The Right to Be Forgotten Law. How to Use it Effectively?

What is the right to be forgotten? It appears in Recitals 65 and 66 and in the GDPR`s Article 17. It claims that the data subjects have the right to make the controller delete their personal data without any undue delay. At the same time, the controller is obliged to erase this information with no undue delay if one of the specified conditions applies. It is worth knowing that this “undue delay” means around one month.

The right to be forgotten happens to be a legal concept that allows people to ask for the de-indexing or removal of certain data about them from online platforms or search engines, especially when the information is outdated, harmful, or irrelevant.

The right of erasure has become so significant because impressive amounts of personal details are readily accessible to anyone with an internet connection. The thing is that it is critical to remove content that can potentially harm an individual`s privacy and reputation.

Legal Framework and Origins of the Right to Be Forgotten

This right emerged from European Union law, specifically after the well-known ruling taken by the Court of Justice of the European Union in 2014. There is a widely-known case, Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. This was when a man from Spain asked Google to erase links to a 1998 Spanish newspaper article about his financial issues that had been solved by that moment. The court claimed that people were free to request search engines to delete links to irrelevant or outdated personal data, specifically when it is not relevant anymore.

After that ruling, the European Union introduced the General Data Protection Regulation in 2018 with the purpose of enshrining the EU right to be forgotten into law formally. According to the GDPR, you are welcome to ask for the erasure of personal information under certain conditions, including when consent is withdrawn, the data is no longer needed for the purposes it was gained for, or when the processing of information is unlawful.

Even though this concept was created in Europe, it has had an impact on other countries. It means that they reconsidered how personal details are managed and whether people need to have more control over the data available about them online. Still, the application of this law can vary by jurisdiction and remains controversial.

What Deletion Requirements Are There?

As mentioned before, there are certain GDPR deletion requirements. As per Article 17, you can make the controller delete personal information without undue delay when these conditions are met:

• The individual withdraws the consent on which the data processing is based, and no other legal ground for processing is there.
• The personal information is no longer necessary for the goals it was gained.
• The individual objects to the processing, and no overriding legitimate reasons for processing are there.
• The individual`s personal information was processed unlawfully.
• The personal information must be deleted to comply with a legal obligation in Union or Member State law to which the controller is subject.
• The personal information was obtained in relation to the offer of data society services to a child.

Data controllers must remove information, and this should happen within a certain GDPR data deletion time frame, considering the cost of the operation and the technical feasibility. This ensures that people can exercise their rights effectively and that their personal details are protected.

How You Can Utilize the Right to be Forgotten

The GDPR data deletion is not an absolute right, it just one of the possible methods. The request to remove information must meet specific criteria, and the process typically involves a legal or formal procedure. Here is how people can use the RTBF to request the erasure of personal data from the internet:

1. Requesting the removal of links from search engines:

Most RTBF requests are made to search engines, such as Google. The process begins when an individual contacts the search engine and submits a request to remove specific links that lead to personal data. The request usually involves filling out a form on the search engine’s website, in which the individual provides the URLs in question and explains why they believe the links should be removed.

The search engine evaluates the request based on several factors. These include whether the information is outdated, irrelevant, or damaging to the individual’s reputation. For example, a request may be granted if it involves outdated news articles, old legal disputes that have been resolved, or personal details that are no longer relevant.

2. Content removal by online platforms and websites:

The right to forget law does not only apply to search engines but also to specific websites that host the data. In cases where an individual believes that a website or social media platform is hosting outdated, irrelevant, or defamatory content, they can contact the platform directly and request the removal of the content.

Social media platforms, blogs, and online forums may be more difficult to navigate when requesting content deletion. Most platforms have a content removal policy in place, and individuals can submit a formal request citing their RTBF rights. However, platforms may require a clear reason for removal, such as proving that the information violates privacy laws, is false, or is no longer relevant.

3. Legal action:

If a search engine or online platform refuses to comply with the European data subject rights requests, the individual may seek legal recourse. This could involve filing a complaint with the relevant data protection authority or taking the matter to court.

In Europe, individuals can file complaints with data protection authorities like the Information Commissioner’s Office (ICO) in the UK or the CNIL (National Commission on Informatics and Liberty) in France. These authorities can investigate the matter and issue rulings that compel search engines or websites to remove certain information.

In some cases, individuals may have to file lawsuits against search engines or content providers. Legal challenges often focus on balancing the individual’s right to privacy with the public’s right to access information.

Courts weigh these competing interests, sometimes ruling in favor of removing the content and at other times upholding the publication of certain information in the interest of freedom of expression.

4. Delisting requests for public records:

Some individuals request that organizations remove information from public records that are linked to their names, such as arrest records, old lawsuits, or bankruptcies. Public records are often indexed by search engines, making it difficult for individuals to move past mistakes made in the past. If the data is no longer relevant or if it infringes on their right to privacy, individuals can ask for it to be delisted.

While removing such data can be challenging, especially if it concerns public interest or legal transparency, individuals may argue that the information is no longer relevant or has been superseded by more current events.

A Few Real-Life Cases

To understand what is right to be forgotten in practice, you should look at some real-life cases where people utilized this right to ask for the deletion of personal information.

• Google v. Google Spain SL (2015)

In this case, the Court of Justice of the European Union claimed that search engines are obliged to respect the right to be forgotten and delete links to personal details if they are deemed to be outdated or irrelevant. The case involved a Spanish person, referred to as “A”, and this individual wanted Google to de-index links to sensitive personal details. Initially, Google refused to do that, stating that it was not responsible for the content. However, the court ruled that Google and other search engines are responsible for the information they index, and people can ask them to remove information that meets the GDPR data deletion requirements.

• Google v. CNIL (2019)

CNIL, which happens to be the data protection authority of France, requested Google to delete specific links globally, but Google was not going to do that stating that such a requirement would infringe on freedom of expression. The Court of Justice of the European Union (CJEU) ruled that the RTBF applies only within the European Union, which implies that search engines must de-index links within the EU but are not obligated to erase them globally. This case set a precedent for the limits of RTBF outside European borders, highlighting conflicts between privacy and free speech.

• NT1 v. Google (2018)

In this case, a UK court ruled that Google must remove links to information about an individual’s past criminal conviction, with the purpose of tackling harmful content online issues. The case centered on the balance between privacy rights and public interest. The claimant, referred to as NT1, had been convicted of a crime years earlier, but the ongoing presence of the conviction in search results was preventing him from rebuilding his life. The court ruled that the RTBF should apply in this situation, reinforcing the principle that outdated, irrelevant, or harmful information could be removed from search results under certain scenarios.

Turn to NonDetected for Help

As you can see from the above cases, the success of every request using the Right to Be Forgotten Law depends on individual circumstances, which can be the conduct of the person making the request, the type of data to be deleted, and whether the information is still relevant. Therefore, a one-size-fits-all approach does not exist, and you might need some right to be forgotten help.

At NonDetected, we have specialists who can solve this kind of issues quickly and professionally. They do not only know the right to be forgotten definition and requirements, but they also have experience in tackling such problems.

All you need to do is to contact us and explain what the issue is, and we will do everything possible to a successful resolution.