# data[].attributes.body
Excelent contributions everyone! thank you for being so active and commited to the course! thank you for being part of theis MOOC and thank you for sharing all of this great recsources, and for sharing your thoughts!
-Nexus team-

# data[].attributes.body
Put it in simple words, the right to be forgotten (or right to erasure) “entitles individuals to request that search engines delist URLs from across the internet that contain “inaccurate, inadequate, irrelevant or excessive” information surfaced by queries containing the name of the requester”. Within the EU law framework (art. 17 GDPR), this right is increasing “its specific weight in balancing with other conflicting rights”. Thus, it is not an absolute right.

The article carries out a brief analysis of the evolution of this right and the main controversies born during the years.

I found it important because this right is part of the GDPR which, as we all know, is the current EU legislation on data protection.
erica_t

# data[].attributes.attachment_link.readable_text
Over the past few years there has been a natural tendency to associate specifically Google with the evolution of the Right to be Forgotten and the consequences related thereto. This tendency is fundamentally based on a variety of different circumstances that influenced both the world's biggest tech giant and the new balance between the free dissemination of information and individual self-determination.

The premise is that any processing of personal data may determine advantages and disadvantages with regard to individual and social interests protected by the law. In simple terms, the Right to be Forgotten entitles individuals to request that search engines such as Google, Bing, and Yahoo delist URLs from across the Internet that contain "inaccurate, inadequate, irrelevant or excessive" information surfaced by queries containing the name of the requester. Critically, the ruling requires that search engine operators make the determination for whether an individual's right to privacy outweighs the public's right to access lawful information when delisting URLs.

It is clear that, although there is no authentic hierarchy of rights, depending on the context some may be predominant over others. The importance attached to a specific right and the importance of preventing its limitation is determined in accordance with the fundamental understanding in that society. In this regard, although it cannot be - and will never be - qualified as an absolute right, the Right to be Forgotten has been able to exploit fertile ground in the European legislation and to gain equal weight in EU framework as the right to information.

As a matter of fact, due to the entry into force of the Regulation (EU) 2016/679, the Right to be Forgotten has seen an increase of its specific weight in balancing with other conflicting rights such as the right to freedom of expression. Actually, the "right to erasure" is not a new concept in EU Data Protection law. Under Article 12 b) of the Directive (EC) 1995/46, individuals were given a right to ask controllers to erase or block their personal data where its processing was not compliant with the provisions of the Directive and particularly where it was incomplete or inaccurate. However, the fact that such a right is now further legitimized by a specific provision within one of the most relevant pieces of legislation in our recent history, has made its importance definitely more perceptible.

What all this means is that the rights of individuals in the GDPR can come into conflict with the rights to freedom of expression and access to information. Beyond the GDPR, these rights are granted by the European Convention on Human Rights and the EU Charter of Fundamental Rights.

Considering the other side of this coin, it is common knowledge that Google has unintentionally assumed an ever-growing role in this setting. Especially since the 2014 European Court of Justice ruling in the Costeja Gonzalez case, the natural evolutionary path of the Right to be Forgotten has always been linked to Google. From then on, the American multinational tech company found itself unwillingly handling an incredible number of requests related to this right and aimed at obtaining the deindexing of certain contents.

Just to get an idea of the numbers we are talking about, in a company research paper released in February 2018 Google said that in all it received requests to remove more than 2.43 million URLs since the end of May 2014, and it has removed about 43% of them. During the next three and a half years, until the end of 2017, almost 400,000 requesting entities were reported. In the past two years, celebrities requested more than 41,000 delistings and politicians and government officials requested almost 34,000.

The processing of each delisting request is not automated - it involves individual consideration of every request and implies human judgement. Without such an individual assessment, the procedure put in place by Google would be open to substantial abuse, with the prospect of individuals, or indeed businesses, seeking to suppress search results for illegitimate reasons. Moreover, it would be a violation of the provisions set forth by Article 22 of the GDPR according to which the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

In view of all the above, Google has managed to invest money and devote human resources to guarantee that each and every single request is duly evaluated. Things that the tech giant takes into account are "the nature of the offence, the sentence imposed, the time which has passed since the conviction, and the relevance of the information to the requestor's business or professional life".

Notwithstanding the utmost importance of Google Spain, which indeed automatically comes to mind when talking about this kind of issues, it must be stressed that also the jurisprudence of the Court of Justice of European Union has seen a great evolution in the last few years and has managed to define better the vague boundaries of the Google Spain case. Indeed, in that occasion the Court actually had to pull the strings of the existing legislation to be able to attribute the duty of the search engine operator to take into consideration the requests of the interested parties and, further, to balance the public interest with the individual one. Most recently, in September 2019, the CJEU had the chance to clarify the situation with two extremely significant decisions, immediately recognized as landmark cases.

With reference to the first one, it relates to case C-507/17 between the French Authority for the Protection of personal data (Commission Nationale de l'Informatique et des Libertés - CNIL) and Google Inc. and concerns the territorial scope of the deindexing. The interpretative question that the French Council of State referred to the CJEU was whether, when a search engine operator accepts a request for deindexing, it is required to perform said deindexing on all versions of its search engine or only on that corresponding to the Member State of residence of the beneficiary of the deindexing (in this case, only on Google.fr), or again on all those of the member countries (Google.it, Google.de, Google.eu, etc.).

