General  Data Protection Regulation (GDPR) – The Right To Be Forgotten

General Data Protection Regulation (GDPR) – The Right To Be Forgotten


The world is changing and becoming even more globalized and technologized. The EU noticed the issue that current legislation does not respond to the arising legal challenges. It was a time for a change. Through the General Data Protection Regulation’s (GDPR) application on 25 May 2018 across the European Union, new legal requirements for the protection of personal data have been enforced for data controllers that are operating within the EU territory. Due to the GDPR changes, in certain cases, the data subject has the right to have the controller erase data concerning him or her without undue delay. This right is also known as the right to be forgotten (article 17 of the GDPR). This article protects natural persons while corporations are processing their personal data.

The controller is obligated to erase the personal data according to article without undue delay if:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed
• the data subject withdraws the consent on which the processing was based and there is no other legal basis for the processing
• the data subject objects to the processing of his or her data for purposes of direct marketing or otherwise exercises the data subject’s right to object and there is no other justified reason for the processing
• the personal data has been processed unlawfully
• the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject or
• the personal data has been collected in connection with offering information society services.
The right does not apply if the processing of the data is necessary:
• for exercising the right of freedom of expression and information
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing or
• for the establishment, exercise or defense of legal claims.

There has been a descriptive case law Google Spain v. González. The case offers a piece of understanding of how the article right to be forgotten works in general. In the case, Mr González searched Google for his name, and Google search resulted in links to the newspaper articles from 1998 on which an announcement mentioning Mr González’s name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts. Mr González requested, first, that newspaper is required either to remove or alter those pages so that the personal data relating to him no longer appeared or to use certain tools made available by search engines in order to protect the data. Second, he requested Google to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to the newspaper. Mr González stated that this information has been irrelevant for years. Google argued that the data was not incompatible with legislation and lawfully published.

The Spanish National High Court asked the Court of Justice of the European Union (CJEU) for advice on the application of the Data Protection Directive. According to the CJEU, the financial interest of the controller is not in itself, sufficient to justify further processing. As a general rule, the protection of privacy also overrides the public’s right to information. However, in individual cases, the nature and sensitivity of the information and the position of the data subject, for example, as a public figure, may affect this balance. In its decision, CJEU highlighted the importance of respecting the fundamental rights, in particular the right to privacy. After all, the operator of a search engine was obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person.

This case demonstrates in a certain way the problematic relationship between the person’s right for privacy and newspaper’s right for freedom of expression and information as well as a public interest. Here, Mr González’s Google results had already come irrelevant, they bothered him and his privacy. Anyway, even though the information were not relevant anymore, it does not change the fact that this information would not be true. Based on this, the newspaper has the right for expression and follow the public interest. However, since the article right to be forgotten is existing there was no reason not to erase the data. Thus, the right for privacy was the priority.

Nowadays the privacy is a common subject of discussion and why it would not be, since the privacy issues are existing in the world full of smartphones, interactive speakers and fitness trackers, just to name a few. Privacy is discussed in controversy among philosophical, legal, social and scientific circles. Still, no universally accepted definition of privacy exists. There is even a discussion about the 4th generation of the “new” human rights. At the moment, traditional human rights concepts are also under pressure because technology is creating new capabilities for human rights violations. In today’s world there are stored personal information in many, many places, the right to be forgotten emphasizing the individual person’s right to privacy by offering the ability to control at least at some level what information is available about them on the internet, for instance. Rights to live with humanity and the current discussion is strongly going on. The effects are worth following.