What is the “right to be forgotten”?
As hard as you may try, it is almost impossible for a person to not have a digital footprint nowadays. Even if you refrain from using social media, chances are you do your banking and shopping online, or have, at some point, signed up to a newsletter or filled in an application form over the web.
However, even if you have managed to avoid doing any of the above, if you use a search engine such as Google, they know who you are. According to the Princeton Web transparency & Accountability Project, 76% of websites now contain Google trackers and 24% have trackers for Facebook.
The reason big tech is so interested in us and will do anything to convince us to provide them with personal information comes down to one simple concept – advertising. The more companies like Google and Facebook know about you, the more they can target advertisements to suit you (the ads you view when using both platforms are not there by accident). In addition, to get you to click on more advertisement (which generate revenue for the company), they need everyone (including you) to spend more time online.
Big tech has created thousands of jobs around the world and has injected billions of pounds into the British economy. It has also made our lives easier, safer (in some respects), and allowed the human race to connect in ways we never dreamed possible 10-15 years ago.
However, some academics and lobby groups are raising concerns about the amount of data large tech companies hold and how it is being used. Fortunately, in Europe, the General Data Protection Regulations (GDPR), which come into force in the UK on 25th May 2018, provides significant protection for individuals in relation to how their personal data is collected, used and retained. The impact of the GDPR is expected to impact Alphabet (Google’s parent company) significantly, wiping 2% from its revenues according to Deutsche Bank analysis.
The GDPR and the right to erasure
Under Article 17 of the GDPR, a person has the right to request the “erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay”. The following grounds must apply for this right to be available:
- The reasons for collecting and processing the data are no longer necessary
- The individual withdraws their consent to the processing
- The individual objects to the legitimate reasons given by the controller for the processing of their data and the controller cannot prove overriding legitimate grounds
- The data has been unlawfully processed
- The data must be erased to comply with Member State laws
If the personal data has been put into the public domain, the data controller must inform other controllers that erasure of the data has been requested. The obligation to do this is one of “reasonable steps” and factors such as cost, and the availability of technology will be considered.
Google and the “right to be forgotten”
Individuals’ right to erasure in relation to private companies and charities and even larger corporates may be relatively easy to enforce under the GDPR. For example, if you wish to have your details erased from a company’s direct marketing database, under their GDPR compliance policies and procedures, a framework for dealing with such requests should exist so the data owners request can be quickly processed. But for a giant like Google, whose very existence depends on holding as much data as possible on every person in the world, the “right to be forgotten” is currently not normally won without a fight.
The “right to be forgotten” derived from the European Court of Justice (ECJ) case, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González heard in 2014. The case concerned the publication on the web of an order of forced property sales which took place in 1998. One of the properties described belonged to Mario Costeja González, who was named in the announcements which were published on the internet by a Spanish newspaper.
Mr González made a request to Google Spain to have the links to the announcements removed, stating the forced sale had been dealt with years before and the information was no longer relevant.
The ECJ backed Mr González, stating Google must delete “inadequate, irrelevant or no longer relevant” data from its results when a member of the public requests it.
ECJ judges are currently deciding on another case which has stemmed from France. This judgment, when delivered, will state whether the “right to be forgotten” principles established in the Google Spain case extends outside the EU. Initially, under the “right to be forgotten” principle, Google only scrubbed data from EU sites. However, France’s data-protection authority, the CNIL, subsequently informed Google that once it accepts a delisting, it must remove results from all domains, including those outside Europe and Google.com.
In January 2018, it was announced two men were bringing a case against Google in the High Court to have references to previous criminal convictions removed from the search engine in the first “right to be forgotten” case in Britain. The men say that the convictions are more than a decade old and “legally spent”, so their names should no longer be linked to information referring to the cases on Google. The outcome of this case will be highly anticipated, especially as the judgment is likely to be delivered after the GDPR comes into force.
In summary
The “right to be forgotten” is not easily given by Google. And remember, even if the information is removed from Google, it may remain online; it may just be much harder for ordinary folk to find it.
Privacy law and litigation will continue to evolve over time. Undoubtedly, the GDPR will result in contentious battles between individuals who want their data erased and companies who believe they have a legitimate right to continue to contain and process it.
We will keep you updated as the law in this area develops.
Saracens Solicitors is a multi-service law firm based in London’s West End. We have dedicated and highly experienced civil litigation solicitors who can advise you on all civil litigation and GDPR matters. For more information, please call our office on 020 3588 3500.
Do you have any comments to make on this article? Please feel free to add them to the section below.
