The right to have your personal data erased in certain circumstances, known as the ‘right to be forgotten’, hit the headlines back in 2014 when the European Court of Justice ruled that Google should amend its search results so as not to display certain information; in that case information about a Spanish citizen’s past financial difficulties.
Now the English courts have followed suit, with the High Court finding that Google had to remove links to articles about an individual’s spent criminal conviction (NT1 & NT2 v Google LLC).
It’s been reported that since the 2014 decision, Google has received requests to remove close to 2 million links/URLs and the recent High Court decision, and forthcoming GDPR, may well prompt an increase in such requests.
However, how broad is the right to be forgotten?
There’s a common misconception that individuals can simply request that all their data be removed in all cases, which is not the case. The right applies in limited circumstances including:
- Where the personal data is no longer necessary in relation to its purpose;
- Where processing is based solely on consent and consent is withdrawn;
- Where the individual objects to the processing and there are no overriding legitimate grounds for the processing; or
- Where personal data have been lawfully processed
Given the wide-ranging implications of the current case, particularly for large serach providers, it is not surprising that permission to appeal was granted by the High Court. We may, therefore, find that we have a Court of Appeal ruling, and perhaps subsequently a Supreme Court ruling, on this matter in the near future.