In this regard, the CJEU clarified that currently there is no obligation - deriving from the EU law - for a search engine operator that accepts a delisting request submitted by the interested party to carry out such deindexing on all versions of its engine. However, the delisting must be done in the search engine versions of all EU member states. In addition, the operator must adopt measures to prevent, or at least seriously discourage users, from accessing the links removed in the European versions, through an "extra EU" version.

Basically, the abovementioned decision has established that there is no obligation for a search engine to apply the Right to be Forgotten globally. Therefore, while EU citizens actually are entitled to ask for the right to erasure according to Article 17 of the GDPR, said right only applies within the boundaries of the European Union, meaning the bloc composed by the 27 Member States.

Obviously, this decision has also been subject to some criticism, particularly from those who believe that when information is available elsewhere, one needs not to travel to access it. By way of example, when a content is blocked in a specific EU Member State because of GDPR rules, one could simply change his/her VPN location to a non-EU country and have immediate access. According to this view, the notion of geography determining access and privacy right, given current technology of VPN for starters, makes a mockery out of legal data protections.

Truth is that the above described ruling could be seen as a victory for global freedom of expression. Courts or data regulators in the UK, France or Germany should not be able to determine the search results that Internet users in America, India or Argentina get to see. Probably it would not be right that one country's data protection authorities can impose their interpretation on Internet users around the world.

The Court stated that the balance between privacy and free speech should be taken into account when deciding if websites should be delisted - and also to recognise that this balance may vary around the world. Further, the CJEU underlined the limits of a "global approach". Since the right to privacy and data protection are not absolute rights, they need to be balanced with other fundamental rights, among which the right to freedom of expression and the GDPR does not aim to strike a fair balance between fundamental rights outside the territory of the Union.

The second case (C-136/17), which seems to have received less attention from the media, arises from another reference made by the French Council of State in relation to four appeals that concerned, in one way or another, the processing of sensitive data by search engines. The Court reiterated that the indexing activity carried out by search engine operators must be considered "processing of personal data" and therefore subject to the limitations currently provided for by the GDPR, and previously by Directive (EC) 1995/46, as regards the treatment of sensitive data.

Consequently, a search engine operator must, in principle, accept requests for delisting regarding web pages where sensitive personal data appear, unless such links prove to be strictly necessary to protect the freedom of information of Internet users potentially interested in having access to web pages containing sensitive data.

For what concerns judicial data, the search engine operator is required to accept a request for deindexing towards web pages that contain information that is no longer current (for example, they inform about a conviction at first instance of a person later acquitted on appeal), unless that the public role played by the person, the seriousness of the crime and other circumstances do not make the public interest in knowledge prevalent. If the search engine operator considers the public interest in information as prevalent - and therefore the links should not be removed - he will still have to "arrange the list of results in such a way that the resulting overall image for the Internet user reflects the current legal situation". In other words, the algorithm will have to sort the results not based on their popularity, but on the topicality of the information.

These are the most recent but certainly not the last steps that will trace a story destined to last a long time and whose ending, to date, seems to be still far far away.

G. Sartor, The right to be forgotten: balancing interests in the flux of time, International Journal of Law and Information Technology (Nov. 2016)

A. Barak, Proportionality and Principled Balancing, Law & Ethics of Human Rights, Vol. IV (2010)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Regulation (EU) 2016/679, Article 17 - Right to erasure ('right to be forgotten')

C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.

T. Bertram, Three years of the Right to be Forgotten, (Feb. 2018)

G. Corfield, Here is how Google handles Right To Be Forgotten requests, The Register (May 2018).

C-507/17, Google LLC, successor in law to Google Inc., v Commission nationale de l'informatique et des libertés (CNIL)

G. De Gregorio, Google v. CNIL and Glawischnig-Piesczek v. Facebook: content and data in the algorithmic society, MediaLaws, (Mar. 2020)

C-136/17, GC, AF, BH, ED v Commission nationale de l'informatique et des libertés (CNIL), interveners: Premier ministre, Google LLC, successor to Google Inc.

# data[].attributes.attachment_link.title
Google and the Right to be Forgotten: brief summary of a never-ending story

# data[].attributes.attachment_link.description
Over the past few years there has been a natural tendency to associate specifically Google with the evolution of the Right to be Forgotten and the consequences related thereto. This tendency is fundamentally based on a variety of different circumstances ...

# data[].attributes.body
I came across this page to inform California residents about a new law to protect personal information. The so-called 'solution' is to make parents fill out tons of forms called 'Do Not Sell requests' so companies like Whatsapp may let them request to ask the deletion of their conversations from their servers - even then, only from the previous 12 months. I wonder how much conversation was initiated with residents prior to this law has taken effect. A custom form example: https://www.commonsensemedia.org/sites/default/files/uploads/pdfs/blank_consumer_request-spanish-bilingual.pdf

# data[].attributes.attachment_link.title
CCPA: Protect Your Privacy | Common Sense Media

# data[].attributes.attachment_link.description
Protect your family's data privacy with an important privacy law, the California Consumer Privacy Act (CCPA). Make a Do Not Sell request to companies like Snapchat and TikTok.

# data[].attributes.body
In Italy the theme of privacy is seriously considered. For this reason exists a Data Protection Authority that works to defend personal data. However, our presence online can't always been protected. It's necessary that big companies and governments improve their security systems.

# data[].attributes.attachment_link.authors[].name
Garante per la protezione dei dati personali

# data[].attributes.attachment_link.title
“I tuoi dati sono un tesoro”: il video del Garante per raccontare cos’è la privacy

# data[].attributes.body
For this module I went to check the law on online privacy in my country, since I never did it before. My goal through this course is to continue to get deeply informed about this issue and spred it to people around me.

