Right to be Forgotten

Author: Stefan Kulk

The right to be forgotten is a legal right that exists in some jurisdictions, and that is closely related to the right of privacy and the protection of personal data. This right generally enables people to require the removal of information about them that is stored or otherwise processed by others. It can be argued that the right existed before the internet and the rise of online platforms and that it could be read into pre-internet norms and case law. However, the right to be forgotten has gotten particular prominence with the development of digital information technologies. The ability to store and search great amounts of information has shifted the ‘default of forgetting’ information towards a ‘default of remembering’ (Mayer-Schönberger, 2009¹). This required a rethinking of how we deal with private information and personal data in computer-mediated interactions and spurred the development of the right to be forgotten.

The right to be forgotten gained a lot of attention when it was read into the European Union Data Protection Directive – the predecessor of the General Data Protection Regulation (GDPR) – by the European Court of Justice in the Google Spain case (InfoCuria, 2014)². In its decision, the Court acknowledged that people have the right to have search results to irrelevant or outdated information about them delisted. Not all references to such information need to be removed under the ruling, as the Court explained that the right to be forgotten does not apply in cases in which there is a public interest in accessing the information in question. That may be the case if the person in question plays a role in public life, for instance, because that person is a politician or celebrity. The right to be forgotten thus requires that a balance is struck between a person’s right to privacy and other people’s rights to share and access information (Kulk, Zuiderveen Borgesius, 2018³). After the Google Spain case, search engines have implemented forms that enable people to do removal requests, which are then processed by these search engines. As of July 2020, Google has received almost 950.000 requests concerning a total of 3.700.000 URLs.

The right to be forgotten (or ‘right to erasure’) is enshrined in the European Union by means of the GDPR. It applies broadly to any kind of processing of ‘personal data’ – not just by search engines – in cases where such processing is unlawful or no longer necessary (Ausloos, 2020⁴). The California Consumer Privacy Act of 2018 established a ‘right to deletion’ as well. In both laws, freedom of expression is recognized as an exception to these rights.

References

1. Mayer-Schönberger, V. (2011). Delete: The virtue of forgetting in the digital age. Princeton University Press.
2. Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, C-131/12 (CJEU 2014). Available at: http://curia.europa.eu/juris/liste.jsf?num=C-131/12
3. Kulk, S., Borgesius, F. Z. (2018). Privacy, freedom of expression, and the right to be forgotten in Europe. Cambridge Handbook of Consumer Privacy, 301.
4. Ausloos, J. (2020). The Right to Erasure in EU Data Protection Law: From Individual Rights to Effective Protection. Oxford University Press.