The clash of freedoms: The Right to be Forgotten

Erwan Wuilleme - 21 May 2024

Image credit: Juan Suárez / derechoaleer (The Guardian)

“No happiness, no serenity, no hope, no pride, no enjoyment of the present moment could exist without the ability to forget", said Nietzsche. 

He sees forgetting as a tool for the psychological reconstruction of the person. 

It is from this concept that the right to forget has been imagined, to allow for the avoidance of the harmful or painful consequences of recalling information. This idea appears in 1966 and then analyzed by Costaz (1995) as the "prescription of facts that are no longer relevant". Boizard (2016) considers that this "great law of oblivion" is based on the idea that "after a certain period of time, it is superfluous to recall in justice the crimes that have been forgotten and whose effects have disappeared." In the context of the multiplication of internet data, the right to oblivion has become more prominent and also enshrined at the European Union level since 2014. 

However, the need for this ‘right to be forgotten’ seems contradictory to the right to freedom of information and expression, requiring a balance to be struck between respect for privacy and respect for freedom of information.

What is the ‘Right to be Forgotten’ and when does it apply?

Article 12 of the Universal Declaration of Human Rights states that "no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks." As a result, and without any particular event, the concept of the ‘right to be forgotten’ emerged at the end of the 20th century around privacy on the Internet, in the context of the systematic development of new technologies and the proliferation of the Internet. However, the case of Mario Costeja Gonzales in 2014 is a key event concerning the implementation of the ‘right to be forgotten’ as a law. We will come-back to this.

Since 2018, the ‘right to be forgotten’ has been a key element of the European Union's General Data Protection Regulation (GDPR). Article 17 of this regulation covers the rights of an individual or customer to request that all personal data held on him by a company be deleted at his request. The provisions of the GDPR specify that search engines (such as Google) must remove references to personal data that appear publicly in search results. This involves either removing information from the original site (right to erasure) or dereferencing a website by search engines (right to dereference). This is an essential right because it ensures the privacy of an individual. Thus, the Court of Justice of the European Union (CJEU) defines this right as the obligation for a search engine to "remove information relating to that person from the list of results displayed following a search made using that person's name."

A person may therefore request to exercise the right to erasure of his or her personal data. This request must be consistent with several situations. It can succeed if the applicant's data is no longer necessary for the purposes for which they were initially collected or processed, or if the data has been used for prospecting purposes. The individual also may wish to withdraw the consent initially given. Moreover, the request can be successful if the data was collected when the applicant was a minor (such as: on a blog, forum, social network, website...). Finally, it is also possible in the case where the data has been processed unlawfully. Thus, the aim is to give the applicant the right to request and obtain the deletion of their personal data if there is no longer any valid reason to keep them. 

However, the ‘right to be forgotten’ has certain exceptions. First, it does not apply if the data must be available to respect the freedom of information or expression. It also does not apply if the data is related to an ongoing or recent legal proceeding or if it is of public health importance. Finally, the right does not apply if the data must be archived in the public interest because it is important for scientific or historical research. Overall, the exceptions to the ‘right to be forgotten’ revolve around public interest, freedom of expression, and freedom of information.

GDPR frames the procedure of asserting one's ‘right to be forgotten’. The applicant must first contact the search engine via the form provided for this purpose. Then, they have to define the data they wish to dereferer from the search engine, for example. The latter has a period of one month to respond to the person requesting it. If the host does not respond, either by refusal or by lack of response, it is possible to refer the matter to the National Commission for Information Technology and Liberties (CNIL). When filing a complaint online with the CNIL, one must remember that the search engine initially refused to comply with the request. If the CNIL does not respond, by refusal or lack of response, it is then possible to bring the matter before the civil courts.

The paradox of Freedom 

However, the ‘right to be forgotten’ can then be controversial. On the one hand, there is the right to protect an individual's privacy, and on the other, the freedom of expression and freedom of information. Where do we draw the line between the two? How do you balance the two? The main criticism of this decision in favor of the extension of the ‘right to be forgotten’ could lead to global censorship and a violation of the right to freedom of information. The main question is therefore where to draw the line between privacy and freedom of information.

The ‘Mario Costeja Gonzales case’

In 2014, the Spanish judiciary ruled in favour of the ‘right to be forgotten’ in the "Google Spain SL, Google Inc vs Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzales (2014)" case. The case concerned an advertisement published in the newspaper La Vanguardia, mentioning that Mr. Costeja had been subject to a real estate foreclosure in 1998, in order to recover his social security debts. When Mr. Costeja noticed that a search on his name turned up this old ad, he contacted the newspaper in 2009. The newspaper rejected his request claiming that this was contrary to freedom of information. Mr. Costeja then contacted Google Spain to request the removal of this search result. Ultimately, the European Union courts ruled that Google had to remove the search results, but that the newspaper was not obligated to remove the original article. The decision set an important precedent and validated the ‘right to be forgotten’ as law, with several caveats. 

This is where the balance lies between the freedom to protect privacy in our digital era and the freedom of expression and information. Laws and regulations must be established so that individuals can request the deletion of obsolete, inaccurate, harmful or disproportionate information, while guaranteeing transparency and accountability to ensure freedom of information and expression. The balance between the freedom of the individual and the freedom of society will therefore be strengthened.

References:

Boizard, M. (2016). Le temps, le droit à l'oubli et le droit à l'effacement. Les Cahiers de la justice, (4), 619-628.

Available at: https://www.cairn.info/revue-les-cahiers-de-la-justice-2016-4-page-619.htm

Costaz, C. (1995). Le droit à l’oubli. Gaz. Pal, 2, 961.

Available at: https://www.cairn.info/revue-les-cahiers-de-la-justice-2016-4-page-619.htm