The right to be forgotten

Is it possible to erase my traces online and how should I proceed?

10/09/2014 • National

In May 2014, a judgment of the Court of Justice of the European Union strenghtened the "right to be forgotten". According to this judgment, a European citizen may ask a search engine operator to remove a link from the list of results following a search made on the basis of that person's name if the data is incorrect or no longer relevant. The most popular search engine Google has already made a "Search removal request" available on their page. Does this mean that anybody can erase all their traces online? The answer is no, even after the judgment of the European Court of Justice. This article explains what exactly is meant by the "right to be forgotten".

What is the right to be forgotten?

The "right to be forgotten" already exists in Luxembourg since the 1995 EU directive on data protection has been implemented into national law by the Act of 2 August 2002. That right is more specifically described in articles 28 (paragraph 4) and 30 of the act, although the term "right to be forgotten" is not litterally in the text. That term is used to explain in an intelligible manner what it means when a person requests the deletion of innacurate, obsolete or irrelevant data (art. 28 paragraph 4) or when a person opposes the disclosure of accurate data that is unfavourable or outdated.

The right to be forgotten means that you can request that your personal data is no longer processed. For example, you can ask that your data is no longer published on a particular website, but this can only be done for "serious and legitimate reasons relating to a particular situation". This implies, first of all, that you have to have a good reason to request the deletion of your data. In other words, you must be able to prove that the publication of your data is contrary to any of the legal principles of necessity, relevance to the purpose for which the data was collected originally and/or legitimacy. If this is not the case, then you have to prove that the disclosure of your data on a large scale over the Internet at the present time is really damaging to you. It also has to be a specific case ("particular situation"). It is not possible to delete everything that has been published online about you or by yourself by making one single request to Google.

What are the changes brought by the judgment of the European Court of Justice?

If the right to be forgotten already exists since 2002, you may be wondering why a judgment of the European Court of Justice was still necessary. The judgment refers to a particular situation and mostly answered two questions relating to search engines:

Does a search engine operator process personal data in the same way than a website operator?
Is the act on data protection applicable to search engines operated by international companies?

In response to the first question, the Court stated that a search engine makes data available to everybody. Otherwise, the data in question wouldn't be available or just to a very limited extent. The Court considered that the operator of the search engine is the 'controller' in respect of that processing, given that it is the operator which determines the purposes and means of the processing. The Court concluded that an internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.

Concerning the second question, Google considers that EU legislation is not applicable to them because they are a company from the USA. The Court rejected that argument by stating that Google has establishments in EU Member States and that the EU directive on data protection is therefore applicable.

If I do not want my data to be published on a particular website, should I contact Google / Bing to remove this site from their search results?

If it is one particular website, you have to contact the operator of this site first to delete your data. If the operator refuses to delete your data, you may contact Google. If your name is mentioned on many different websites and it is virtually impossible to contact each website operator, you can submit the request directly to Google. However, note that when you send a request to Google, your personal data will continue to appear on the websites in question. Google will only close the "path" to these websites.

Note: in all cases, the law requires you to follow a specific procedure to request the removal of your data, otherwise your application will not be valid. You will find the description of this procedure below. Where the controller does not grant the request, the data subject may bring the matter before the CNPD or the judicial authority (see below: "What if my removal request is not successful?").

What are the exceptions to the right to be forgotten according to the Court of Justice of the EU?

Inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, the Court stated that a fair balance should be sought in particular between that interest and the data subject's fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court observed in this regard that, whilst it is true that the data subject's rights also override, as a general rule, that interest of internet users, this balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject's private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.

How to submit a request to delete my data from a website?

You have to make your request in writing. Don't forget to sign and date it and also include a proof of your identitiy, such as a copy of your ID card. This prevents a third person to make a request on your behalf as the operator of the website can be sure that it's really you. Clearly write down the reasons for which you want your data to be deleted.

Once your application is submitted, the operator of the website has one month to respond. If the operator refuses to delete your data, you may ask for the reasons of his refusal. When reviewing your request, the operator of the website has to find a balance between your interest in protecting your privacy and the interests of the public to be informed.

How to submit a request to delete my data from Google/Bing ?

Google and Bing already made available specific forms that you can use to submit your removal request.

Once your application is submitted, Google/Bing has one month to respond. If the search engine operator refuses to remove the links, you can expect him to state the reasons for refusal. When evaluating a request, the search engine operators have to balance the privacy rights of the individual with the public’s interest to know and the right to distribute information.

What if my removal request is not successful?

If you are convinced that you have a good reason for your data to be removed but your request has been denied, you can contact the CNPD or go to court. Important: in any case, you have to submit a removal request to the website or search engine (see above: "How to submit a request to delete my data from a website?") before the CNPD or the court can intervene.

Until now, the role of the CNPD is limited to being a mediator. The CNPD can only assess whether, in its opinion, the grounds on which the refusal is based is reasonable. If this is not the case, it can put pressure on the Website operator to delete the data, without being able to impose it. For this, you have to go to court. You can also chose to go to court without contacting the CNPD at all, but again, this is only possible if you have already sent a valid request to the website operator to remove your data.