# data[].attributes.attachment_link.readable_text
Back to Online Privacy Law
* A 2017 updated version of this report is available

The right to privacy, which encompasses the right to the protection of the individual's personal data, was first recognized by the Italian courts in the 1970s, and was then acknowledged by the legislature. In 2003, the Personal Data Protection Code, which implements EU Directives on data protection and on privacy and electronic communications, was adopted. The Code governs all types of data processing, including online data processing. The main purpose of the Code is the general prohibition of the collection, storage, and use of personal data, unless the data subject has given his or her prior informed consent. Transparency is ensured by the adoption of codes of conduct and professional practice by service providers, and by the general duty of providing adequate information to data subjects. Security is guaranteed through the imposition of the "minimum safety measures" standard. In addition to the right to be informed, data subjects are entitled to several other rights, including the right to object to the processing of the data concerning them or to obtain the updating, correction, integration, or erasure of such data. Spamming is prohibited unless the subscriber or user has given his or her consent. A supervisory authority is tasked with verifying compliance of data processing with laws and regulations, responding to data subjects' complaints, and blocking unlawful or unfair data processing operations. Administrative, nonjudicial, or judicial remedies to protect rights of data subjects are foreseen. Presently, no proposals for reforming the current legislation have been presented.

I. Legal Framework

The Italian Constitution contains no express guarantee of the right to privacy.[1] The jurisprudential debate over its existence began in the 1950s, but it was only in 1973 that the Constitutional Court[2] expressly acknowledged privacy as a right,[3] followed by the Court of Cassation two years later.[4]

Initially, the right to privacy protected a person's private life and domicile; over time, as technology evolved, it was extended to protect the ability of individuals to determine what sort of information about themselves is collected and how that information is used.[5]

The first law dealing specifically with the issue of data protection was enacted in 1996,[6] in order to implement EU Directive 95/46 on Data Protection.[7] This act was then repealed and replaced in 2003 by the Codice in Materia di Protezione dei Dati Personali (Personal Data Protection Code, hereafter referred to as the Code),[8] which implements both EU Directive 95/46 on Data Protection and Directive 2002/58 on Privacy and Electronic Communications.[9] The Code expressly recognizes the existence of a right to personal data protection.[10]

As of this writing, no specific laws or regulations regulate location data or smartphone applications.

II. Current Law

The Personal Data Protection Code governs all kinds of data processing, including online data processing.[11] The provisions of Title X are, however, dedicated specifically to some aspects of the processing of personal data in connection with electronic communications.

The definition of electronic communications is given in the introductory part of the Code, where it is stated that this expression "shall mean any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service."[12]

A. Subject Matter and Scope of Application

The provisions of the Code apply to providers of electronic communications services, subscribers, and users. While no definition is given for providers, the Code specifies that a subscriber "shall mean any natural or legal person, body, or association who or which is party to a contract with the provider of publicly available electronic communications services for the supply of such services, or is otherwise the recipient of such services by means of prepaid cards."[13] A user, on the other hand, is "a natural person using a publicly available electronic communications service for private or business purposes, without necessarily being a subscriber to such service."[14] The distinction between subscriber and user extends the protection offered by the Code to those who occasionally use an electronic communications service without having signed a contract with the service provider (e.g., those using their friend's computer or a hotel guest using a hotel Internet connection).[15]

As to the scope of application, the Code applies to the "processing of personal data, including data held abroad, where the processing is performed by any entity established either in the State's territory or in a place that is under the State's sovereignty."[16] It also applies when the processing "is performed by an entity established in the territory of a country outside the European Union, where said entity makes use in connection with the processing of equipment, whether electronic or otherwise, situated in the State's territory, unless such equipment is used only for purposes of transit through the territory of the European Union."[17]

B. Data Processing

Title X of the Code begins with a general prohibition against using "an electronic communications network to gain access to information stored in the terminal equipment of a subscriber or user, to store information or monitor operations performed by a user."[18] In fact, terminals are considered to be an integral part of the private sphere of the individual, and are thus protected by the right to privacy.[19]

The general prohibition on collection, storage, and use of personal data is subject to only one exception: for specific, legitimate purposes, the service provider may store information in order to transmit a communication or provide a specific service as requested by a subscriber or user; however, such technical storage cannot last longer than is strictly necessary and "the subscriber or user must give his or her consent based on prior information, whereby the purposes and duration of the processing shall be referred to in detail, clearly and accurately."[20]

Location data, which indicate the geographic position of the terminal equipment of a user,[21] may only be processed when they are made anonymous;[22] otherwise, it is necessary for the data subject to give his or her prior consent, which may be withdrawn at any time. In both cases, the data may be processed "to the extent and for the duration necessary for the provision of a value-added service."[23]

Traffic data, which are those data necessary for the "purpose of the conveyance of a communication on an electronic communications network or for the billing thereof,"[24] must be either erased or made anonymous when they are no longer necessary for the purpose of transmitting the electronic communication.[25]

C. Data Retention

The Code stipulates that service providers should retain traffic data for two years "with a view to detecting and suppressing criminal offenses."[26] Within that term, the data may be acquired from the provider "by means of a reasoned order of the judicial authority at the request of either the public prosecutor, defense counsel, the person under investigation, the injured party, or any other private party."[27] The Ministry of the Interior as well as the police may request the service provider to "keep and protect traffic data" for up to ninety more days for "purposes of investigation and suppression of crimes."[28] Nonetheless, data processing "shall be carried out by complying with the measures and precautions to safeguard data subjects."[29]

