Google – Complaint Upheld (Italy, 2025)

On 21 March 2024, the data subject submitted a request to Google LLC invoking the right to be forgotten under Article 17 GDPR, seeking removal of eight URLs linking his name to press reports about a 2015–2020 criminal case involving extortion and fraudulent bankruptcy. The criminal proceedings against the data subject had concluded in 2020 with a two-year sentence following a plea bargain. The data subject argued that continued indexing of those articles, five years after the judgment, violated his right to erasure under Article 17 GDPR as they no longer served any public or social interest. Google rejected the request, maintaining that the material remained of public relevance given the seriousness of the offences, their organised-crime context, and the complainant’s ongoing professional activity in similar sectors. On 24 May 2024, the data subject filed a formal complaint with the DPA under Article 77 GDPR. The complainant argued that his role in the criminal case had been marginal, and that persistent indexing of his name caused reputational harm. The DPA examined the complaint under Articles 17(1)(c) and 21(1) GDPR, applying the balancing criteria established in the WP29 Guidelines (2014) and EDPB Guidelines 5/2019. It as noted that Google had already de-indexed four URLs mentioned in the complaint and therefore found no basis for further action regarding them. As to the remaining links, the DPA held that two of the URLs concerned recent, accurate reports about a criminal case of ongoing public importance tied to organised-crime infiltration in the Veneto region and that the data subject was an emblematic participant in that context. The data subject's continuing professional activity in related sectors further supported the public interest factor. Accordingly, the request to delist these URLs was rejected. Two other URLs were found to lack sufficient public-interest justification. One referred only to early-stage investigations, while the other reproduced a