The right to erasure / the right to be forgotten

Regulation (EU) 2016/679 introduces a number of changes to the processing and protection of personal data. One of the significant changes regarding citizens’ rights is the more detailed regulation of the right to erasure (or the right “to be forgotten”). This right makes it possible, when the data subject does not want his data to be processed and there are no legal grounds for their storage, to have them deleted.

The right to erasure (or “right to be forgotten) is a right related to the protection of personal data and more specifically to relations with administrators of personal data (people or companies that collect, record, use, process, disclose and other actions with personal data). The idea is practiced in the European Union and Argentina. The problem arises from the desires of individuals “to determine the development of their lives in an autonomous way without being stigmatized as a result of certain actions performed in the past.”

In the context of the new legal framework, the right to erasure provides individuals with a practical mechanism to limit the storage of their personal data by a specific administrator. The intended effect of the exercise of the right is the suspension of the further possibility of processing the data that identifies the person.

Regarding the right “to be forgotten”, mention should be made of the decision of the Court of Justice of the European Union in the case Google Spain (C-131-12) delivered in May 2014, aimed at clarifying several very important issues related to the right of personal data subjects to be forgotten, objectified first in the repealed Directive 95/46/EC. The court’s decision caused a wide response and mixed reactions both in the EU and outside it, in view of its importance for the regulation of the digital space. In it, the court concluded that the activities carried out by search engines (Google in the specific decision) constitute processing of personal data, which can significantly affect the fundamental rights to privacy and the protection of personal data, as it facilitates users to build a detailed profile of the relevant face.

The most important interpretation of the Court in the case is expressed in the following: Google is a controller of personal data and its activity falls within the scope of the Directive; the right to erasure can be exercised when the data is inadequate, irrelevant or excessive in relation to the purposes of the processing; under certain conditions, when, for example, the person performs an important role in public life, the public interest requires that the data not be subject to deletion.

THE RIGHT TO BE FORGOTTEN IN GDPR

The right “to be forgotten” is further developed in Art. 17 of Regulation (EU) 2016/679, creating a high level of personal data protection. According to § 1 of the provision in question, the data subject may request, and the administrator is obliged to delete, without undue delay, the specific personal data. The above option could be implemented only if the following grounds exist:

  • the personal data are no longer necessary for the purposes for which they were collected or otherwise processed – Invoking this requirement is consistent with the purpose limitation principle, which requires personal data to be collected for specific, explicitly indicated and legitimate purposes;
  • the data subject withdraws his consent on which the data processing is based – rests on the freedom to give and withdraw consent to the processing of personal data;
  • the data subject objects to the processing and there is no overriding legal basis for continuing the processing – consequence of exercising the right to object under Art. 21, par. 1 of the GDPR.;
  • personal data has been processed unlawfully – rests on the rule that no one can derive rights from unlawful conduct;
  • the personal data must be deleted in order to comply with a legal obligation under Union law or the law of a Member State that applies to the controller;
  • personal data has been collected in connection with the provision of information society services to a child.
However, there are a number of situations in which the administrator has the possibility to refuse to delete the data, namely when the processing of the specific data is aimed at:
  • to exercise the right to freedom of expression and information;
  • to perform a legal duty or perform a task of public interest or exercise of public authority;
  • for public health purposes;
  • archiving for purposes of public interest, research historical research or statistical purposes;
  • establishing, exercising or defending legal claims.
Given the above, theright to be forgotten is not an absolute right. Each data subject can benefit from it only if there is a specific reason.
С какво да Ви помогнем?

споделете вашата идея и ние ще се свържем с вас

    Find us in Sofia!Varna!London!

    57 Cherni Vrah Blvd., Energy Tower,
    floor 7, 1407, Sofia

    173 Prilep St., Business Center BeeGarden,
    Office 20 9000, Varna

    Flat 12, Woodland court, 12 Penn hill avenue, Poole, BH14 9LZ