D. Transparency

In order to ensure transparency, the Code provides that the supervisory authority, the Garante per la Protezione dei Dati Personali (Data Protection Authority, discussed in Section III of this report), "shall encourage the adoption of a code of conduct and professional practice applying to the processing of personal data" by service providers, in order to "ensure and streamline adequate information and awareness by users of public and private electronic communications networks as to the categories of personal data processed and the mechanisms for such processing-in particular, by providing information notices online using simple means and in an interactive manner."[30]

Even in the absence of such a code of conduct, the subscriber or user is protected by the general provision of article 12, according to which the service provider must preliminarily inform the data subject,

either orally or in writing, as to the purposes and modalities of the data processing; the obligatory or voluntary nature of providing the requested data; the consequences if he or she fails to reply; the entities or category of entities to whom or which the data may be communicated, and the scope of dissemination of said data; his or her rights; the identification data concerning the data controller; and, where designated, the data controller's representative in the State's territory and the data processor.[31]

E. Security

In order to ensure "security of its services and integrity of traffic data, location data, and electronic communications against any form of unauthorized utilization or access," the service provider shall take "all suitable technical and organizational measures that are adequate in light of the existing risk."[32] Moreover, in case of a particular risk of a breach of network security, the provider shall inform subscribers and users of said risk and the possible remedies.[33]

According to the Code, the minimum security measures that a service provider may adopt include

1. a) computerized authentication;

2. b) implementation of authentication credentials management procedures;

3. c) use of an authorization system;

4. d) regular update of the specifications concerning scope of the processing operations that may be performed by the individual entities in charge of managing and/or maintaining electronic means;

5. e) protection of electronic means and data against unlawful data processing operations, unauthorized access, and specific computer programs;

6. f) implementation of procedures for safekeeping backup copies and restoring data and system availability;

7. g) keeping an up-to-date security policy document;

8. h) implementation of encryption techniques or identification codes for specific processing operations performed by health-care bodies in respect of data disclosing health and sex life.[34]

F. Data Subjects' Rights

The Code provides that data subjects "have the right to obtain confirmation as to whether or not personal data concerning [them] exists."[35] They also have the right to be informed of the source of the personal data, the purposes and methods of the processing, the identification data concerning data controller and data processors, and the entities to whom the personal data may be communicated.[36] Once they have been so informed, data subjects have the right to object, in whole or in part, to the processing,[37] and also to obtain updating, correction or integration, erasure, anonymization, or blocking of such data.[38] All these rights may be exercised simply by making a request to the data controller or processor without formalities, and the processor must reply without delay.[39]

G. Spamming

The Code regulates the practice of spamming, stating that the use of automated emails without human intervention "for the purposes of direct marketing or sending advertising materials, or else for carrying out market surveys or interactive business communications, shall only be allowed with the subscriber's consent."[40]

H. Minors

No specific provisions exist in the Code or elsewhere as to the specific issue of online privacy for minors. The general rules of the Code therefore apply.

I. Remedies

If a provision of the Code is violated, data subjects may choose among three kinds of remedies to protect their rights: administrative,[41] nonjudicial,[42] and judicial.[43]

In the case of administrative remedies, the data subject may lodge a claim of infringement with the national data protection authority, the Garante. No specific formalities are required. The claim must contain as many details as possible.[44] As long as the claim is not found to be manifestly groundless, the Garante may take different actions:[45] the data controller may be asked to block the processing of their own initiative, or an order may be issued for the data controller to take such measures as are necessary or appropriate to bring the processing into line with the provisions in force.[46] If the service provider fails to comply or if there is an actual risk of a considerable prejudice to one or more of the data subjects, the Garante may also block or prohibit the processing. The same will happen if such processing is in conflict with a substantial public interest.

Nonjudicial remedies are also offered by the Garante. If data subjects have not yet brought an action before a judicial authority, they may protect their rights by filing a complaint with the Garante[47](once such a complaint is lodged, data subjects cannot change their minds and seek a judicial remedy).[48] The Garante gathers the necessary information relevant to the complaint and, if it is well-founded, may order the data controller to abstain from the unlawful conduct, and may also specify the remedies to enforce the data subject's rights and set a term for their implementation.[49] If no decision is rendered within sixty days of the date on which the complaint was lodged, the complaint must be regarded as dismissed.[50] The decision or tacit dismissal of the Garante may be challenged before the judicial authorities.[51]

Finally, the data subject may choose to file a lawsuit at the Civil Court, and the petition may be granted or dismissed, in whole or in part. The court may also order the necessary measures; provide for damages, if claimed; and award legal costs to the losing party.[52] Appeal against the judgment is not possible; however, it may be challenged before the Court of Cassation.[53]

J. Sanctions

Violations of the Code are punishable with sanctions that, according to the nature of the violation, may be either administrative or criminal, and are specific to each violation.[54] For instance, in the case of no or inadequate information provided to data subjects, the service provider may be punished with a fine of between three thousand and eighteen thousand euro (about US$3,700 to $22,255); the amount may be increased up to three times if it is found to be ineffective on account of the offender's economic status.[55] Another example is unlawful data processing, which may be punished, if harm is caused, with imprisonment of up to twenty-four months.[56] Finally, failure to adopt security measures may be punished either with detention for up to two years or with a fine of up to fifty thousand euro (about US$61,820).[57]

