What is the right to forget?
Under the cos è il diritto all oblio, a data subject can demand that information that can be directly or indirectly traced back to him or her is deleted. The right to be forgotten is one of the rights of data subjects under the GDPR .
In a number of cases, a controller must erase personal data of a data subject as soon as possible, for example if:
- Personal data are no longer necessary for the purposes for which they were originally collected or processed.
- The data subject withdraws consent and there is no other legal ground for the processing.
- The personal data has been unlawfully processed.
- A data subject objects to the processing and there are no overriding legitimate grounds for the processing.
An organization that has made the personal data public must take reasonable steps to inform other controllers of the request for erasure of the data.
Deleting data is not always possible, for example if legislation requires a minimum retention period.
The right to be forgotten is also called the right to be forgotten, the right to be forgotten or RTBF. It is included in Article 17 of the General Data Protection Regulation (GDPR) as the right to erasure.
Right to forget in examples
Many organizations have now developed procedures for changing or deleting data. Forms are often available on the website for this, or you can call a special telephone number.
In any case, organizations that have no valid reason to still process your data must remove it on their own initiative. As mentioned before, not all removal requests can be honored. For example, everyone wants to have their data deleted from the BKR register.
As with all requests from data subjects, a request for erasure must in principle be processed within one month. Depending on the complexity of the requests and the number of requests, this period may be extended by two months
Below we take a closer look at the right to forget in search engines and the right to forget when deleting online accounts.
Right to forget in search engines
The right to forget also concerns the removal of references in the results of search engines. Important court decisions have already been made in this regard.
For example, the right to be forgotten came into the news after the European Court of Justice ruled on 13 May 2014 that under the applicable privacy legislation, individuals have the right to have certain results removed from a search engine ( C-131/12, the Cotija judgment ). Please note, when this judgment was handed down, the GDPR had not yet entered into force and the European privacy directive was applicable. However, the outcome would have been no different under the GDPR oblio immagini.
Right to forget = right to delete
In fact , the said judgment concerns the right to remove links in search engine results . The original source referred to, for example a newspaper article, remains. Only certain data are no longer shown by the search engine if the name of the person concerned is searched. Other search terms can lead to this data.
Although the original case concerned the request to remove results from Google, the ruling of the European Court is important for all search engines.
Removal request – conditions for removal from search results
The European Court ruled in its landmark judgment that search engines must remove links to pages if searches are made by name and the references are incorrect, incomplete, outdated, irrelevant or excessive.
The ruling does not mean that people or organizations will simply remove unwelcome mentions from the search results. In the background, the trade-off between freedom of information versus censorship plays a role here. Search engines are important in society. With each removal request, the personal interest of the data subject must be weighed against the general interest of free information gathering. A celebrity or politician will not easily have a link to unwelcome content removed because he or she is simply part of public life.
Also read: sharenting