The Right to be Forgotten
Module 4: Data Privacy and Data Protection
The so-called ‘right to be forgotten’(1) — which is perhaps better described as ‘the right to erasure’ or ‘the right to be de-listed’ — entails a right to request that commercial search engines or other websites that gather personal information for profit, such as Google, should remove links to private information when asked. The right to be forgotten progresses from the right of data subjects contained in many data protection laws that personal information held about a person should be erased in circumstances where it is inadequate, irrelevant or no longer relevant, or excessive in relation to purposes for which it was collected.
In 2014, the Court of Justice of the European Union (CJEU) handed down an important ruling in the case of Google Spain v Gonzalez.(2) Mr Gonzalez, a Spanish national, lodged a complaint in 2010 with the Spanish information regulator. The cause of Mr Gonzalez’s complaint was that, when an internet user entered his name into Google’s search engine, the user would obtain links to pages of the Spanish newspaper from 1998 referring to attachment proceedings against him for the recovery of certain debts. Mr Gonzalez requested that the personal data relating to him be removed or concealed because the proceedings against him had been fully resolved and the reference to him was therefore now entirely irrelevant.
Before the CJEU, relying to the EU data protection law in effect at the time, the claim was upheld. The CJEU noted that the very display of personal information on a search results page constitutes processing of such information,(3) and there was no reason why a search engine should not be subject to the obligations and guarantees laid out under the law.(4) Further, it was noted that the processing of personal information carried out by a search engine can significantly affect the fundamental rights to privacy and to the protection of personal data when a search is carried out of a person’s name, as it enables any internet user to obtain a structured overview of information relating to that individual and establish a profile of the person.(5) According to the CJEU, the effect of the interference “is heightened taking into account the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.”(6)
With regard to de-listing, the CJEU held that the removal of links from the list of results could, depending on the information at issue, have effects on legitimate internet users potentially interested in having access to that information.(7) This would require a fair balance to be struck between that interest and the data subject’s fundamental rights, taking into account the nature of the information, its sensitivity for the data subject’s private life, and the interest of the public in having that information, which may vary according to the role played by the data subject in public life.(8)
The CJEU went on to hold that a data subject is permitted to request that information about him or her no longer be made available to the general public by its inclusion in a list of search results where, having regard to all the circumstances, the information appears to be inadequate, irrelevant or no longer relevant, or excessive in relation to purposes of the processing carried out by the operator of the search engine.(9) In such circumstances, the information and links concerned in the list of results must be erased.(10)
The right to be forgotten has also been recognised in domestic contexts. For instance, Italy’s Supreme Court of Cassation has held that the public interest in an article diminished after two and a half years, and that sensitive and private information should not be available to the public indefinitely.(11) The case is currently being litigated before the European Court of Human Rights.(12) The Belgian Court of Cassation has also recognised the right to be forgotten.(13)
There are, however, limits to the ambit of the right to be forgotten. In 2017, the CJEU was seized with a request for a preliminary ruling in the case of Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni.(14) Mr Manni, relying on the Gonzalez decision, sought an order requiring the Chamber of Commerce to erase, anonymise or block any data linking him to the liquidation of his company contained in the companies register. The CJEU declined to uphold Mr Manni’s request, and held that in light of the range of possible legitimate uses for data in companies registers and the different limitation periods applicable to such records, it was impossible to identify a suitable maximum retention period. Accordingly, the CJEU declined to find that there is a general right to be forgotten from public company registers.
Furthermore, other jurisdictions have refused to uphold a right to be forgotten against search engines. In Brazil, for example, it was held that search engines cannot be compelled to remove search results relating to a specific term or expression;(15) similarly, the Supreme Court of Japan declined to enforce the right to be forgotten against Google, finding that deletion “can be allowed only when the value of privacy protection significantly outweighs that of information disclosure”.(16)
According to the Global Principles of Freedom of Expression and Privacy (Global Principles),(17) the right — to the extent that it is recognised in a particular jurisdiction — should be limited to the right of individuals under data protection law to request search engines to delist inaccurate or out-of-date search results produced on the basis of a search for their name,(18) and should be limited in scope to the domain name corresponding to the country where the right is recognised and the individual has established substantial damage.(19) It states further that de-listing requests should be subject to ultimate adjudication by a court or independent adjudicatory body with relevant expertise in freedom of expression and data protection law.(20)
For further reading on the right to be forgotten, see Module 5: Trends in Censorship by Private Actors of Media Defence’s Advanced Modules on Digital Rights and Freedom of Expression Online.