Skip to 0 minutes and 6 secondsNow, it is time to address two other significant rights of data subjects prescribed
Skip to 0 minutes and 11 secondsby the General Data Protection Regulation: the right to erasure and the right to data portability. The right to erasure is sometimes known as the right to be forgotten, though this denomination is not entirely correct. Data subjects have the right to obtain from data controllers the erasure of personal data concerning them without undue delay. In this regard, controllers are obliged to erase these personal data without undue delay if one of the following grounds is applicable. First, personal data are not necessary anymore in relation to the purposes for which they were collected or processed. Second, data subjects withdraw their consent, and there is no other legal ground for processing.
Skip to 0 minutes and 55 secondsThird, data subjects object to the processing, and there are no overriding legitimate grounds for this processing. Fourth, personal data have been unlawfully processed. Fifth, personal data must be deleted in order to comply with the legal obligation in the European Union law or the law of EU Member States to which controllers are subjected. And, sixth, personal data have been collected in relation to the offer of information society services to children. This right to erasure is, however, not applicable when the processing is necessary for the exercise of the right to freedom of expression and information.
Skip to 1 minute and 34 secondsIt also does not apply when the processing is required for compliance with a legal obligation of the controller under the law of the European Union, or its Member States, that requires the processing, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in a controller. In addition, this right is not applicable for reasons of public interest in the area of public health and for achieving purposes in the public interest, scientific or historical research purposes, or statistical purposes. Finally, it does not apply for the establishment, exercise, or defence of legal claims.
Skip to 2 minutes and 12 secondsWith respect to this right, an interesting case was brought before the Court of Justice of the European Union, or the CJEU. The judgement was given on 13 May 2014 and dealt with the right to be forgotten in the context of the Directive 95/46/EC, the predecessor of the GDPR. In 2010, a Spanish national, Mario Costeja Gonzalez, complained before the Spanish Data Protection Agency against the newspaper La Vanguardia Ediciones, Google Spain, and Google, Incorporated. He was not happy with the fact that if Internet users entered his name in the Google search engine, two links to the newspaper would appear where his name would be present.
Skip to 2 minutes and 55 secondsHis name would be connected to the real state auction with regard to the attachment proceedings initiated for the recovery of social security debts. He wanted the newspaper to have these references removed or altered and Google to have his personal data in this regard removed or concealed. The complaint in relation to the newspaper was dismissed by the Agency, but it was upheld with regard to Google. In the national legal proceedings between the two, the Spanish National High Court referred a number of preliminary questions to the Court of Justice of the EU dealing with the applicability of the Directive 95/46/EC to the Internet search engines, such as that of Google.
Skip to 3 minutes and 36 secondsThe Court of Justice of the European Union has concluded that data subjects have a right to erasure. It means that the information presented by the search engines is not linked to their names and that the operators of the search engines may be required to remove links to third party websites with data subjects' personal information. Such an interference with the fundamental rights, however, can be justified if there is a significant interest of the general public to have access to this information. If those individuals, for example, play an important role in the public life. Currently, many requests are processed by Google that originate from individuals who would like to remove certain links to third party websites containing certain personal information about them.
Skip to 4 minutes and 22 secondsAre you one of these people? Or are you considering now to become one? Furthermore, data subjects have a right to receive personal data concerning them which they provided to controllers and to transmit these data to other controllers. The data in question must be provided in a structured, commonly used, and machine-readable format. This right exists when the processing is based on consent, or a contract, and the processing is carried out by automated means. In addition, data subjects who exercise their right to data portability may have their personal data transmitted directly from one controller to another if this is technically possible.
Skip to 5 minutes and 6 secondsThis right can be exercised without prejudice to the right to erasure. It also does not apply to the tasks carried out in the public interest or in the exercise of official authority by the controller. Finally, it cannot be invoked to adversely affect the rights and freedoms of others. Imagine that an individual has been a devoted user of the Google Plus social network. As the time passes, he notices that it is not as popular anymore as it used to be and that all his friends have left it. He decides to walk over to Facebook, and - by using his right to data portability - may ask Google to hand over to him all personal data it holds about him.
Skip to 5 minutes and 49 secondsThis will allow him an easy transfer of all his personal details to the new social network.
Skip to 5 minutes and 57 secondsThe right to erasure and the right to data portability formed the core of our discussion this time. They are ensured by the General Data Protection Regulation and should benefit those who can be considered data subjects.
Right to erasure and right to data portability
The rights to erasure and to data portability should not be omitted in our discussion of data subjects’ rights.
The right to erasure (also known as “the right to be forgotten”) is to be found in Article 17 GDPR. It allows data subjects to obtain from data controllers the erasure of personal data concerning them without undue delay. This right, however, does not apply when, for example, the processing is necessary for the exercise of the right to freedom of expression and information; when there are reasons of public interest in the area of public health; or when legal claims must be established, exercised or defended.
“The right to be forgotten” was dealt with by the Court of Justice of the European Union (CJEU) in the judgment from 13 May 2014 involving Spanish citizen Mario Costeja González, the Spanish Data Protection Agency, Google Spain and Google Inc. The Court has observed that data subjects have a right to erasure meaning that information in search engines is not linked to data subjects’ names and that the search engine operators may be required to remove links to third party websites with personal information. If there is a significant interest of the general public to have access to this information, this interference with fundamental rights may be justified.
Data subjects also have the right to data portability or, in other words, the right to receive from controllers personal data concerning them in a structured, commonly used and machine-readable format and to transmit these data to other controllers. This has been laid down in Article 20 GDPR. If it is technically possible, personal data can be directly transmitted from one controller to another. The right to data portability is not applicable to the tasks carried out in the public interest or in the exercise of official authority by the controller and it cannot be invoked to adversely affect the rights and freedoms of others.
© University of Groningen