FIRST SECTION
CASE OF CRACÒ v. ITALY
(Application no. 30782/18)
JUDGMENT
STRASBOURG
13 June 2024
This judgment is final but it may be subject to editorial revision.
In the case of Cracò v. Italy,
The European Court of Human Rights (First Section), sitting as a Committee composed of:
Péter Paczolay, President,
Gilberto Felici,
Raffaele Sabato, judges,
and Liv Tigerstedt, Deputy Section Registrar,
Having regard to:
the application (no. 30782/18) against the Italian Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms ("the Convention") on 13 June 2018 by an Italian national, Mr Giuseppe Cracò ("the applicant"), who was born in 1961, lives in Sant'Agata di Militello and was represented by Mr A. Savoca, a lawyer practising in Palermo;
the decision to give notice of the application to the Italian Government ("the Government"), represented by their Agent, Mr L. D'Ascia;
the parties' observations;
Having deliberated in private on 21 May 2024,
Delivers the following judgment, which was adopted on that date:
SUBJECT MATTER OF THE CASE
1. The present application concerns the publication of the unredacted version of a judgment containing detailed references to the applicant's medical conditions on the Internet.
2. On 15 September 2005 judgment no. 2371/2005 of the Sicily Regional Section of the Court of Auditors (Sezione Giurisdizionale per la Regione Siciliana della Corte dei Conti) (hereinafter "judgment no. 2371/2005") was delivered and published on the website of the Court of Auditors.
3. As judgment no. 2371/2005 detailed the applicant's health conditions and medical records, on 4 June 2009 he filed a request for anonymity with the Palermo District Court, that was rejected on 14 July 2010 by judgment no. 3429/10.
4. On 20 May 2016, by judgment no. 10512/16, the Court of Cassation granted the applicant's appeal against the lower court's judgment, set it aside, and referred the case back to the Palermo District Court for reconsideration of the amount of compensation.
5. On 5 October 2017, by judgment no. 5219/2017, the Palermo District Court awarded the applicant 2,000 euros (EUR) as compensation and approximately EUR 3,500 for costs and expenses.
6. The applicant complained that, despite the Court of Cassation's judgment, the domestic authorities failed to remove judgment no. 2371/2005 from the website of the Court of Auditors and that its availability to the public without restrictions, at least until 16 May 2018, amounted to a violation of his private life within the meaning of Article 8 of the Convention.
7. He also complained under Article 6 § 1 of the Convention and Article 1 of Protocol No. 1 to the Convention of the delayed payment of the compensation awarded by judgment no. 5219/2017 of the Palermo District Court.
THE COURT'S ASSESSMENT
8. The Government contended that the applicant did not exhaust the domestic remedies, as he did not appeal against judgment no. 5219/2017 of the Palermo District Court on points of law or by reasons of errors of facts (revocazione) before the Court of Cassation.
9. They also argued that the judgments in favour of the applicant, the payment of the compensation and the removal of judgment no. 2371/2005 from the website in July 2009, as mentioned in judgment no. 5219/2017 of the Palermo District Court, deprived him of victim status.
10. The applicant objected that judgment no. 2371/2005 was still online and available to the public without restrictions or redactions in May 2018.
11. The Court recalls that, in order for a judicial remedy to be effective, the domestic courts must be able to engage properly with the substance of the Convention complaint raised by the applicant (P.C. v. Ireland, no. 26922/19, § 107, 1 September 2022).
12. In the instant case, the Court notes that by judgment no. 10512/16, the Court of Cassation, after having declared that the publication of the applicant's health data was unlawful, remitted the case to the Palermo District Court only for reconsideration of the amount of compensation to be awarded to the applicant (see paragraph 4 above). Therefore, considering that appealing against judgment no. 5219/2017 of the Palermo District Court, irrespective whether on points of law or by reasons of errors of facts, did not amount to an effective remedy in respect of the applicant's complaint before the Court, the Government's first objection must be dismissed.
13. As to the second exception raised by the Government, the Court reiterates that a decision or measure favourable to the applicant is not in principle sufficient to deprive him of his status as a "victim" unless the national authorities have acknowledged, either expressly or in substance, and then afforded redress for, the breach of the Convention (Selahattin Demirtaş v. Turkey (no. 2) [GC], no. 14305/17, §§ 217-18, 22 December 2020).
14. Although the Government argue that judgment no. 2371/2005 was removed from the website of the Court of Auditors in July 2009, from the evidence before it, the Court notes that in May 2018, the said judgment was still available to the public without restrictions or redactions. The Court of Auditors never informed the applicant that the judgment had been removed from its website or that it had been replaced with a redacted version and the Government did not produce any evidence in this respect.
15. Against this background and considering the sensitive nature of the information referred to in judgment no. 2371/2005, in the Court's view the national authorities did not afford adequate redress to the applicant, who can still claim to be a victim of the alleged continuous violation of Article 8 of the Convention. Consequently, also this objection by the Government must be dismissed.
16. Since the complaint is neither manifestly ill-founded nor inadmissible on any other grounds listed in Article 35 of the Convention, it must be declared admissible.
17. The general principles for assessing whether the disclosure of personal health data was compatible with Article 8 of the Convention have been summarised in L.B. v. Hungary ([GC], no. 36345/16, § 122, 9 March 2023), Y.G. v. Russia (no. 8647/12, § 44, 30 August 2022) and Z v. Finland (25 February 1997, §§ 70-71, Reports of Judgments and Decisions 1997-I).