III. Role of Data Protection Agencies

The Garante per la Protezione dei Dati Personali (Data Protection Authority) was instituted by Law 675/96 in order to ensure lawful data processing and the respect of people's fundamental rights.[58] It is an independent and autonomous collegiate body composed of four members, two of whom are elected by the Chamber of Deputies and two by the Senate from among "persons ensuring independence and with proven experience in the field of law or computer science."[59] The elected members hold office for four years, and the appointment may be renewed only once.[60] Under penalty of losing office, they cannot carry out professional or advisory activities, manage or be employed by public or private entities, or hold elective offices.[61]

The tasks of the Garante are described in article 154 of the Code and include the following:

Verifying whether data processing operations are carried out in compliance with laws and regulations

Receiving reports and complaints

Ordering data controllers or processors to adopt such measures as are necessary or appropriate for the processing, to comply with the provisions in force

Prohibiting unlawful or unfair data processing operations, in whole or in part, or blocking such processing operations

Drawing the attention of the Parliament and government to the advisability of legislation

Issuing opinions whenever required

Raising public awareness of the legislation governing personal data processing and its relevant purposes, as well as of data security measures

IV. Court Decisions

As discussed in the first section of this report, the right to privacy was first recognized by the courts. After World War II, the courts were forced to take affirmative steps toward the protection of a person's private life in order to answer the challenges of technological evolution, as the legislature did not want to intervene.

From the 1950s until the first half of the 1970s, there was a clear contrast between the decisions of the Tribunals of First Instance and those of the Appellate Courts: the former recognized the right to privacy, while the latter refused to acknowledge it.[62] An example of this contrast can be found in the well-known Caruso case.[63] Caruso was a famous opera singer; after his death, his heirs asked the Tribunal of Rome to protect his private life by barring the disclosure of certain indiscretions that would have harmed his privacy and memory.[64] The Tribunal rendered an innovative decision, recognizing the existence of a right to privacy, which implied the prohibition of intruding into someone's private sphere.[65] Nonetheless, the Court of Appeals[66] and then the Court of Cassation[67] reversed the decision rendered by the Tribunal, stating that the simple desire for privacy alone could not be protected by the law.[68]

It was only in 1975 that the Court of Cassation finally acknowledged the existence of the right to privacy, stating that "a general right to privacy is deemed to exist in our legal system, a right protecting strictly personal and domestic situations [from disclosure] if not justified by preeminent public interests."[69] This case opened the way for a series of decisions confirming the right to privacy. There were no landmark cases; rather, the courts, with their intense activity, built a path that, decision after decision, led to the adoption of Law 95/46, followed by the Personal Data Protection Code. After these laws were enacted, there was a sudden slowdown in the jurisprudential activity; as of this writing, no decision has yet been rendered with regard to online data protection.

V. Public and Scholarly Opinion

The Personal Data Code has been well received both by the public and by legal scholars. According to Sabina Kirschen, a scholar of civil law, "the undeniable complexity of the subject . . . has forced the legislature to intervene and transform the multitude of existing rules into an organic law," which "represents an important accomplishment in the history of Italian privacy law, as well as a foundation on which to build its future."[70]

Another civil law scholar, Silvia Melchionna, praised the ability of the Code to finally "simplify the interpretation of the provisions about personal data protection."[71]

The provisions of the Code that deal with electronic communications have been particularly popular, principally because of the "comprehensive protection it gives to consumers . . . by specifying the duties of service providers and giving value to the rights of users," according to an Italian jurist and former member of the Garante, Giuseppe Santaniello.[72]

VI. Pending Reforms

As of this writing, no proposals have been presented to reform the current legislation concerning online privacy.

Prepared by Laura Andriulli
Law Library Intern
under the supervision of Nicole Atwill
Senior Foreign Law Specialist
June 2012

[1] GIUSEPPE CASSANO, DIRITTO DELLE NUOVE TECNOLOGIE INFORMATICHE E DELL'INTERNET [NEW INFORMATION TECHNOLOGY AND INTERNET LAW] 128 (Ipsoa, 2002).

[2] Corte di Cassazione [Cass.] 12 aprile 1973, n. 38, Corte Costituzionale [Corte Cost.], 1973, I, 354.

[4] Cass. 27 maggio 1975, n. 2129, Giurisprudenza Italiana [Giur. it.], 1976, I, 1, 970.

[5] ROCCO PANETTA, LIBERA CIRCOLAZIONE E PROTEZIONE DEI DATI PERSONALI [FREEDOM OF MOVEMENT AND PERSONAL DATA PROTECTION] 6 (Giuffrè, 2006).

[6] Legge 31 dicembre 1996, n. 675, GAZETTA UFFICIALE DELLA REPUBBLICA ITALIANA [G.U.] 8 gennaio 1997, n. 5.

[8] Decreto Legislativo [D. Lgs.] n. 196 del 30 giugno 2003, G.U. 29 luglio 2003, n. 174.

[12] Art. 4.2 C.m.p. (all Code translations by author).

[18] Art. 122 C.m.p.

[20] Art. 122 C.m.p.

[22] Art. 126 C.m.p.

[25] Art. 123 C.m.p.

[26] Art. 132.1 C.m.p., as amended by D. Lgs. 30 maggio 2008, n. 109, G.U. 18 giugno 2008, n. 141, implementing Directive 2006/24/EC.

