What is the right to be forgotten?

Under Art. 17(1) GDPR, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay,” when, among other things, one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected.
• The data subject withdraws the consent on which the processing is based and where there is no other legal ground for the processing.
• The data subject objects to the processing and there are no overriding legitimate grounds for the processing.
• The personal data have been unlawfully processed.

Under Art. 17(2), “Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.”

However under Art. 17(3), these obligations shall not apply to the extent that processing is necessary, among other things:

• For exercising the right of freedom of expression and information
• For compliance with a legal obligation which requires processing under EU law or member state law to which the controller is subject
• For reasons of public interest in the area of public health.

Right to be forgotten and to erasure of sensitive data not absolute, in the advocate general’s view

In the case before the Court of Justice, the French data protection authority, Commission nationale de l’informatique et des libertés (CNIL), upheld the position of Google refusing to grant the request of four French citizens to erase information about them from the search results displayed in the Google search engine, primarily involving links to articles about various types of activities and events from the individuals’ past. These included satirical images, reports of launch of an investigation, and information about involvement in the Church of Scientology. The individuals demanding erasure of their data appealed the CNIL decision to the Conseil d’État (comparable to the Supreme Administrative Court in Poland).

The Conseil d’État then sought a preliminary ruling from the Court of Justice on the scope of exercise of the right to be forgotten in internet search engines, particularly whether the operator of a search engine has a duty, as a data controller, to systematically remove links to websites containing sensitive personal data.

The right of any natural person to request to be forgotten by an operator of a search engine was recognised by the Court of Justice in Google Spain SL (C-131/12). But the judgment in the pending case C-136/17 will determine whether the right to be forgotten and the general ban on processing of sensitive personal data are absolute in nature, or there are situations where individual privacy is outweighed by the public interest, freedom of information, and freedom of expression.

In his opinion, the advocate general takes the position that operators of internet search engines should consider the request by data subjects to erase their data, but in each case should also consider whether removal of a link (e.g. to a press report) infringes one of these public values.

In his reasoning, the advocate general relied on the wording of Art. 9 of the former Data Protection Directive (95/46/EC), concerning exemptions from exercise of the right to be forgotten for journalistic purposes or artistic or literary expression. The advocate general takes the position that even if the information whose removal is sought by the data subject constitutes sensitive data, the right to be forgotten is not available automatically whenever requested by the data subject.

This interpretation of the provisions of the directive on the right to be forgotten may be relevant for interpretation of the comparable concepts under Art. 17(3) GDPR.

The Court of Justice is expected to issue a judgment in the CNIL case this year. The court is not bound by the advocate general’s opinion, but such opinions are often a good predictor of the court’s adoption of a similar interpretation, which in this case would recognise limitations on the right to be forgotten. Such a holding would be welcomed not only by Google, but also by other operators of internet search engines.

Katarzyna Szczudlik