The Right To Be Forgotten

Unheard of until a few years ago, the “right to forget” is becoming a common expression in the legal world and beyond. It is important, however, to agree on what exactly this generic term covers. It groups together several rights based on different legal grounds.

Two sub-categories can be distinguished. The first covers all the legal instruments that allow the citizen to obtain or recover control of his personal data. This is what I term “droit à l’oubli”, literally “right to forget”. The legal basis for this comes from the legislation on the protection of personal data (such as, for example, the GDPR). The second sub-category is an expression of the right to private life. It comprises the tools that allow a person to refuse to be an object of information, either systematically or on a specific occasion. It is “the right to be forgotten”. It is this second sub-category that I will mainly deal with.

The “right to be forgotten” limits the freedom of the press. It is therefore a question of balancing the interests protected by this fundamental right against the right to private life. The action that is likely to be brought with success after an infringement of the “right to be forgotten” is based on the common law of liability, namely Article 1382 of the Belgian Civil Code. Two specific conditions have to be met. The disputed facts have been lawfully published for the first time. This information must, then, be disseminated a second time, in a way that may be different from the original disclosure. If these preliminary conditions are met, the judge has several parameters at his disposal to assess the balance of the interests involved.

The author of this chapter focused his attention on the new wave in the frame of privacy protection in the EU law: from co called “right to be forgotten” (case Google vs. Gonzáles) to General Data Protection Regulation (DCFR). Author explained especially the impact of the recent European development of the personal data protection on the Czech law including the newly prepared Czech personal Data Protection Act, the changes of doctrinal thinking and the challenges to the juridical practice in the Czech Republic.

The General Data Protection Regulation (hereinafter the GDPR) and the Danish Data Protection Act (hereinafter the DDPA) has been effective since 25 May 2018 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), see: http://​eur-lex.​europa.​eu/​legal-content/​EN/​TXT/​HTML/​?​uri=​CELEX:​32016R0679&​from=​ENG. The Danish Data Projection Act is available in English at https://​www.​datatilsynet.​dk/​media/​6894/​danish-data-protection-act.​pdf.). However, the interpretation of the regulation still raises questions in Denmark. Thus, in this article, predictions of future case law are mainly based on the work of the Danish Ministry of Justice on adapting Danish law to the GDPR. This work resulted, among others, in a white paper encompassing more than 1000 pages, published on 24 May 2017 (White paper no. 1565, GDPR – and the legal framework of Danish legislation, available at: http://​justitsministeri​et.​dk/​nyt-og-presse/​pressemeddelelse​r/​2017/​nye-regler-styrker-beskyttelsen-af-persondata-i-europa.). In Denmark, case law traditionally stays close to the evaluations and considerations set forth in such white papers and other preparatory works. The predictions must therefore be considered to be founded on a realistic and sound basis.

The Finnish Data Protection Ombudsman (DPO) and courts have handled cases concerning the ‘right to be forgotten’ as rectification matters. Thus, the personal data in question must have been unnecessary, false, incomplete or outdated in relation to the purpose of processing. This chapter deals with the Finnish legal state prior to the General Data Protection Regulation (EU) 2016/679 (GDPR) which currently applies, alongside the supplementary national Data Protection Act (1050/2018).

The article discusses the right to be forgotten in the German jurisdiction. It first states that a special right to be forgotten does not exist in Germany, but arises from general civil law and general data protection law—even before the General Data Protection Regulation (GDPR) came into force. In a second step, the limits of these claims against the service provider as an indirect tortfeasor are shown, who is obliged to review the specific notification of the party affected. In this context, it will be discussed which constitutional requirements—defined by the case-law of the Federal Constitutional Court—the service provider must take into account when balancing different interests. Subsequently, it is shown by which legal remedies the right to be forgotten and possible claims for damages can be enforced. Afterwards, the development of the right to be forgotten is presented, taking into account the reactions of the German courts and commentators, in order to show that in Germany the claiming of service providers as indirect tortfeasors has already been established before the ECJ’s decision. The actual effects of the ECJ’s decision will then be demonstrated by Google Germany’s implementation of the requirements of the right to be forgotten. In the ensuing section, the extent to which claims to deletion arise from the new GDPR will be explained. In the end, the article comes to the conclusion that the core task of the GDPR is to now strike a reasonable balance in the current secondary law while adequately accounting for the basic guidelines from fundamental rights as the competent authorities make use of the consistency procedure.

This chapter examines the status of the right to be forgotten in Irish law. It pays close attention to data protection law and finds that even before the coming into force of the General Data Protection Regulation (GDPR), a right to be forgotten, rooted in data protection law, was available in Irish law. The chapter also explores whether a right to be forgotten is available beyond data protection law. In doing so, it assesses whether interests in forgetting and/or being forgotten are given expression in other areas of Irish law. The chapter considers the legislation on spent convictions, defamation law and the law of privacy. It finds, however, that data protection law is the most suitable home for a right to be forgotten. The chapter also examines the limits of the right to be forgotten and the remedies available for infringement before commenting on the transparency problem in the context of search engine delisting requests.

This contribution focuses on the current implementation of the right to be forgotten under the Italian legal order. By answering to twelve questions, the authors provide an overview of the main aspects in this field. In particular, the authors deal with how the right to be forgotten is protected in Italy, its limits as well as the legal remedies available to enforce such right. Once having described such general framework, this contribution analyses the concrete implementation of the right to be forgotten in Italy considering, in particular, the obstacles in its implementation together with the effective use of the Google procedure. Then, the authors share their views regarding the upcoming legal reform of the right to be forgotten from an Italian and European perspective.