[27] Art. 132.3 C.m.p.

[28] Art. 132.4 C.m.p.

[29] Art. 132.5 C.m.p.

[30] Art. 133 C.m.p.

[31] Art. 13 C.m.p.

[32] Art. 32 C.m.p.

[32] Art. 34 C.m.p. (footnotes dropped).

[40] Art. 130 C.m.p.

[24] 41 Arts. 142-144 C.m.p.

[42] 42 Arts. 145-151 C.m.p.

[43] Art. 152 C.m.p.

[44] Art. 142 C.m.p.

[45] Art. 143 C.m.p.

[47] Art. 145 C.m.p.

[49] Art. 150 C.m.p.

[51] Art. 151 C.m.p.

[52] Art. 152 C.m.p.

[54] Arts. 161-172 C.m.p.

[55] Art. 161 C.m.p.

[57] Art. 169 C.m.p.

[59] Art. 153 C.m.p.

[62] TOMMASO AMEDEO AULETTA, RISERVATEZZA E TUTELA DELLA PERSONALITÀ [PRIVACY AND PROTECTION OF THE PERSONALITY] 68 (Giuffrè, 1978).

[63] Tribunale Ordinario di Roma 14 settembre 1953, Foro it., 1954, I, 115.

[66] Corte d'Appellodi Roma 17 maggio 1955, Foro it., 1956, I, 793.

[67] Cass. 22 dicembre 1956, n. 4487, Foro it., 1957, I, 5.

[69] Cass. 27 maggio 1975, n. 2129, Diritto d'autore [Dir. aut.], 1975, 367-78, as cited in PANETTA, supra note 5, at 161 (translation by author).

[70] Sabina Kirschen, Il Codice della Privacy, fra Tradizione ed Innovazione [ The Privacy Code, Between Tradition and Innovation], in PANETTA, supra note 5, at 7 (translation by author).

[71] SILVIA MELCHIONNA, IL CODICE DEL TRATTAMENTO DEI DATI PERSONALI [THE DATA PROTECTION CODE] 68 (Giappichelli, 2007) (translation by author).

[72] GIUSEPPE SANTANIELLO, LA PROTEZIONE DEI DATI PERSONALI [PROTECTION OF PERSONAL DATA] 1 (Cedam, 2005) (translation by author).

# data[].attributes.attachment_link.description
Back to Online Privacy Law * A 2017 updated version of this report is available The right to privacy, which encompasses the right to the protection of the individual's personal data, was first recognized by the Italian courts in the 1970s, and was then acknowledged by the legislature.

# data[].attributes.headline
The importance of data privacy laws and regulations

# data[].attributes.subject
The importance of data privacy laws and regulations

# data[].attributes.body
The most interesting part in this video, is the consequences of the lack of data privacy laws in a country. Current regulations (national, regional, global) might not be enough and certainly need updating. But their total absence, as it is the case in some African countries, is dangerous.

# data[].attributes.attachment_link.title
"I have nothing to hide", Data Privacy in 2020 | Nelio Leone | TEDxAmityUniversityDubai

# data[].attributes.body
Gleen Greenwald explains why the privacy is so important for us and how the thought that only bad person search privacy (Erich Schimit - CEO Google and Mark Zuckerberg- Facebook's founder) is wrong and dangerous.

# data[].attributes.attachment_link.description
Glenn Greenwald was one of the first reporters to see -- and write about -- the Edward Snowden files, with their revelations about the United States' extensive surveillance of private citizens. In this searing talk, Greenwald makes the case for why you need to care about privacy, even if you're "not doing anything you need to hide."

# data[].attributes.body
Everybody already knows about data hacking in Facebook, but sometimes we forgot it. Sometimes it's easier to accept cookies and privacy notice but it's always a good idea taking some times to rember that and to protect our data.

# data[].attributes.headline
3 Major Internet Privacy Issues and how to avoid them

# data[].attributes.subject
3 Major Internet Privacy Issues and how to avoid them

# data[].attributes.body
I think it´s a good idea to use a VPN, so that nobody can locate you.

# data[].attributes.attachment_link.authors[].name
About the Author Susan Alexandra is a small business owner, traveler and investor of cryptocurrencies.

# data[].attributes.attachment_link.title
3 Major Internet Privacy Issues and How to Avoid Them -- Security Today

# data[].attributes.attachment_link.description
Information mishandling, snooping and location tracking are often the ways in which users find their privacy violated online.

# data[].attributes.body
I share this article as I think it is helpful. It shows us how to protect our accounts online. It tells us about what experts in digital security and privacy do to protect their stuff. I think what they told, can help us a little.

# data[].attributes.attachment_link.readable_text
Before I became a reporter at NPR, I worked for a few years at tech companies.

One of the companies was in the marketing technology business - the industry that's devoted in part to tracking people and merging their information, so they can be advertised to more effectively.

That tracking happens in multiple senses: physical tracking, because we carry our phones everywhere we go. And virtual tracking, of all the places we go online.

The more I understood how my information was being collected, shared and sold, the more I wanted to protect my privacy. But it's still hard to know which of my efforts is actually effective and which is a waste of time.

So I reached out to experts in digital security and privacy to find out what they do to protect their stuff - and what they recommend most to us regular folks.

Here's what they told me.

1. To protect your accounts, practice good security hygiene.

There are some steps that make sense for almost all of us, says Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation. Those include using strong passwords, two-factor authentication, and downloading the latest security updates.

