Officially referred to as the “right of erasure” under Article 17 of the GDPR, what is now commonly referred to as the “right to be forgotten” allows individuals to request organisations delete their personal data that they hold. Crucially, this right is not absolute. A request only requires to be complied with in the following situations:
- An organisation has been relying on consent to justify processing and consent is then withdrawn and there is no other legal groudn;
- An organisation has been relying on legitimate interests for processing but circumstances have changed and there is now no continuing legitimate interest;
- The request is objecting to the use of personal data which is used for direct marketing;
- An organisation is processing personal data unlawfully; or
- The data in question is currently used for the purposes of providing an information society service to children.
There are then a few scenarios where organisations don’t have to comply with requests even where the data and purposes fall into the categories above, for example where an organisation can demonstrate that it needs to keep the personal data to comply with a legal obligation, to defend a legal claim, where retention is in the public interest, in areas of public health, or archiving etc. or where there are freedom of expression considerations.
In the realm of online search engines, the Court of Justice of the European Union ruled in 2014 that search engines should comply with requests to delete certain search results in the EU in instances where such results are “inaccurate, inadequate or excessive”. As that ruling was delivered in 2014, France’s Council of State have now referred a new question to the CJEU on the potential for a request to mean that a search engine must delete all such results across its global domains, not just those in the EU. Advocate General Maciej Szpunar has initially questioned the territorial scope of the GDPR to impose this, and so it will be interesting to learn the CJEU’s views once their updated judgment is published.
