Business,

In a series of blogs I will tell you more about the rights of data subjects under the GDPR. The previous blog discussed the right of access . In this blog I will tell you more about the right to be forgotten gdpr on the basis of recent case law. How far does this right go?

THE RIGHT TO BE FORGOT

The right to be forgot is govern by Article 17 of the GDPR. In the GDPR, this right is also refer to as ‘the right to erasure’ or ‘the right to be forgot’. Article 17 lists six situations in which a data subject may request an organization (the ‘controller’) to delete their personal data:

  • The retention of the personal data is no longer necessary for the purpose for which they were process.
  • The data subject withdraw consent to the processing and there is no other legal ground for the processing.
  • The data subject objects to the processing.
  • The personal data unlawfully process.
  • There is a legal obligation to delete the data.
  • The organization has processed the personal data of a child under the age of 16, without the parents’ consent.

The third paragraph of Article 17 GDPR lists a number of reasons for organizations not to comply with such a request. For example, an organization may refuse a request if the processing of the data subject’s personal data is necessary for the performance of a legal task, or for the exercise of the right to freedom of expression and information.

THE RIGHT TO BE FORGOT VERSUS THE RIGHT TO FREEDOM OF EXPRESSION AND INFORMATION

Because others have published something about the data subject and those publications appear as links in the search results of, for example, Google? Can those involved ask Google to delete those links?

Also read: right to be forgotten process

HOW FAR DOES THE RIGHT TO BE FORGOT GO?

In 2014, the European Court of Justice ruled on this in a Google case against Spain (the Cotija judgment). In that ruling, the Court ruled that, under certain circumstances, data subjects do indeed have the right to have links removed from search engines.

With such requests, it will always depend strongly on the circumstances of the case whether the search engine should honor a request for removal. In doing so, the search engine must weigh the rights and interests of the data subject (right to privacy and protection of personal data) against its own (financial) interests and the rights of people who use the search engine (right to freedom of expression and information).

THE INTERNET KNOWS NO BOUNDARIES. OR IS IT?

Another case recently before the same European Court of Justice concern the question of how far the right to be forgot in search engine actually go. Should global search engines such as Google also remove the search results in question globally? The answer to that is ‘no’.

The European Court rule that if search engine (have to) remove link, they are not oblige to remove those link in all extension of their search engine. Does the request come from Europe? Then they have to delete the links in all European extensions of the search engine (such as google.nl, google.fr, google.be). On all extensions outside of Europe (such as google.com or google.ca) the links may continue to appear in the search results.

In its ruling, the European Court considers that the right to privacy is not an absolute right. The balance between the right to privacy and the protection of personal data of the data subject. On the one hand and the freedom of information of internet users. On the other hand differs considerably around the world. From a legal point of view it is then not desirable to impose. The (strict) European standards on the rest of the world. The rest of the world can draw up its own laws and regulations for this. We call this the territoriality principle.

This can be very frustrating for those involve. Who are internationally know or who work and have had search result remove. After all people from Shanghai Sydney São Paulo New York or any other place outside of Europe. Who use a non-European version of a search engine will still see the search results deleted in Europe. From a legal point of view, however, this makes sense, in view of the territoriality principle. The internet may have no borders, but the law (still) does.

Incidentally the European Court ruled that search engines must take measures to discourage people. From accessing the results of one of the non-European versions of the search engine from one of the Member States. Perhaps that is a small consolation for some involved.

Also read: Right to be Forgotten Meaning