It’s been a year since GDPR clarified how individuals could enforce their right to be forgotten. In that time Nath Solicitors in London has seen an increase in requests from individuals to assist them in removal of sensitive personal data stored by companies, including online search engines like Google. We have also advised companies on how they can comply with requests for removal of data and how they can apply exemptions to data they hold so that erasure is not mandatory.
WHAT IS THE RIGHT TO BE FORGOTTEN?
GDPR is all about enhancing the protection of individuals and their personal information. The right to be forgotten (or the ‘right to erasure’) enables an individual to ask an organisation to remove his or her personal data from their systems when there is no compelling reason for it to be stored.
Many of the reported cases in this area predate GDPR and relate to search engines like Google. They illustrate how strongly companies like Google originally fought against enabling the right to be forgotten. The case of Spanish plastic surgeon Hugo Guidotti Russo is one of the most widely known right to be forgotten cases. Mr. Russo was angered by the fact that users who searched for him on Google were led to a 20 year-old newspaper report from one of Spain’s major papers about a lady who sued him for millions of dollars because of a plastic surgery operation she says went wrong. While the report mentioned that he faced imprisonment and a huge fine there was no mention of the fact that he was ultimately acquitted of any charges and that any civil claim against him was unsuccessful.
GOOGLE v SPAIN
The right to be forgotten was brought to a greater attention of the public by the Court of Justice of the European Union’s (CJEU) Google Spain decision. Mario Costeja González, a Spanish national, made a complaint to the Spanish Data Protection Agency (AEPD) against La Vanguardia newspaper, Google Spain and Google Inc, in relation to pages in the newspaper that appeared in Google search results when his name was searched for.
The AEPD rejected the claim against La Vanguardia as the information had been lawfully published by it, but upheld the complaint against both Google entities and requested that they take the necessary measures to withdraw the personal data from their indexes. Google Spain and Google Inc brought actions before the High Court seeking to have the AEPD decision cancelled. The Spanish High Court referred the matter to the CJEU. Ultimately the EU court agreed with Mr González and Google took down the information.
IS GOOGLE THE ONLY ORGANISATION AFFECTED BY THE RIGHT TO BE FORGOTTEN?
While cases against Google and other search engines are at the forefront of the development of the law on the right to erasure remember that GDPR applies to all data controllers. Google is just one such controller.
It may therefore be invoked in a whole range of situations – not just to remove embarrassing social media posts or defamatory or damaging information that online search results reveal. Any company that holds personal information may be requested to remove it. This has implications for HR departments and marketing companies amongst others. Is there a compelling reason to retain details of lapsed disciplinary measures taken against an employee for example? Or should marketing companies be able to hold on to information gathered about customers in the past?
WHAT DOES GDPR SAY?
The right to be forgotten is not a blanket right. It must be balanced with other rights such as the right to freedom of expression. GDPR sets out several ways data can be exempt from the right to erasure. These are as follows:
- When the data processing is necessary to exercise freedom of expression and information
- When the data is used to comply with a legal obligation
- When processors are performing a task carried out in the public interest or in the exercise of official authority
- If the data is processed for research or statistical reasons that are in the public interest (for example scientific studies)
- When data processing is for the establishment, exercise or defence of legal claims.
HOW WE CAN HELP
At Nath Solicitors in London it’s the application and interpretation of these exemptions that we are regularly asked to advise on. In the past, internet search engines and other companies have been slow to remove material under the right to be forgotten. This has changed. Google now has processes in place for dealing with right to be forgotten requests. It even publishes details of the number of requests it receives and how many of these are successful (in 2017/2018 it received 655,000 requests to de-list 2.5 million links and took down four in ten).
These figures reveal that Google still removes only a low proportion of links in response to right to be forgotten requests. And it’s why legal advice is essential for anyone considering a right to be forgotten request or companies facing such requests, The low success rate we believe is in large part down to the fact that requests don’t demonstrate how the relevant data meets the legal criteria for removal. It’s crucial to make the strongest possible case to Google and other data controllers when seeking to have information removed. At Nath Solicitors we can ensure your case is robustly argued and pursue your case with the Information Commissioner if necessary.
If you have concerns about data a company holds on you or your organisation has received a request to erase information about a data subject contact Shubha Nath on 0203 983 8278 or contact the firm online.
