10 key questions on the Right to be Forgotten

1 What is the Right to be Forgotten?

According to Constitutional Court ruling 58/2018 of 4 June, the right to be forgotten:

“(… )is specified as the right to obtain without undue delay from the controller of personal data relating to an individual the erasure of such data when they are no longer necessary for the purposes for which they were collected or processed; when the consent on which the processing was based is withdrawn; where the data subject objects to the processing; where the data have been unlawfully processed; where it is necessary to comply with Union or Member State law; or where the data have been obtained in connection with the provision of information society services. (…)”.

2 How can I exercise it and with whom?

In accordance with the Spanish Data Protection Agency (hereinafter, AEPD)

“Data protection regulations establish that in order to exercise the right to erasure (and, therefore, the ‘right to be forgotten’) it is essential for the citizen to first contact the entity that is processing their data, in this case the search engine. The major search engines have set up their own forms (Google, Bing or Yahoo) to receive requests to exercise this right in this area. If the entity does not respond to the request made or the citizen considers that the response received is not adequate, he or she may file a complaint with the Spanish Data Protection Agency”.

3 Who is the data controller? The website? The search engine? Both? Is it sufficient to exercise this right with the search engine or can I also go to the websites on which the information containing my personal data appears?

The following judgments answer this question:

• Ruling 4132/2015 of 15 October 2015 of the Supreme Court (hereinafter SC)

“The publisher of a website containing personal data processes personal data and as such is responsible for ensuring that such data processing complies with the requirements of the law, in particular those deriving from the principle of data quality.

• Judgment of the Court of Justice of the European Union (hereinafter CJEU) T of 13 May 2014:

“However, it is the operator of the search engine who determines the purposes and means of that activity and thus of the processing of personal data carried out by him in the context of that activity and must therefore be regarded as the ‘controller’ of that processing pursuant to Article 2(d)”.

Consequently, the data subject may contact both the website where his or her personal data is explicitly referenced and the search engine that indexes the results leading to that website, in order to exercise his or her right to be forgotten or to have the data deleted.

4 What is the territorial scope of application of this right?

We will answer this question together with the following one by means of a CJEU Judgment

5 Can I complain about a search engine or controller that is not located in the EU?

In its judgment C-507/17 of 24 September 2019, the CJEU confirms the aforementioned exclusively EU territorial scope and extends the possibility of exercising the right of suppression to search engines that, despite having their registered office outside the EU, have establishments within the EU:

“In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in France carries on activities, in particular commercial and advertising activities, which are inextricably linked to the processing of personal data (…). The referring court considers that, in those circumstances, such processing takes place in Google’s establishment situated on French territory. Such a situation therefore falls within the territorial scope of Directive 95/46 and Regulation 2016/679′.

It is important to note that, although the effective exercise of the right to suppress the non-EU versions of the search engine, the CJEU eventually clarified that:

“(…) the operator of a search engine which considers a request for the removal of links under those provisions shall be obliged to carry out such removal, not in all versions of its search engine, but in the versions of that engine corresponding to all the Member States, if necessary in combination with measures which, in full compliance with the legal requirements, effectively prevent or at least make it seriously difficult for internet users who carry out a search on the basis of the name of the person concerned from one of the Member States to gain access (…)’.

6 Does the information disappear from the internet if I exercise my right of deletion only with the search engine?

No, only the results linked to the unlawfully processed data disappear.

• This is the view of the CJEU in its judgment of 13 May 2014:

“(…), the supervisory authority or the court may order that operator to remove from the list of results obtained following a search based on the name of a person links to websites published by third parties and containing information relating to that person, without an order to that effect presupposing that that name or that information is, with the full agreement of the publisher or by order of one of those authorities, previously or simultaneously removed from the website on which it was published”.

7 Am I obliged to inform search engines to remove the results associated with my request if, instead of exercising my right of removal against the search engine, I exercise my right of removal against a website?

• The CJEU, in its judgment c-129/21 of 27 October 2022, responds:

“As the Commission rightly points out, in order to ensure the effectiveness of the right to withdraw consent under Article 7(3) of the GDPR and to ensure that the data subject’s consent is strictly linked to the purpose for which it was given, the controller to whom the data subject has addressed to withdraw his consent to the processing of his personal data is indeed obliged to inform any person who has transmitted those data to him and to whom he has transmitted, in turn, those data. (…)”.

8 What happens if the controller refuses my request?

• This question was addressed by the CJEU in judgment C-460/20 of 8 December 2022:

“(…) where the operator of the search engine does not comply with the request for the removal of links, the interested party must be able to bring the matter before the supervisory authority or the courts so that they can carry out the necessary checks and order the operator to take the necessary measures (…)”.

Si te ha interesado este artículo no dudes en leer:

Is it legal to sell data in Spain?

The transfer or sale of personal data is regulated in Recital 34 and Article 10 of DIRECTIVE (EU) 2019/770 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 20 May 2019.

9 Do the searches I intend to remove have to contain my entire name?

Not necessarily.

• The Supreme Court addresses this issue in its ruling 1624/2020, 27 November 2020:

“The exercise of the right of objection (….) entitles the person concerned to require the operator of a search engine to remove from the list of results obtained as a result of a search carried out on the basis of either his full name or his two surnames, links to web pages, lawfully published by third parties, which contain truthful data and information relating to his person, when the dissemination of such information, relating to his person, undermines the right to honour, privacy or self-image of the person concerned, and is not in the public interest (…)”.

Consequently, it will be possible to request the exercise of the right to be forgotten in cases where reference is made only to the surnames of the injured party.

10 Are there any limitations or exemptions to exercising the right of erasure?

Yes, case law is clear in stating that this is not an absolute right.

Firstly, we find the SC, which, in turn citing the Constitutional Court, emphasises the constitutional protection of freedom of information over the right to suppression when it is exercised by public authorities:

• STS 1624/2020, 20 December:

“b) (…) the constitutional protection of freedom of information, and its possible prevalence over the rights of the personality, requires that the information refers to facts of public relevance, in the sense of being newsworthy.

(…) As we have said on repeated occasions, public authorities and officials, as well as public figures or those engaged in activities that entail public notoriety “voluntarily accept the risk that their subjective rights of personality may be affected by adverse criticism, opinions or revelations and, therefore, the right to information reaches, in relation to them, its maximum level of legitimising efficacy, insofar as their life and moral conduct participate in the general interest with a greater intensity than that of those private persons who, without a vocation for public projection, are circumstantially involved in matters of public importance, to whom it is necessary, therefore, to recognise a higher level of privacy, which prevents granting general importance to facts or conduct that would have it if they were referred to public figures”.

• For its part, the CJEU also ruled in its judgment C-460/20 of 8 December 2022:

“The fact that Article 17(3)(a) of the GDPR already expressly states that the data subject’s right to be forgotten is excluded when the processing is necessary for the exercise of, inter alia, the right to freedom of information (….) shows that the right to the protection of personal data is not an absolute right, but, as underlined in recital 4 of the GDPR, must be considered in relation to its function in society and in balance with other fundamental rights, in accordance with the principle of proportionality (…)”.

If you liked this article, you may also find it interesting to read the following one:

How to comply with the GPRD after the Schrems II ruling