GDPR: How far does the right to be forgot go?
In a series of blogs I will tell you more about the rights of data subjects under the GDPR. The previous blog discussed the right of access . In this blog I will tell you more about the right to be forgot on the basis of recent case law. How far does this right go?
Also read: derecho al olvido
THE RIGHT TO BE FORGOT
The right to be forgot is govern by Article 17 of the GDPR. In the GDPR, this right is also refer to as ‘the right to erasure’ or ‘the right to be forgot’. Article 17 lists six situations in which a data subject may request an organization (the ‘controller’) to delete their personal data:
- The retention of the personal data is no longer necessary for the purpose for which they were process.
- The data subject withdraw consent to the process and there is no other legal ground for the processing.
- The data subject objects to the processing.
- The personal data unlawfully process.
- There is a legal obligation to delete the data.
- The organization has processed the personal data of a child under the age of 16, without the parents’ consent.
The third paragraph of Article 17 GDPR lists a number of reasons for organizations not to comply with such a request. For example, an organization may refuse a request if the processing of the data subject’s personal data is necessary for the performance of a legal task, or for the exercise of the right to freedom of expression and information.
THE RIGHT TO BE FORGOT VERSUS THE RIGHT TO FREEDOM OF EXPRESSION AND INFORMATION
Where the right to be forgot is regularly seriously hamper by the publication of personal data on the internet, especially via link in search engine. Because what about personal data that can be found online? For example, because others have published something about the data subject and those publications appear as links in the search results of, for example, Google? Can those involved ask Google to delete those links?
Also read: sharenting que es
HOW FAR DOES THE RIGHT TO BE FORGOT GO?
In 2014, the European Court of Justice ruled on this in a Google case against Spain (the Cotija judgment). In that ruling, the Court ruled that, under certain circumstances, data subjects do indeed have the right to have links removed from search engines.
With such requests, it will always depend strongly on the circumstances of the case whether the search engine should honor a request for removal. In doing so, the search engine must weigh the rights and interests of the data subject (right to privacy and protection of personal data) against its own (financial) interests and the rights of people who use the search engine (right to freedom of expression and information).
THE INTERNET KNOWS NO BOUNDARIES. OR IS IT?
Another case recently before the same European Court of Justice concern the question of how far the right to be forgot in search engine actually goes. Should global search engines such as Google also remove the search results in question globally? The answer to that is ‘no’.
The European Court rule that if search engine (have to) remove link, they are not oblige to remove those link in all extension of their search engine. Does the request come from Europe? Then they have to delete the links in all European extensions of the search engine (such as google.nl, google.fr, google.be). On all extensions outside of Europe (such as google.com or google.ca) the links may continue to appear in the search results.
Also read: mario costeja gonzález
Protection Of Personal Data
In its ruling, the European Court considers that the right to privacy is not an absolute right. The balance between the right to privacy and the protection of personal data of the data subject on the one hand and the freedom of information of internet users on the other hand differs considerably around the world. From a legal point of view, it is then not desirable to impose the (strict) European standards on the rest of the world. The rest of the world can draw up its own laws and regulations for this. We call this the territoriality principle.
So this statement mean that the right to be forgot is relative. This can be very frustrating for those involve who are internationally know or who work and have had search result remove. After all, people from Shanghai, Sydney, São Paulo, New York or any other place outside of Europe, who use a non-European version of a search engine, will still see the search results deleted in Europe. From a legal point of view, however, this makes sense, in view of the territoriality principle. The internet may have no borders, but the law (still) does.