Court case 6806/2023 – Court Ruling (Italy, 2023)

The data subject was tried and convicted in a criminal proceeding. He served his sentence in prison and started a new life afterwards. He found a job, made new friends and was in a romantic relationship. After some time, his girlfriend and friends became aware of the data subject’s criminal past through an article published on an online newspaper 18 years before the facts at issue. Shocked, they decided to cut any relationship with the data subject. The data subject asked the controller the removal of the content, which was no longer necessary to pursue journalistic freedom to inform, and compensation for damages suffered due to the publication. The controller removed the article, but refused to compensate the data subject. The controller objected that it did not have an obligation to remove all the contents from its website that were no longer relevant for the public debate. The court of first instance upheld the controller’s view and rejected the data subject’s claim for damages. As the facts dated back to a time when the GDPR was not yet in force, the Court of Cassation denied that the Regulation was applicable at the facts at issue. To the contrary, Directive 95/46/EC regulated the matter. However, the legal reasoning developed by the court substantially follows the structure of Article 17 GDPR and therefore constitutes a relevant interpretation of such a provision. The Court of Cassation upheld the judgement of first instance. According to the judges, a necessary element in the right to erasure is a gap between a depiction of the data subject which is no longer updated and the current situation of the latter. This gap is assessed from the point of view of the data subject, as they are in the best position to evaluate what does no longer correspond to the present. Therefore, the right to erasure can be activated only by the explicit request of the data subject to the controller. The court also stressed that an excessively broad interpretation of the right to