The Right to be Forgotten or Right to Erasure, is basically the right given to individuals to ask organisations to delete, block or cease the processing of their personal data.
Even though the Right to be Forgotten became well-known and thoroughly discussed in the human rights field after its insertion in Article 17 of the General Data Protection Regulation (GDPR), it initially appeared in Article 12 (b) of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
The Google Case
The leading case on the matter is C-131/12 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (13/05/2014), usually referred to as “the Google Case”. The decision on the Google Case gained publicity after the adoption of the GDPR in 2016, even though the main legal ground on which the claim was founded, was Article 12 of Directive 95/46/EC, since the case preceded the adoption and the enforcement of the GDPR.
In 1998 a Spanish newspaper published two announcements in its printed edition regarding the forced sale of properties arising from social security debts, in order to attract as many bidders as possible. At a later stage, that specific newspaper edition became available on the web. One of the properties contained in the announcements belonged to Mario Costeja González, whose name was included in the announcements. In 2009, Costeja contacted the newspaper and complained because when his full name was entered in Google’s search engine, a link to the announcements was appearing. He requested the erasure of his personal data, arguing that the forced sale had been concluded years ago and was no longer relevant. He then conducted Google Spain to request the removal of the links to the newspaper’s announcements. When Google Spain refused to do so, Gonzalez filed a complaint in the Spanish Data Protection Agency, which finally called on Google Spain and Google Inc. to remove the links to the announcements and make access to the data therein impossible.
When the case reached the National High Court of Spain due to actions brought by Google, the national judge stayed the proceedings and raised a number of questions to ECJ regarding the interpretation of Directive 95/46/EC.
The European Court of Justice (ECJ) ruled that individuals have the right to request from commercial search firms which profit from the gathering of personal data, such as Google, to erase and remove links and virtual paths to their private information and personal data. The reason for this decision is that the commercial entity behind a search engine is also responsible for the processing of personal data which appear in other websites, since it provides immediate access to those websites.
The Court concluded that the right to privacy supersedes the economic interests of commercial firms and sometimes, it even outweighs the public’s right to access information. In general, the importance of the Google Case lies on the massive control given to individuals over their personal data and their use on the internet.
The Right to be Forgotten under the GDPR
The rapid technological developments and the establishment of the Internet as an integral part of the personal and professional life of individuals have caused the uncontrolled dissemination and processing of personal data. This situation highlighted the inadequacy of the current legal framework regarding the safeguarding of the circulation of personal data and the need to establish a stronger set of rules.
Due to the abovementioned ever-growing need, the Right to be Forgotten is expressly stated and established within one of the most over-analysed legal instruments of our days, the GDPR.
The specific circumstances under which the right to be forgotten applies, are found in Article 17 of the GDPR. More specifically, an individual is entitled to request the erasure of their personal data if:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- The data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing.
- The data subject objects to the processing and there are no overriding legitimate grounds for the processing.
- The personal data have been unlawfully processed.
- The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
- The personal data have been collected in relation to the offer of information society services.
Nevertheless, the same Article provides for instances where personal data might not be erased despite the request of the data subject:
- For data used to exercise the right of freedom of expression and information.
- For data used to comply with a legal ruling or obligation.
- For data used to serve the public interest.
- For data used during an organization’s official authority.
- For data being processed for public health purposes.
- For data being processed to perform necessary preventative or occupational medicine.
- For data that represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
- For data is used for the establishment of a legal defence or in the exercise of other legal claims.
The essence in the design of the GDPR, is the balancing of two contradictive targets: The preservation of the integrity of fundamental right to the protection of personal data and the eradication of obstacles to the free movement of data. The Right to be Forgotten, as a part of the GDPR, seems to follow the general essence of the Regulation, as Europeans have been introduced to a right that is powerful, but not absolute.
If we assume that there is an informal “importance hierarchy” of rights, the Right to be Forgotten is one that is continuously rising. Although it will never be qualified as an absolute right, the Right to be Forgotten has been able to obtain unexpected magnitude and to gain equal significance as the Right to Information.