The right to be forgotten?

Under Article 17 of the GDPR, data subjects have an important right to erasure, which is sometimes referred to as “the right to be forgotten”.

The Court of Justice of the European Union or the CJEU played an important role in the formulation of this right. In its judgmentin the Google Spain case from 13 May 2014, “the right to be forgotten” or the right to be delisted from the search results of a search engine was addressed. It should be observed, however, that it was done in the context of the Directive 95/46/EC, which is a legal instrument that preceded the GDPR. The Directive did not specifically address this right but currently it can be found in Article 17 of the GDPR. Let’s have a look at this judgment in more detail.

The facts of this case are rather simple. Mario Costeja González who is a Spanish national lodged a complaint in 2010 before the Spanish Data Protection Agency against a number of legal entities: the newspaper La Vanguardia Ediciones, Google Spain and Google Inc. The problem that this man discovered was the following. If Internet users entered the name of Mr. Costeja González in the Google search engine, two links to the newspaper La Vanguardia Ediciones would appear where his name would be present. This fact as such is unproblematic. However, his name would then be connected to the real-estate auction with regard to the attachment proceedings initiated for the recovery of social security debts. The Google search engine is one of the most widely used search engines in the world and Mr. Costeja González was not happy about the fact that everybody could see this information. He wanted the newspaper to have these references removed or altered and Google to have his personal data in this regard removed or concealed.

© CJEU via Infacts.org

In the first place, the Spanish Data Protection Agency dismissed the complaint of Mr. Costeja González in relation to the newspaper but upheld it with regard to Google. Then Mr. Costeja González initiated national legal proceedings and eventually the Spanish National High Court decided to refer a number of preliminary questions to the Court of Justice of the EU. The CJEU would then consider the applicability of the Directive 95/46/EC to the Internet search engines, including Google’s search engine, and provide its answers to the posed questions.

According to the CJEU data subjects have a right to erasure or, more specifically, to remove any links shown by the search engine to their names. The Court acknowledged the fact that the processing of personal data, such as those of Mr. Costeja González, is liable to significantly affect the fundamental rights to privacy and data protection when it is possible to search for an individual using his or her name. This is the case because Internet users would be allowed to see the search results containing structured information about an individual and this information concerns many important aspects of the private life of that individual. This would allow persons and entities to create more or less detailed profiles on persons. Currently, these search engines play a crucial role in our modern society and make it possible to interconnect various aspects of individuals’ private life.

Following the reasoning of the CJEU, if the right to erasure is exercised, the operators of the search engines, such as Google in this particular case, are obliged to remove the above-mentioned links to the websites run by third parties that contain personal data of data subjects in question.

In some situations, the removal of the links and personal data of individuals does not have to take place. This is especially important when there is a clear interest of the general public to have access to this information. This might be the case when data subjects are prominent figures in the public life and information about them must be known to those who are interested in it.