The Right to be Forgotten
Module 4: Data Privacy and Data Protection
The ‘right to be forgotten’(1) — which can also be described as ‘the right to erasure’ or ‘the right to be de-listed’ — entails the right of a data subject to request that commercial search engines or other websites that gather or publish personal information remove links to the personal information relating to the subject on request. The issue is highly contextual and often fraught because it usually involves a complicated balancing of public and individual interests. The right to be forgotten progresses from the right of data subjects contained in many data protection laws that personal information held about a person should be erased in circumstances in which it is inadequate, irrelevant, no longer relevant, or excessive in relation to purposes for which it was collected. However, in some cases, there may be a valid justification for keeping the information in the public domain because it is in the public interest.
Establishing the right to be forgotten in the EU
The right to be forgotten was established in a 2014 ruling of the Court of Justice of the European Union (CJEU) in the case of Google Spain v Gonzalez.(2)
Mr Gonzalez, a Spanish national, lodged a complaint in 2010 with the Spanish information regulator. The cause of Mr Gonzalez’s complaint was that any search for his name on Google’s search engine prominently displayed old news articles about debt proceedings against him. Mr Gonzalez requested that the personal data relating to him, which was over a decade old, be removed or concealed because the proceedings had been fully resolved and the reference to him was now irrelevant.
The CJEU upheld the claim, relying on the European Union data protection law in effect at the time. The CJEU noted that the very display of personal information on a search results page constitutes the processing of the information(3) and that there was no reason why a search engine should not be subject to the obligations and guarantees laid out under the law.(4)
Further, it was noted that the processing of personal information carried out by a search engine can significantly affect the fundamental rights to privacy and the protection of personal data when a search is carried out of a person’s name, as it enables any internet user to establish a profile of the person.(5)
According to the CJEU, the effect of the interference “is heightened taking into account the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.”(6)
With regard to de-listing, the CJEU held that the removal of links from the list of results could, depending on the information at issue, have effects on the legitimate interests of internet users seeking access to that information.(7)
This would require a fair balance to be struck between those interests and the data subject’s fundamental rights, taking into account the nature of the information, its sensitivity to the data subject’s private life, and the interest of the public in having that information, which may vary according to the role played by the data subject in public life.(8)
The CJEU went on to hold that a data subject is permitted to request that information about them be removed from search results where, having regard to all the circumstances, the information appears to be inadequate, irrelevant or no longer relevant, or excessive in relation to purposes of the processing carried out by the operator of the search engine.(9)
In such circumstances, the information and links concerned in the list of results must be erased.(10)
Since then, the jurisprudence on the right to be forgotten has developed significantly, particularly in the EU. See the European Court of Human Rights’ Guide to the Case Law on Data Protection for some examples of the nuances that have since been developed.
A growing body of jurisprudence
The right to be forgotten has also been recognised in domestic contexts, although not as yet in sub-Saharan Africa. However, it has been recognised in South America in, for example, the State Court of Appeals of São Paulo, Brazil.(11)
Of relevance to the media, the Supreme Court of Chile, in 2019, made an order requiring several digital media outlets to update the information they had published about a person involved in a criminal case in order to achieve a balance between the right to information that was in the public interest and the right to honour.(12)
Non-consensual dissemination of intimate images (NCII)
A growing body of case law is also beginning to recognise the right to be forgotten in cases of the non-consensual sharing of intimate images (NCII), such as X v. Union of India and X v. YouTube, both in the High Court of Delhi in India.
Litigating NCII in Kenya
In 2016, the High Court of Kenya determined a case, Roshanara Ebrahim v Ashleys Kenya Limited & 3 others (2016), involving the non-consensual distribution of the petitioner’s nude photographs by an ex-boyfriend, resulting in her dethronement as Miss World Kenya 2015.(13)
The Court held that Ebrahim had a legitimate expectation of privacy, that she did not waive her right to protection of privacy by taking nude photographs, and did not consent to their dissemination to third parties, and as such, her right to privacy under Article 31 of the Constitution of Kenya had been violated. It further ordered the ex-boyfriend to pay damages and directed the organisers of the Miss World Kenya not to publish the nude photographs in their possession.
The case provides valuable insights into the ‘reasonable expectation of privacy,’ whether images are obtained in an intrusive manner, and whether the presence of illegalities may invalidate a right to privacy claim.(14)
Limits on the right to be forgotten
As jurisprudence around the world has developed, lines have begun to be drawn identifying the limits of the right to be forgotten. In 2017, the CJEU declined to uphold a request to erase, anonymise, or block any data linking the plaintiff to the liquidation of his company contained in the companies register in the case of Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni.(15) The CJEU held that in light of the range of possible legitimate uses for data in company registers and the different limitation periods applicable to such records, it was impossible to identify a suitable maximum retention period. Accordingly, the CJEU declined to find that there is a general right to be forgotten from public company registers.
Furthermore, other jurisdictions have refused to uphold a right to be forgotten against search engines:
- In Brazil, for example, it was held that search engines cannot be compelled to remove search results relating to a specific term or expression.(16)
- Similarly, the Supreme Court of Japan declined to enforce the right to be forgotten against Google, finding that deletion “can be allowed only when the value of privacy protection significantly outweighs that of information disclosure”.(17)
According to the Global Principles of Freedom of Expression and Privacy (Global Principles),(18) the right — to the extent that it is recognised in a particular jurisdiction — should be limited to the right of individuals under data protection law to request search engines to delist inaccurate or out-of-date search results produced on the basis of a search for their name(19) and should be limited in scope to the domain name corresponding to the country where the right is recognised and the individual has established substantial damage.(20)
It states further that de-listing requests should be subject to ultimate adjudication by a court or independent adjudicatory body with relevant expertise in freedom of expression and data protection law.(21)
For further reading on the right to be forgotten, see Module 5: Trends in Censorship by Private Actors of Media Defence’s Advanced Modules on Digital Rights and Freedom of Expression Online.