The Internet offers a wealth of information, but once you're online in a way you don't like, just try to get it off. For those situations, the Right To Be Forgotten (RTBF) was created. In a nutshell, this means you have the right not to be haunted forever with information about you. With the General Data Protection Regulation (GDPR), which is directly applicable from May 25, 2018, the RTBF has been given an explicit legal basis. But even now the right can be exercised. What ground rules should you take into account?
RTBF PUT ON THE MAP
RTBF was first made famous in Europe by the 2014 Google Spain ruling of the European Court of Justice (C-131/12). This case involved a Spaniard who, more than 10 years after the fact, was still facing outdated publications about social insurance debts he incurred.
In the ruling, the European Court explicitly named for the first time that under European privacy rules (Directive 95/46/EC), people have an RTBF. At issue was not whether the publications themselves were lawful. At issue was whether it was lawful that when you searched for this Spaniard's name in Google's search engine, the results list contained references to these publications. To assess that, the Court had to weigh interests between the Spaniard's right to privacy, on the one hand, and Google's and Internet users' right to freedom and collection of information, on the other. For Internet search engines, the Court ruled that a person's right to privacy generally outweighs this, although it may be otherwise under certain circumstances.
HOW CAN SOMEONE EXERCISE THEIR RTBF?
In response to the Google Spain ruling, Internet search engines had to offer the ability to submit removal requests. Google, Yahoo! and Bing - the three largest Internet search engines here - facilitate the RTBF through "removal forms" (see links). These are Web pages - which, by the way, are well hidden within the Web sites of these search engines - on which standard fields can be entered to make a removal request. It must be filled in what URL (the web address of the web page) is involved and why it should be removed from the search results list.
WHEN IS AN APPEAL TO RTBF LIKELY TO SUCCEED?
A removal request from a search engine should be granted if the privacy interest of the person concerned outweighs the economic interest of the search engine and the interest of search engine users in accessing the information. It follows from case law that the privacy interest is generally given greater weight, and a removal request should be accepted on that basis. This sounds rigorous, but in practice it is not so bad. This is because the balancing of interests can also turn out differently depending on the type of information and the privacy interest involved and the interest of the public.
This only still says little in general terms about the success rate for exercising the RTBF. For clarification, European privacy regulators have published guidelines (WP225), which identify criteria that may be relevant when assessing a deletion request. For example, a request is more likely to be granted if it concerns a minor, if the data is inaccurate, irrelevant, excessive and/or outdated given its context, and if it is clear that the person about whom it concerns is adversely affected. In contrast, a request is more likely to be denied if it concerns a public person (such as a top executive), the information is up-to-date and correct, and was published for journalistic purposes.
WHAT IF A REQUEST IS DENIED?
If a removal request is rejected by a search engine, that does not necessarily mean it is the end of the matter. The courts could be the solution. Of course, this does involve costs and can be time-consuming. It can also sometimes attract the attention of the media, which is not the intention. Another option is to ask the Autoriteit Persoonsgegevens to mediate. In line with the guidelines of European regulators, this authority has outlined in its mediation overviews situations in which it may or may not proceed to mediation.
In practice, it mediates in about one in three cases. As of May 11, 2017, the authority had received 155 mediation requests, of which it had actually mediated in 50 cases, as a result of which in 37 cases the search results were still removed. If someone does not want to go to the authority, if the authority does not want to mediate, or if the mediation was unsuccessful, an appeal can (still) be made. This can be successful, as it follows from the case law on the subject that the judge does not always think the same way as the authority.
DOES THE RTBF ONLY APPLY AGAINST SEARCH ENGINES?
Data about someone must be rectified, deleted or blocked if their use is not in accordance with privacy rules. In the Google Spain ruling, RTBF is based on this general privacy law. Because Google Spain deals specifically with Internet search engines, this case cannot be applied one-to-one to other situations. For example, consider the case where someone wants to exercise their RTBF in relation to a website on which the content is published, rather than a search engine.
The function of such a website will not be similar to the function that search engines perform in our society. The impact on someone's privacy is also different when it comes to a specific website rather than references to it in a search engine. Therefore, although a person has an RTBF even in those cases, a different balancing of interests is required. As of May 25, 2018, it will become clearer in what way the RTBF should be applied in such other situations. Then the General Privacy Regulation will apply directly, which also explicitly includes the RTBF. It is therefore advisable for organizations to get an early orientation on how they want to respond to the RTBF under the General Data Protection Regulation.
