The Right to be Forgotten is most robustly codified in the General Data Protection Regulation GDPR. This right was initally recognized during the EU case Google v. Spain. The precedent set was that compaines that manages search engines and profit from data -like Google- should remove links to private information when they are asked to as long as the information is no longer relevant. This right to delete data doesn't extend to news sources that are asked to remove articles. The court did state that the right to privacy outweighs the economic interests of data collectors and sometimes even the general interest the public has in accessing information.
The Right to be Forgotten is further codified in Recitals 65 and 66 and in Article 17 of the GDPR. This right is not absolute however. Article 17 give specific circumstances in which someone has the right to delete their personal data:
- The personal data is no longer necessary for the purpose an organization originally collected or processed it.
- An organization is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent.
- An organization is relying on legitimate interests as its justification for processing an individual’s data, the individual objects to this processing, and there is no overriding legitimate interest for the organization to continue with the processing.
- An organization is processing personal data for direct marketing purposes and the individual objects to this processing.
- An organization processed an individual’s personal data unlawfully.
- An organization must erase personal data in order to comply with a legal ruling or obligation.
- An organization has processed a child’s personal data to offer their information society services.
There are alos some limits to these circumstances. An organization's right to process data may trump the individuals right to be forgotten when:
- The data is being used to exercise the right of freedom of expression and information.
- The data is being used to comply with a legal ruling or obligation.
- The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority.
- The data being processed is necessary for public health purposes and serves in the public interest.
- The data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy.
- The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
- The data is being used for the establishment of a legal defense or in the exercise of other legal claims.
These rights also only apply to EU member states. The U.S. has yet to recognize this right. This is despite a pew research poll which found that 74% of people surveyed supported a right to be forgotten. In fact, the Ninth Circuit ruled that the Right to be Forgotten does not exist yet in the U.S. in Garcia v. Google. It seems clear that if a right to be forgotten is to be established in the U.S. it won't happen through the courts. Therefore, legislation is needed to recognize this right. If having control of your data is important to you, please reach out to your legislator. We know it is important to us here at DeleteYourData.com.