18. The Court takes note that, under domestic law, the publication of health data in judgments and decisions made available to the public amounts to an unlawful interference in private life. In particular, Article 51 of Legislative Decree no. 196 of 2003 ("Legislative Decree no. 196/2003") and Article 56 § 2 of Legislative Decree no. 82 of 7 March 2005 provide that judgments and decisions of administrative courts (including the Court of Auditors) are made available to the public, through their filing with the registry and their uploading on the Internet, within the limits of the regulation on the protection of personal data. In this respect, Article 52 § 2 of Legislative Decree no. 196/2003 establishes that the competent court must, on its own motion, publish only redacted versions of judgments and decisions whenever this is necessary to protect the rights and dignity of the person concerned.
19. Moreover, on 2 December 2010 the Data Protection Supervisor (Garante per la protezione dei dati personali) issued guidelines on data protection in judgments and decisions made available to the public. It clarified that the above-mentioned Article 52 § 2 of Legislative Decree no. 196/2003 applies in all cases involving "sensitive data", within the meaning of Article 4 § 1 letter (d) of Legislative Decree no. 196/2003, as in force at the relevant time, and which included "health data". It further emphasised the prohibition of publishing health data and concluded by stating that it is the responsibility of the judicial authorities to conduct a careful assessment of the need to redact data in order to ensure adequate protection to the rights and dignity of the persons involved in judicial proceedings.
20. As regards the application of Article 52 § 2 of Legislative Decree no. 196/2003, the Court notes that on 14 December 2016 the First President of the Court of Cassation issued Order no. 178/2016 "on the protection of personal data in judgments and judicial decisions made available to the public". The Order expressly states that, in cases falling within the scope of Article 52 § 2, the bench delivering the judgment must order that the name of the person concerned be redacted by the Data-Processing Centre (Centro Elaborazione Dati) of the Court of Cassation before publication of the document on the Internet. Although this Order does not apply to the Court of Auditors, the Court considers that it bears witness to the existence of "good practices" within the superior courts to ensure proper enforcement of Article 52 § 2 and an effective protection of personal data.
21. The Court further observes that, in the instant case, the Court of Cassation already acknowledged that the publication of sensitive medical information on the applicant's health was unlawful and awarded him compensation (see paragraphs 4-5 above). Nevertheless, it also notes that the Court of Cassation's judgment was not accompanied by the redaction of the applicant's health data in judgment no. 2371/2005 or its removal from the website of the Court of Auditors (see paragraph 14 above).
22. Against this background, the Court sees no reason to depart from its case-law (see paragraph 17 above) and finds that the failure to remove judgment no. 2371/2005 from the website of the Court of Auditors or to replace it with a redacted version amounts to a violation of Article 8 of the Convention.
23. Under Article 6 § 1 of the Convention and Article 1 of Protocol No. 1 to the Convention, the applicant also complained of the delayed payment of the compensation awarded by judgment no. 5219/2017 of the Palermo District Court.
24. The Court reiterates that the creditor's uncooperative behaviour may be an obstacle to timely enforcement of a judgment, thus mitigating the authorities' responsibility for delays (see Belayev v. Russia (dec.), no. 36020/02, 22 March 2011; compare also Di Giuseppe v. Italy (dec.) [Committee], no. 7997/21, § 7, 5 December 2023, and the references cited therein).
25. Having examined all the material submitted to it, the Court notes that, as highlighted by Government in their observations, although judgment no. 5219/2017 of the Palermo District Court was filed on 5 October 2017, the applicant did not communicate the correct bank details to the debtor authority and did not provide the relevant supporting documents until February 2019. The Court of Auditors then ordered the payment on 6 March 2019. In these circumstances the Court finds that this complaint does not disclose any appearance of a violation of the rights and freedoms enshrined in the Convention or the Protocols thereto.
26. It follows that this part of the application must be rejected in accordance with Article 35 §§ 3 (a) and 4 of the Convention as manifestly ill-founded.
APPLICATION OF ARTICLES 41 AND 46 OF THE CONVENTION
27. The applicant claimed 50,000 euros (EUR) in respect of the non-pecuniary damage for the alleged violation of Article 8 and only EUR 30 for costs and expenses for the alleged violation of Article 6 of the Convention and Article 1 of Protocol No. 1.
28. The Government objected that, having regard to the nature and extent of the alleged violation, the finding of a violation constituted sufficient just satisfaction. In any event, they argued that the applicant had failed to provide evidence of the alleged damages suffered and of costs and expenses.
29. In the context of the execution of judgments in accordance with Article 46 of the Convention, the Court reiterates that a judgment in which it finds a breach of the Convention imposes on the respondent State a legal obligation to put an end to the violation and make reparation for its consequences in such a way as to restore as far as possible the situation existing before the breach (see, among many authorities, Yüksel Yalçınkaya v. Türkiye [GC], no. 15669/20, § 404, 26 September 2023).
30. Therefore, in light of the circumstances of the present case, the Court finds that the Respondent State has an obligation to remove judgment no. 2371/2005 from the website of the Court of Auditors and other public databases, or to replace it with a redacted version.
31. In respect of the claim for non-pecuniary damage, the Court recalls that the domestic courts awarded compensation to the applicant for the publication of the unredacted version of the contested judgment (see paragraphs 4-5 above). In this connection it observes that the applicant did not complain of the amount of such compensation neither at the domestic level, nor before the Court. Consequently, the Court considers that the finding of a violation constitutes sufficient just satisfaction for any additional non-pecuniary damage caused to the applicant.
32. With regard to costs and expenses, the applicant claimed only EUR 30 in relation to the complaint under Article 6 of the Convention and Article 1 of Protocol No. 1, which the Court has found inadmissible. This claim is therefore rejected.
FOR THESE REASONS, THE COURT, UNANIMOUSLY,
Done in English, and notified in writing on 13 June 2024, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Liv Tigerstedt Péter Paczolay
Deputy Registrar President