The Right to be Forgotten
Module 4: Data Privacy and Data Protection
The ‘right to be forgotten’(1) — which is perhaps better described as ‘the right to erasure’ or ‘the right to be de-listed’ — – entails a right to request that commercial search engines, or other websites that gather personal information for profit, remove links to private information when asked, subject to a balancing of public and individual interests. The right to be forgotten progresses from the right of data subjects contained in many data protection laws that personal information held about a person should be erased in circumstances where it is inadequate, irrelevant, or no longer relevant, or excessive in relation to purposes for which it was collected.
The right to be forgotten was established in a 2014 ruling of the Court of Justice of the European Union (CJEU) in the case of Google Spain v Gonzalez.(2) Mr Gonzalez, a Spanish national, lodged a complaint in 2010 with the Spanish information regulator. The cause of Mr Gonzalez’s complaint was that any search for his name on Google’s search engine prominently displayed old news articles about debt proceedings against him. Mr Gonzalez requested that the personal data relating to him, which was over a decade old, be removed or concealed because the proceedings had been fully resolved and the reference to him was now irrelevant.
The CJEU upheld the claim, relying on the EU data protection law in effect at the time. The CJEU noted that the very display of personal information on a search results page constitutes processing of such information,(3) and there was no reason why a search engine should not be subject to the obligations and guarantees laid out under the law.(4) Further, it was noted that the processing of personal information carried out by a search engine can significantly affect the fundamental rights to privacy and to the protection of personal data when a search is carried out of a person’s name, as it enables any internet user to establish a profile of the person.(5) According to the CJEU, the effect of the interference “is heightened taking into account the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.(6)
With regard to de-listing, the CJEU held that the removal of links from the list of results could, depending on the information at issue, have effects on the legitimate interests of internet users seeking access to that information.(7) This would require a fair balance to be struck between those interests and the data subject’s fundamental rights, taking into account the nature of the information, its sensitivity for the data subject’s private life, and the interest of the public in having that information, which may vary according to the role played by the data subject in public life.(8)
The CJEU went on to hold that a data subject is permitted to request that information about them be removed from search results where, having regard to all the circumstances, the information appears to be inadequate, irrelevant or no longer relevant, or excessive in relation to purposes of the processing carried out by the operator of the search engine.(9) In such circumstances, the information and links concerned in the list of results must be erased.(10)
The right to be forgotten has also been recognised in domestic contexts. For instance, in a de-listing dispute between a publisher and a local restaurant owner, Italy’s Supreme Court of Cassation held that the public interest in retaining access to a news article about a fight at the restaurant diminished over time, and that sensitive and private information should not be available to the public indefinitely.(11) The European Court of Human Rights (ECtHR) subsequently upheld the decision.(12)In the case of Hurbain v Belgium, the ECtHR upheld an order requiring the anonymisation of a person involved in a road accident and was not a breach of the publisher’s freedom of expression.(13)The Belgian Court of Cassation has also recognised the right to be forgotten,(14) as has the State Court of Appeals of São Paulo, Brazil.(15)
The Supreme Court of Chile, in 2019, made an order requiring several digital media outlets to update information they had published about a person involved in a criminal case in order to achieve a balance between the right to information that was in the public interest and the right to honour.(16)
A body of case law around the world is also beginning to recognise the right to be forgotten in cases of the non-consensual sharing of intimate images (NCII), such as X v. Union of India and X v. YouTube, both in the High Court of Delhi in India.
There are, however, limits to the ambit of the right to be forgotten. In 2017, the CJEU was seized with a request for a preliminary ruling in the case of Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni.(17) Mr Manni, relying on the Gonzalez decision, sought an order requiring the Chamber of Commerce to erase, anonymise or block any data linking him to the liquidation of his company contained in the companies register. The CJEU declined to uphold Mr Manni’s request and held that in light of the range of possible legitimate uses for data in company registers and the different limitation periods applicable to such records, it was impossible to identify a suitable maximum retention period. Accordingly, the CJEU declined to find that there is a general right to be forgotten from public company registers.
Furthermore, other jurisdictions have refused to uphold a right to be forgotten against search engines. In Brazil, for example, it was held that search engines cannot be compelled to remove search results relating to a specific term or expression,(18) similarly, the Supreme Court of Japan declined to enforce the right to be forgotten against Google, finding that deletion “can be allowed only when the value of privacy protection significantly outweighs that of information disclosure”.(19)
According to the Global Principles of Freedom of Expression and Privacy (Global Principles),(20) the right – to the extent that it is recognised in a particular jurisdiction – should be limited to the right of individuals under data protection law to request search engines to delist inaccurate or out-of-date search results produced on the basis of a search for their name(21) and should be limited in scope to the domain name corresponding to the country where the right is recognised and the individual has established substantial damage.(22) It states further that de-listing requests should be subject to ultimate adjudication by a court or independent adjudicatory body with relevant expertise in freedom of expression and data protection law.(23)
For further reading on the right to be forgotten, see Module 5: Trends in Censorship by Private Actors of Media Defence’s Advanced Modules on Digital Rights and Freedom of Expression Online.