Teutas - Diritto & Tecnologia

The sentence pronounced last 24th of February by a court in Milan, Italy, against three Google Italy managers for breach of Italian data protection law justifies the hype of recent days all around the world, both for the raised issues, as well as for the fact that the public and the international press created a great expectation on the case. The motivations of the sentence have been available since last 12th of april.

 The case: at the end of 2006, some kids recorded and then uploaded to Google Video a short film where they were taunting a disabled fellow. The film stayed a couple of months on the site, but it was removed from Google when the authorities notified the company of the abuse.

Despite this, four of the executives of Google Italy were called before the Milan court on grounds of privacy violation and complicity in the crime of defamation.

The sentence: while clearing the accused for defamation (Google has not an obligation of prior control on the contents), the sentence condemned three out of the four for breach of the Italian Privacy Code, in application of section 167 (Unlawful Data Processing) of it (Legislative Decree 196/2003). This sections states that “Any person who, with a view to gain for himself or another or with intent to cause harm to another, processes personal data in breach of Sections 18, 19, 23, 123, 126 and 130 or else of the provision made further to Section 129 shall be punished, if harm is caused, by imprisonment for between six and eighteen months or, if the offence consists in data communication or dissemination, by imprisonment for between six and twenty-four months, unless the offence is more serious.”

In particular section 23 deals with the prior consent for the treatment of sensible data: “Processing of personal data by private entities or profit-seeking public bodies shall only be allowed if the data subject gives his/her express consent”. While admitting that, according to the Code framework, the one who had to request the prior consent to the taunted kid was the uploader on the Google Video platform, the Judge evaluated if this obligation could be referred to Google video too. Does it exist an obligation for the host provider to respect -and in which extence -this law? The Judge confirms that there is not a prior control obligation (in the sense that an intermediary of the web has not the duty to control each upload-ad impossibilia nemo tenetur), but the intermediary must inform correctly those who upload files that contain personal data that they have to collect and treat those data lawfully. Sentencing this, the Judge detours the issue from breach of article 23 (prior consent) to the mere breach of article 13 of the Code. This article asks to provide a data subject, from whom data relating to himself are collected, with a privacy notice about the aims and ways the data will be treated and shared. This notice should be, according to the position of the judge, more detailed and evident in order to give the uploader a warning on the necessity of the prior consent. Google took advantage from the substancial lack of this preliminary notice and so it is guilty.

The sentence opened a wide discussion in Italy. From what described above, it is evident the motivation is not perfectly coherent. As remarked by the lawyer of Google managers on teutas.it, the judge argues on article 167 while the article he assumes breached is 13, that is not mentioned in article 167. In case, he should have mentioned another article of the Code, section 161 that states an administrative sanction for “Providing No or Inadequate Information to Data Subjects (Breach of the provisions referred to in Section 13 shall be punished by a fine consisting in payment of between six thousand and thirty-six thousand Euro).

Anyway, a so tough punisment like imprisonment is definitely not reasonable for this kind of behaviour.

As remarked by the President of the Italian Authority for Data Protection, Francesco Pizzetti, in his interview to Vittorio Zambardino (Repubblica.it) this ruling has “lights and shadows”. In fact, the judge underlines many times that Google has not the duty to control the contents of the uploads and tries to find a balance between avoiding an obligation of control of the content by the intermediary of the web- because that would undermine the democratic utility of the network-and avoiding to rely entirely on user liability for unlawful processing of data.

Google has a peculiar role in contemporary society: somehow in many countries this firm has assumed a “freedom saviour” role, while it is and remains a big, wealthy and ubiquitous commercial body. As told by Francesco Pizzetti, this Vividown-Google case must not give Italy an international image that is unfounded, given the nature of the sentence; at the same time it is prudent to avoid giving Google on a “silver plate” the role of freedom defendant while it defens only its business.

---

Aggiungi questo articolo ai tuoi social bookmarks preferiti