She and other experts make a distinction between privacy and security when it comes to your data. Security generally refers to protecting against someone trying to access your stuff - such as stealing your credit card number or hacking your accounts. Privacy is more often used to talk about keeping your movements from being tracked for purposes of advertising or surveillance.

It turns out that the steps to protect your security are more clear-cut than those for privacy - but we'll come back to that.

Use strong passwords or passphrases for your accounts. Longer than a password, passphrases should be strong and unique for each site. Don't use 1234. Bring some randomness and special characters into it. And don't use the same password for different websites: You don't want all your accounts to be compromised just because one gets hacked.

Use a password manager to keep track of your passwords, Galperin says - then all you have to do is remember the passphrase for your password manager.

Turn on two-factor authentication for your important accounts. You've seen this: Usually you're asked to put in your mobile number so that you can receive a text with an additional number you input before you can log in.

That's the most common type of two-factor authentication - but it's not the strongest, Galperin says, because SMS messages can be intercepted by your Internet provider, law enforcement or the government.

If you want to go a step further, Galperin recommends using an application that sends the second factor to an app on your phone, such as Authy or Google Authenticator, as these are harder to intercept. (Full disclosure here: NPR receives funding from Google and Facebook.) You can also use a physical key you carry with you that plugs into your computer's USB port and serves as the second factor.
Download the latest security updates.
Those nudges you get from your computer or phone to install the latest security update? You should download those.

"Most applications, when they're compromised, are not compromised by scary zero-day bugs that nobody knows about," Galperin says. "They are compromised by problems that everybody knows exist that have been publicly reported, and that the company has fixed and they have issued a patch in their security update. But if you do not take the security update, you do not get the benefit of the work of the security engineers at that company."

2. Beware of phishing.

Not all attacks on our security come through malware or hackers invisibly breaking into your account. It's common that we're tricked into handing over our passwords or personal information to bad actors.

These attempts can happen via email, text message or a phone call. And generally they're trying to get your username and password, or perhaps your Social Security number. But there are often signs that these messages aren't legit - spelling or grammar errors, links to websites other than the one it should be linking to, or the email is coming from a weird domain.

If it feels fishy, it might be phishing.

3. Protect what matters most.

Depending on your situation, you might want to take additional precautions to safeguard your privacy and security.

To figure out what steps people should take to safeguard their stuff, Galperin suggests you make a security plan. The Electronic Frontier Foundation has a guide to doing this, which starts by asking yourself these questions:

What do I want to protect?

Whom do I want to protect it from?

How bad are the consequences if I don't?

How likely is it to need protecting?

And how much trouble am I willing to go through to try to protect it?

You can use the answers to those questions to focus your efforts on securing the things that matter most to you.

4. Delete some apps from your phone. Use a browser instead.

Matt Mitchell is a tech fellow at the Ford Foundation, and the founder of CryptoHarlem, an organization that teaches people to protect their privacy, including from surveillance.

Apps can learn a lot about you due to all the different types of data they can access via your phone. Seemingly harmless apps - like say, a flashlight app - could be selling the data they gather from you.

That's why Mitchell recommends "Marie Kondo-ing" your apps: Take a look at your smartphone and delete all the apps you don't really need. For many tasks, you can use a browser on your phone instead of an app.

Privacy-wise, browsers are preferable, because they can't access as much of your information as an app can.

I mentioned to Mitchell that even though I use Facebook and Twitter, I don't have those apps on my phone - partly so that I'll use them less, and partly for privacy reasons. I wanted to know - did I accomplish anything by not having those apps on my phone?

"You've accomplished a lot," he says. He compares it to oil companies turning crude into petrol: Your data can be turned into profit for these companies. "Every time you don't use an app, you're giving them less data, which is less money."

Mitchell says that's true even if you've been on Facebook a long time, and it feels like the company already knows everything about you. He compares it to smoking: It's never too late to cut back or quit - you'll still benefit by giving it less data to harvest.

5. To protect your chats, use an encrypted app for messaging.

If you want the contents of your messages to be secure, it's best to use an app that has end-to-end encryption, such as Signal or WhatsApp. That means you and the recipient can read the message you send - but no one in the middle.

But even though the contents of your messages are protected by encryption in apps such as Signal and WhatsApp, your metadata isn't - and someone could learn a lot about you from your metadata, Galperin warns. She compares it to what you can learn just by looking at the outside of an envelope in the mail: who sent it to whom, when and where it was sent from.

And WhatsApp is owned by Facebook - so when you share your contacts with WhatsApp, Facebook is getting that info, though it can't read the contents of your messages.

If you're on an iPhone, iMessages are encrypted when you're messaging another iOS device - but not when you're messaging an Android phone. Signal offers encrypted messaging on both Android and iPhone.

What about Facebook Messenger? Jen King, director of privacy at Stanford Law School's Center for Internet and Society, advises against using the Messenger app.

The app "has access to far more info on your phone than using Facebook through a browser," she says, recommending something such as WhatsApp or regular SMS texting instead.

And if encryption matters to you, be careful about backing up your chats to the cloud. If you back up your WhatsApp messages to iCloud or Google Drive, for example, they're no longer encrypted.

"That backup is just a database. And that database is easy for someone to open and read," Mitchell says, if they were able to access your cloud account. To keep your messages from prying eyes, turn off cloud backups and delete existing WhatsApp backups from iCloud or Google Drive.

6. Turn off ad personalization.

Whenever possible, Mitchell recommends going into your settings and turning off ad personalization, which often gives companies permission to do invasive tracking.

