Food for thought
The Italian DPA’s decision seems to be consistent with the CJEU decision on the Google Spain case. There is a fundamental difference between the request of de-listing links from the search results and the request of rectifying the resulting snippet. While in the former, the rights to privacy and data protection will often conflict with the freedom of expression, which encompasses the interest of the public to be informed (as the case in question shows); in the latter the rights to privacy and data protection (including the right to rectify incorrect information) fits well with the interest of the public of being properly and accurately informed. Although Google’s claim that the snippet is not intended to be a means of information, it is in the public interest that the abstract shown in a search result does not mislead the web users in their process of choosing which search result to click on. A wrong snippet may cause bias or even induce some web users to consider its content as fully informative, thus possibly damaging the data subject concerned.
However, the decision of the Italian DPA raises at least one concern. The search engine is bound to rectify the snippet whenever it is asked to do so by the data subject, provided that it finds the request justified. As in Google Spain, one may ask whether the search engine is truly able to accomplish such request and ensure that the snippet conveys correct information of public interest.
There is no doubt that the search engine must recur to some kind of human intervention in order to edit the snippet (this clearly cannot be left to algorithms). In turn, this means that the search engine becomes a publisher/journalist to a certain extent, by choosing the content of an abstract about a person. This seems to be at odds with the principle of distinction between publisher and search engine that has been emphasized by the CJEU in the Google Spain case.
The question is: do we really want Google to choose/edit the snippet about us? Moreover, even if it does so after being requested, will we be happy with the way it edits the snippet about us? Most importantly, is Google truly willing to edit that kind of content? As the Italian case in question shows, it seems that Google prefers to simply remove the snippet, thus making the claimant happy. Google must have thought that, at the end of the day, a snippet is not a great loss for the public.