Explaining the Issues: The Right to be Forgotten

In Media Defence’s Explaining the Issues series, we provide an overview of legal issues faced by the media. See other blogs in the series here.

What is the right to be forgotten and where does it apply?

The so called right to be forgotten, also described as the right to be delisted, or the right to erasure, is a legal construct that allows individuals to request data about them be removed or delisted by search engines. The seminal case looking at this principle was the 2014 Court of Justice of the European Union (CJEU) judgment in Google Spain SL v Agencia Española de Protección de Datos, Mario Costeja Gonzalez (Google Spain case). The Court held that the operator of a search engine “collects” data within the meaning of the EU Directive. It further held that data which appears to be “inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes” should be removed from the list of results, unless there are particular reasons, such as the role played by the individual in public life, justifying the public in having access to the information. Access Now have created a useful document answering FAQs on this case.

In September 2019, the CJEU delivered judgment in the case of Google LLC v Commission Nationale de l’Information et des Libertés (CNIL) (Google v CNIL), which looked at the issue of geographical scope of de-referencing orders. In the Google v CNIL case, the French data protection regulatory authority, CNIL, fined Google for failing to globally de-reference information concerning an individual. Google LLC had confined the removal of the links to search engines in EU Member States.  Google LLC lodged an application with France’s Conseil d’État (Council of State) seeking an annulment of CNIL’s decision. As the case involved issues regarding the interpretation of the EU Directive, the Conseil d’État stayed the proceedings and referred questions to the CJEU for clarity. Media Defence intervened alongside other organisations when the matter was referred to the CJEU.

The CJEU considered whether a search engine operator must de-reference on all versions of its search engine, irrespective of where the search is initiated (even if it comes outside of the European Union). The Court concluded that the right to be forgotten is not globally recognised and that the competing interests between the right to privacy and freedom of expression are balanced differently across the world.

The “right to be forgotten” is not expressly written into any international human rights instruments. However, it is included in Article 17 of the General Data Protection Regulation (GDPR). There have been developments in the right to be forgotten in national courts, with courts in Italy and Belgium recognising the right. Other national courts, such as in Brazil and Japan, have refused to uphold it.

How does this impact freedom of expression?

The right to be forgotten is an important element for the protection of privacy. It recognises that sometimes personal information found online is not in the public interest. The CJEU judgment aimed to establish the difference between what should be available as it is in the public interest and what is no longer relevant and violates an individual’s privacy claims.

However, application of the right to be forgotten can represent a threat to freedom of expression and the right to access information. This includes the importance of protecting and maintaining the media archive, and public access to that online archive, as well ensuring courts do not apply the principle beyond its intended scope

According to the Global Principles of Freedom of Expression and Privacy, the right should be limited to search engines to delist inaccurate or out-of-date search results and should be limited to the domain name corresponding to the country (for example, google.co.uk in the United Kingdom).

Access Now has provided some guidance on ensuring clear safeguards for the implementation of the right to be forgotten:

• A right to de-list must be limited to the sole purpose of protecting personal data.
• Criteria for de-listing must be clearly defined in comprehensive data protection legislation to avoid interference with human rights.
• Competent judicial authorities should interpret standards for determining what is de‑listed.
• The right to de-list must be limited in scope and application.
• Search engines must be transparent about when and how they comply with de-listing requests.
• Users must have easy access to a remedy.

What does this mean for search engines?

Search engines are now afforded a wide discretion in de-referencing data. They are required to balance competing elements including what is relevant and what is in the public interest. A lack of cogent regulatory safeguards can result in search engines becoming the “judge, jury and executioner” of the right to be forgotten. There are risks involved in conferring such a decision-making power upon a private entity, particularly given the need to balance competing rights, an exercise traditionally reserved for courts. The Electronic Frontier Foundation expressed concern that the “ambiguous responsibility upon search engines” will censor the internet.

To read more about the right to be forgotten and how to litigate digital rights cases, see our Advanced Modules on Digital Rights and Freedom of Expression, in particular Module 5: Trends in Censorship by Private Actors