The right to privacy and the right to personal data protection are two fundamental rights enshrined in the European Union’s treaties and Charter, providing individuals with proper tools of control over their private life. The “right to be forgotten” may be considered one of these tools. After being expressly consecrated by the European Court of Justice in a 2014 ruling which involved a search engine on the Internet, this right seems to have its own path, apart from the existing legal regime of the data subjects’ rights, as judicial and administrative practice shows it (in Romania, as well). As of the 25th of May 2018, a new European Union regulation directly and uniformly applies in all the Member States and specific legal provisions on the right to be forgotten have come into force. Romania is taking part in all these reforms, so the legal transplant of the right to be forgotten was smoothly put in place with all its relevant guarantees, besides the domestic civil legal protection of the personal rights which is under the judiciary’s scrutiny.

This chapter comprehensively illustrates the recent status of the right to be forgotten in the UK and unveils the significance of the changes caused by recent developments. Particularly, the latest reforms in both domestic and international law have had a drastic impact on the application of the right to be forgotten. With the General Data Protection Regulation (GDPR) scheduled to have direct effect in all EU member states, the Government introduced the Data Protection Act (DPA) 2018 in order to retain the regulation post-Brexit. Significantly, the GDPR emphasises the need for a statutory right to be forgotten in Article 17, which goes beyond what was guaranteed under the old legal framework in the UK. In addition, the crucial judgment of NT1 and NT2 v Google LLC handed down by the High Court in 2018 established and clarified under which circumstances a person can successfully ‘erase’ unwanted information from the digital landscape under UK law. It further contains novel and significant conclusions as to how UK courts should balance out the different interests involved in a right to be forgotten case. By drawing upon these developments in both legislation and case law, this chapters provides a unique overview of how the right to be forgotten has been conceptualised over time and what issues have already been raised under the new legal framework. Also, it offers an insight into the rationales underpinning the right to be forgotten from a UK perspective and explores whether further protection would be desirable.

There is neither specific Argentine legislation guaranteeing the right to be forgotten nor specific remedies for infringement of such a right. Argentina finds similar values and protections in the constitutional rights of privacy and dignity, but has not followed the ECJ ruling in the Google Spain case in accordance with the European approach to the right to be forgotten.

Within the various aspects of the online privacy fender, the discussions about “right to be forgotten”, understood as the opposition to a public memory, of past events, outdated and dissonant characteristics in relation to their contemporary personality aspects. In the digital environment, it reaches the storage and public availability of decontextualized data and information, through news in a content server, mention in database, return in a search provider or even a post in social network, which represents a form of permanent and oppressive memory of the subject’s current personality. In Brazil, the Superior Court of Justice (STJ) already had the opportunity to address the issue of the right to be forgotten on the Internet; the arguments demonstrate the preponderance of the right to information and communication, evoking the forgetfulness only when the subject can detach himself from the recounting of history and this does not prevent rememorating of socially relevant fact. The STJ removed the right to be forgotten cases of noncontractual liability for the conduct of search providers, but kept it in front of the application providers, adopting the so-called “notice and take down” regime. It is therefore perceived that the right to to be forgotten, especially in the face of the challenges of the Internet, imposes a critical reflection that aims the guarantee of effective protection of the constitutionally protected values.

This report analyses the “hybrid” notion of dereferencing in Canadian law. An emerging right representing a real potential to provide the balances that seem necessary to ensure both the free flow of information and the dignity of people. It is well established in Canada that courts may, after finding that a document on the Internet is in violation of the law, order its removal. Judges also order the removal of hypertext links to documents that are contrary to the law. There is therefore a balance between the right to freely seek information and the right to protect privacy and reputation. Once it is shown that a document violates a person’s reputation or privacy, a judge may order its removal as well as the deletion of the hyperlinks that lead to it. The “right to be forgotten” as described above must be distinguished from the right created by the decision of the European Court of Justice to erase links generated by a search engine. In Canadian law, it can not be assumed that privacy law provides a right to erase search results. The constitutional guarantee of freedom of expression, understood as protecting the freedom to search for information that does not contravene the law, precludes the application of a “right to dereference” which would be linked to the right to the protection of personal information.

Despite the absence of any explicit basis for the so-called “right to be forgotten” in Japanese data protection statutes, there is a basis in Japanese privacy case law that provides part of the substance of such a right. This was elucidated in a landmark decision of the Supreme Court of Japan on January 31, 2017, regarding the issue of search engine liability. The Supreme Court held that, if certain substantive requirements are met, injunctive relief can be granted against a search engine operator to remove search results containing private facts. The level of protection provided for such a Japanese equivalent of the right to be forgotten, being subject to a heavily fact-specific balancing test formulated by this Supreme Court decision, can be roughly characterized as somewhat eclectically in-between the two ends of the spectrum represented by EU and US law respectively, in terms of how it seeks to strike a balance among the multiple competing interests including but not limited to privacy, the freedom of expression, access to information, and online platform business. This paper highlights the importance of such recent proactive judicial moves in Japan to curb algorithmic determinism, and also emphasizes the need to prepare for the mixed blessings of the next generation of self-learning algorithmic decision-making enabled by artificial intelligence (AI) and the latest smart information technologies.

The multifaceted nature of the right to be forgotten suggests that the concept actually has many different roots and serves different interests. Four kinds of the right to be forgotten are explored and discussed in Taiwan’s legal contexts. Both the right to request deletion of personal data and more specifically the right to de-indexing on internet are commonly understood as honoring individual will or choice. It could be easily outweighed by more compelling interests of public’s right to know and the freedom of press. However, the right of oblivion for the purpose of social rehabilitation and the right as independence from power in an era of big data deepen the meaning of the right to be forgotten and relate the concept to more democratic values.