Google – Dismissed (Italy, 2025)

In February 2024 a serving police officer (the data subject) exercised his right to be forgotten under Article 17 GDPR by requesting Google (the controller) to de-index 13 URLs. The URLs contained reports of a 2017 criminal case in which he had initially been convicted of stalking, property damage, and defamation. The stalking charge was later overturned on appeal but the convictions for property damage and defamation were upheld, resulting in a suspended sentence of 1 year and 5 months. The data subject argued that the continued indexing of his name alongside these reports was excessive and disproportionate, given the elapsed time, his acquittal on the most serious charge, and the harm to his reputation and private life. The Controller initially refused the request, citing the public’s right of access to lawfully published information. The data subject then filed a complaint in March 2024. During the proceedings, the controller reviewed the information and de-indexed 11 URLs- leaving 2 URLs indexed. The controller held that it could lawfully index the last two URLs, for several reasons: * they were factually accurate; * they were up to date, as they reported that the data subject was cleared from the stalking charge; * the data subject's role as a public officer meant that the information in the URLs was of public interest. The DPA clarified that the right to be forgotten must be balanced against the public's right to access information. In this case, the DPA held that there was a general interest in the information about the data subject's criminal charges due to the data subject's status as a public officer. The DPA also considered that the two remaining URLs were both accurate and up to date, as the controller pointed out. On these grounds, the DPA held that the controller rightfully refused to de-index the two remaining URLs and dismissed the complaint.