Erasing the past

By Konstantinos Kakavoulis

Article 17 of the new General Data Protection Regulation institutionalizes the right to erasure, the so-called “right to be forgotten”. According to this article, a person has the right to request the erasure of his personal data and the controller has the obligation to erase the personal data without undue delay. The right to be forgotten is not established for the first time with the entry into force of the new Regulation. It has been established at the European level by the Directive EU/95/46. The Court of Justice of the European Union has ruled in favour of the existence of the said right in the case Google Spain v AEPD and Mario Costeja González.

According to Article 17 of the new Regulation, The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

    1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
    2. the data subject withdraws consent on which the processing is based and their processing cannot be based on another legal ground;
    3. the data subject objects to the processing, which is made for public order reasons or the exercise of an official authority or in the interest of the data controller or third parties, and there are no overriding legitimate grounds for the processing;
    4. the data subject objects to the processing which is made for the direct commercial promotion of products;
    5. the personal data have been unlawfully processed;
    6. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
    7. the personal data have been collected in relation to the offer of information society services to a child

Therefore, it can be concluded that the right to be forgotten is not absolute. The mere fact that a person requests the erasure of his personal data from the Internet does not necessarily result in their erasure. According to data from Google, the company has received 720,000 requests for personal data erasure during the past 3 years and has accepted 43% of them.

For instance, in the case of a house confiscation for debts, which has taken place some years ago, the request for erasure is likely to get approved. In the case of a criminal conviction for a grave crime, this is highly unlikely; besides, the latter will always appear in the criminal record of the perpetrator.

But what is going to happen in the case of an old allegation for a serious crime, which has never been proven?

Or in the event of a recent bankruptcy?

Or in the event that someone has publicly expressed political views, which he now wants to withdraw?

In all the aforementioned circumstances there must be a weighting of the right to be forgotten with the freedom of expression, the economic interest of the data processor, as well as the public interest to gain access to this information according to the right to get informed. This weighting shall always be made taking into account the circumstances of the specific case and under no occasion may its results be predetermined. It must be noted that according to the jurisprudence of the Court of Justice of the European Union, the right to be forgotten in principle prevails over the economic interest of the data processor, as well as the right of the public to get informed.

Another very important case is pending before the Court of Justice of the European Union; the case of France versus Google. The most significant issue of concern raised before the Court is the universality of the right to be forgotten. The Court has to determine whether the pertinent right extends beyond the European Union. France’s argument in favour of the extension is that, without it, the right to be forgotten is void. Even if Google is forced to delete or edit the results of some search within the European plane, these results will still be publicly available in the rest of the world. On the contrary, Google points to freedom of expression, which will be substantially curtailed, if the Court decides that the right is to be extended. The company argues that in such an event, authoritarian regimes will be able to enforce their laws in a way that will universalize the restrictions they impose.

For instance, Thailand will be able to enforce its legislation, which prohibits any insult against its king, universally. Google argues that there must be room for every State to strike a fair balance between the right to privacy and freedom of expression. According to the company, no State must be in a position to impose its legislation on another State.

It is undisputable that both sides have very strong arguments. No matter what the outcome of the case will be, it is sure that the right to be forgotten has been established and is here to stay. This is because it guarantees something very important: the right to live without a flawless past; in other words, the right to live a normal life.