What you need to know about “The Right to be Forgotten”

<We need to be careful in discussing the Right as enunciated in the Costeja decision and as featured in the
GDPR. Are they the same? Or are they merely related? Or does one supplant the other?>

Should regrettable actions committed long ago by individuals be searchable online against their will? European
Union Law says, “no.” <I don’t think it’s as simple as that.>

This is the essence of the right to be forgotten, which arose out of the desire of individuals to “determine the
development of their life in an autonomous way, without being perpetually or periodically stigmatized as a
consequence of action performed in the past.” <See comment above>

Also called the right to erasure, it is found on Article 17 of EU’s General Data Protection Regulation (GDPR).
It involves removing information that was publicly known at a certain time and prohibiting third parties from
having access to this information. <Although the right to erasure is often referred to as the right to be forgotten,
I am not sure its current interpretation is guided by the Costeja Decision. Send me any supporting
material/document>

Does this mean that anyone can simply request the removal of their information from search engines any time?
Not exactly, either. Under this right, personal data may only be erased in the following cases:

- The data is no longer needed for its original purpose

- Data subject withdraws consent
- Data subject exercises right to object
- Data was processed unlawfully
- Erasure is necessary for compliance with the law

<I assume these are the grounds in the GDPR? If so, then these are not limited to search engines. This is why
we need to make a distinction between the GDPR and the Costeja decision>

The origins of this idea is rooted in European Law, and one may argue, from religious notions of “forgiveness”
and “restoration.” This is reflected in such earlier legislation as the UK’s Rehabilitation of Offenders Act, in
which many criminal convictions are considered “spent” after a certain period of time. The right to be forgotten
was also explicitly recognized by French Law (le droit a l’oubli) in 2010.

This right was first applied in the landmark case of Google Spain v. Costeja, decided in 2014. The Court of Justice
of the European Union ruled that an Internet search engine must consider requests from individuals to remove
links to publicly available web pages resulting from a search on their name. The case pronounced that the links
may be removed “where the search results appear to be inadequate, irrelevant, or no longer relevant or excessive
in the light of the time that had elapsed.” While the context itself remains online, it cannot be found by running
an online search of the individual’s name.

The right to be forgotten is perhaps the most disputed right from the GDPR as it is a double-edged sword. On
the one hand, it was contemplated to allow rehabilitation of former offenders in an effort to reintegrate them
into society. Those who were the subject of humiliating content or who have committed neglectful actions for
which they have paid penance for, should have the chance to live a rectified life.

But on the other hand, it is perceived as a potential threat to freedom of expression and a form of censorship.
Specifically, some Non-Governmental organizations (NGOs) have raised the concern that it can be used to by
authoritarian regimes to exert control over publicly available information.

Even trickier, European privacy regulatory bodies have enforced their jurisdiction beyond national borders. An
order by France’s data protection authority (CNIL) is being appealed by Google to the ECJ. CNIL ordered to
extend the “right to be forgotten” to all of Google’s sites, no matter where they are accessed. Google was fined
100, 000 euros for non-compliance.
If this order is not overturned by the ECJ, the law runs the risk of being exploited by authoritarian regimes to
censor what information people in every part of the world can see online. Experts cite the inherent
incompatibility on how the internet and the laws operate. While the latter is borderless, the former is essentially
tied up to government and national boundaries.

As more cases put the application of this right into question, the authorities charged with its implementation
must constantly reevaluate how it should be put into practice. The rights of data subjects to erase information
about them should not become a tool for rewriting history. Moreover, there may be a legitimate interest in
leaving the information publicly available to educate or forward discourse. In implementing the Right to be
Forgotten, regulators must consider the context in every case, and should not apply it indiscriminately.