The GDPR (which will apply in all EU member states from 25 May 2018) enhances existing data subject (individuals) rights and also includes a new data subject right of erasure of personal information. This is also known as the right to be forgotten.
The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. If such a request is made by an individual then the business must comply without undue delay, at no cost to the requesting individual, and by erasing all the individual’s personal data wherever it exists (including any archives and backups).
Individuals have a right to have personal data erased and to prevent processing in the following circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed by the data controller.
- When the individual withdraws consent to the data controller’s processing activities and no other legal justification for processing applies.
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
- The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR)
- The data controller objects to processing for direct marketing purposes.
- The data controller collected the personal data in the context of offering online services to children
- EU or member state law requires erasure to comply with a legal obligation that applies to the data controller
The right to be forgotten is not an absolute right, meaning that a data controller/search engine operator can refuse to comply with the request where the personal data is necessary for the following reasons:-
- to exercise the right of freedom of expression and information
- to comply with a legal obligation for the performance of a public interest task or exercise of official authority
- for public health purposes in the public interest
- archiving purposes in the public interest, scientific research historical research or statistical purposes; or
- the exercise or defence of legal claims.
Google Spain
In May 2014, the ECJ ruled in the Google Spain case that EU citizens have the right to request internet search engines such as Google to remove search results in response to a query for their name, if those results were inadequate, outdated or irrelevant.
The Google Spain case concerned an individual called Mario Costeja Gonzalez who complained to the Spanish National Data Protection Agency that a Google search of his name showed search results for a1998 newspaper publication regarding the repossession of his home. Mr Gonzalez filed a complaint against Google and the Spanish newspaper that had originally published the information online arguing that article infringed his privacy rights as the repossession proceedings had been concluded years earlier. Mr Gonzalez requested that the newspaper must remove or alter the pages to remove or conceal the personal data relating to him so that they were no longer included in the search results.
How do I exercise my right to be forgotten?
Following the Google Spain case, Google has implemented a request process. This is a standard form, see below, which can be found by searching for ‘EU Privacy Removal’, on which an individual can make an official request to have specific URLs/websites removed that include their name.
Note: As this is service is offered by Google, you will need to have a Google Account to access and complete the form.The individual will also need to provide Google with a digital copy of a form of identification, such as a scan of a Passport. Google will then consider the request and if they refuse to remove the link then the individual can bring the mater before their national court.
For more information click on the image to visit the IOC website:
About The Author:
Alicia West is an Assistant Solicitor in the Litigation department. She works on a broad range of matters including franchising and commercial contract disputes for franchisors and franchisees, as well as owner managed businesses and individuals. Her work involves litigation, alternative dispute resolution and general advisory work. Alicia also advises on data protection and IP matters.
About Owen White:
- Owen White Solicitors was formed as a partnership in 1988 and was incorporated in 2013.
- Owen White Solicitors is affiliated member of the British Franchise Association
- Owen White Solicitors is Owen White is one of the leading franchise specialists in the UK with over 35 years’ experience of providing legal advice to both franchisors and franchisees.
- Owen White Solicitors also provide advice on:
- Contact details:
- Owen White Solicitors Senate House 62 – 70 Bath Road Slough Berkshire SL1 3SR
- Tel: +44 1753 876800 Email: law@owenwhite.com Website: www.owenwhite.com