The right to be forgotten or the right to erasure is one of the most important rights in the European Union’s data protection law. This right has particular relevance in the digital environment. Before the advent of the Internet, personal information about natural persons were naturally disappearing with the passage of time[1]. Today we can easily agree to the fact that even if people forget, the machines remember[2]. Paul Lambert explains how personal data shared online can significantly affect human’s lives, leading to redundancies, refusal of employment, refusal to access a university, or, in extreme cases, leading to online abuse and suicides (especially when personal data concerns children or adolescents)[3].
Article 17 (1) GDPR states that ‘the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay[…]’. The right to be forgotten is not an absolute right because in most cases it must be balanced against other rights and freedom, for example with the freedom of expression and information.
Everyone likes stories; therefore, we will begin with the story of the Spanish citizen Mario Costeja González from the famous CJEU’s case – Google Spain[4].
The right to be forgotten in the Google Spain Case
In 2010, Mr. Costeja González lodged a complaint against a newspaper, and against Google Inc related to two internet pages indexed by Google Search. Those internet pages and search results were mentioning Mr. González’s name and some information related to a real-estate auction connected with attachment proceedings for the recovery of social security debts. Mr. González. The data protection authority ordered Google to remove the links to those web pages from the search results. Google Spain and Google Inc. brought actions against the DPA’s decision. The national Court decided to refer questions to the CJEU for a preliminary ruling.
The CJEU stated that a person has a right to be forgotten (a right to erase his or her personal data from the list of results generated by a search engine). The Court considered that an online publication of personal data that reveals intimate information can significantly affect fundamental rights ‘when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him’ (para. 80).
Regarding ensuring a balance between the right to be forgotten and the right of internet users to have access to the information in question, the Court pointed out that, in general, the right to privacy and the right to data protection override, ‘as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life’ (para 81).
References:
[1] Simon Wechsler, The Right to Remember: The European Convention on Human Rights and the Right to Be Forgotten, Columbia Journal of Law & Social Problems, 2015, Vol. 49, Issue 1, p. 136.
[2] A se vedea Paul Lambert, The right to be forgotten. Interpretation and practice, Ed. Bloomsbury Professional, 2019, Kindle Amanzon Version, p. 99.
[3] Idem, p. 70.
[4] CJUE, Cauza C-131/12, Google Spain și Google, hotărârea din 13 mai 2014, EU:C:2014:317.
