The right to be forgotten
Having false, misleading or outdated information about you online can be hugely detrimental to both your professional and person life, so what can you do about it?
In 2014 the European Court of Justice ruled in Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (Case C-131/12) that European citizens have a right to request that commercial search firms, such as Google, which gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant.
In April 2018, in NT 1 & NT 2 v Google LLC [2018] EWHC 799 (QB) the High Court of England and Wales made its first delisting order compelling Google to remove links where it had rejected a request.
The right to be forgotten
The right to be forgotten is the right for an individual not to have their personal data (often their name) processed where the processing is “inadequate, irrelevant, no longer relevant or excessive”. An individual is entitled to request that Google or other search engine operators filter such results against searches of their name.
Following on from the right to be forgotten, the English 2018 Data Protection Act and the General Data Protection Regulation (GDPR) created a right to Erasure, essentially a statutory version of the right to be forgotten.
Under Article 17 GDPR, individuals have the right to have their personal data erased. This right is however not absolute, but the allowable reasons to erase individual’s personal data are:
- The personal data is no longer necessary for the purpose an organisation originally collected or processed it.
- An organisation is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent.
- An organisation is relying on legitimate interests as its justification for processing an individual’s data, but the individual objects to this processing, and there is no overriding legitimate interest for the organisation to continue with the processing.
- An organisation is processing personal data for direct marketing purposes and the individual objects to this processing.
- An organisation has processed an individual’s personal data unlawfully.
- An organisation must erase personal data if so required by a legal ruling or obligation.
A robust application to the organisation is required setting out why the personal information is inaccurate, inadequate, irrelevant or excessive. Once the application is submitted, the search engine organisation must review and make a decision.
If such an application is refused, we can request the search engine to review its decision, complain to the Information Commissioner’s Office (ICO) or seek a court order requiring the search engine to filter the search engine results.
Contact our data protection lawyers today
In this complex sector, Saunders Law represents clients both in making the initial application and following it up if the application is refused. If you want your personal information to be filtered from the search engine, our team below would be happy to assist.