He also recommends going to myactivity.google.com and deleting everything you can. On the left, there's a tab that says "Delete activity by." Select "All time." On your My Google Activity page, you can turn off Web & App Activity, Location History and YouTube History.

"It will show you every search term and everything you've ever done, every YouTube video you've ever looked at, all that stuff," he says. "It'll say, are you sure you want to delete this? 'Cause if you delete this, it might affect some stuff." Mitchell says: Delete it.

7. It's difficult to protect your privacy online if there aren't laws to protect your privacy online.

Tighter privacy settings only get you so far without laws that protect your privacy, says Ashkan Soltani, the former chief technologist for the Federal Trade Commission and one of the architects of the 2018 California Consumer Privacy Act.

There are laws around health information and credit and financial information, he explains, and some states have Internet privacy-related laws.

But nationally, the U.S. doesn't have a universal data privacy law safeguarding everyday online privacy.

Soltani says he rarely recommends steps such as using ad blockers or VPNs for most people. They require too much attention and persistence to deliver on privacy, and even then they are limited in their effectiveness.

"The incentives are so high on the other side," Soltani says, "to uniquely identify people and track them that [users] will never have enough motivation and incentive to do it to the degree of this multibillion dollar ad tech industry."

So how do you protect your privacy? Get involved and call your congressperson, he says - tell the policymakers that you care about online privacy.

8. Start small and take it one step at a time.

Faced with this landscape, getting a tighter hold on your digital privacy and security can feel daunting. But Galperin has this sound advice: Just do a little bit at a time.

You don't need to make a list of all of your accounts to integrate into a password manager - you can just do each account as you log into it.

Even just doing the basics - strengthening your passwords, turning on two-factor authentication and watching out for scammers - can make your accounts a lot more secure. Then keep going: There are a lot of other steps you might want to take, depending on your needs.

We're going to be on the Internet for a long time. The more each of us understands how our data are collected and used - and how to keep private what we want to keep private - the better, safer and healthier our digital lives will be.
The podcast portion of this episode was produced by Audrey Nguyen. She also contributed research. We'd love to hear from you. Leave us a voicemail at 202-216-9823, or email us at LifeKit@npr.org.

# data[].attributes.attachment_link.title
Your Technology Is Tracking You. Take These Steps For Better Online Privacy : Life Kit

# data[].attributes.attachment_link.description
NPR's Laurel Wamsley talked with the experts about how to protect your information - from your text messages to your location - while you're on the phone and computer.

# data[].attributes.body
To be honest, I'm one of those people who often don't read the privacy notices when visiting a website (too long, boring, etc.) The article below explain why they don't work and describe a few alternatives to "Tick the Box" online notices.

# data[].attributes.attachment_link.title
Online privacy notices don't work. Here are 9 alternatives

# data[].attributes.attachment_link.description
Online privacy notices aren't designed with people in mind. Here are nine alternatives that governments and businesses can use to protect consumers' data.

# data[].attributes.headline
Online privacy fears are real - NBC News                         By Bob Sullivan                            https://www.nbcnews.com

# data[].attributes.subject
Online privacy fears are real - NBC News                         By Bob Sullivan                            https://www.nbcnews.com

# data[].attributes.body
Thousands of e-commerce customers watching as their credit card numbers are sold online for $1 apiece. Internet chat rooms where identities are bought, sold and traded like options on the Chicago Board of Trade. These are the horror stories dredged up by privacy advocates who say the Net’s threat to personal privacy can’t be dismissed as mere paranoia. And, they say, we’ve only seen the tip of the iceberg. . . .
__________________________
Now, I get scared of using internet due to online privacy issue!!!

# data[].attributes.body
I see that the video format is seemingly prefered, so I will use it again :-). I have just refered to this video in a comment I have made about another contribution, but it could be interesting to make it more visible.

A man-in-the-middle (MITM) attack is a “cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other” […] “As it aims to circumvent mutual authentication, a MITM attack can succeed only when the attacker impersonates each endpoint sufficiently well to satisfy their expectations. Most cryptographic protocols include some form of endpoint authentication specifically to prevent MITM attacks”.

Reference: Wikipedia contributors. (2021, May 7). Man-in-the-middle attack. In Wikipedia, The Free Encyclopedia. Retrieved 08:20, May 11, 2021, from https://en.wikipedia.org/w/index.php?title=Man-in-the-middle_attack&oldid=1021914886.

I find this video interesting because we can see in it that the digital identity of a person, an organization or a device like a computer is also connected to the digital certificate which “represents” them at the digital firm and the digital authentication, but this digital certificate can also be attacked while we are ignoring it… This video explains more or less technically how we might suffer a man-in-the-middle attack (Laura López Ramírez).

# data[].attributes.attachment_link.title
Man in the Middle Attacks & Superfish - Computerphile

# data[].attributes.body
I think that this video is interesting to make us reflections about our footprint when we navigate and search something to buy

# data[].attributes.body
This video highlights how we are surveilled by the governments through the excuse of protecting us. Is to worth it to give up our privacy in order to be "safer"?

# data[].attributes.attachment_link.title
Safe and Sorry – Terrorism & Mass Surveillance

# data[].attributes.body
it always seems to come down to a balance ... do you come up with super fancy complex passwords/ adjust settings etc to protect your privacy, but you never can remember any of the info yourself, vs balancing comfort and coming to terms that half the internet is possibly accessing your stuff??