The right to be forgotten digitally: an explicit consecration of the GDPR

Obtaining information about a partner, a client or an employee by “Googling” them is now automatic for many of us.

Between social networks, press articles and publications of all kinds, neither the existence nor the diversity of accessible databases can be denied to all and at all times.

Although very useful, this “self-service” provision of personal information leads us to question the true survival of the right to privacy in the digital domain.

At the heart of this discussion, the General Data Protection Regulation (known as “GDPR”) has, since 2018, granted European citizens distinct rights allowing them to have full control over their personal data. Among these, the famous right to erasure or “right to be forgotten” whose scope and methods of exercise should be explained below.

What is the right to be forgotten?

When we talk about the “right to be forgotten”, we are actually talking about the right to erasure set out in Article 17 of the GDPR. This grants any citizen residing in a member country of the European Union the right to obtain from the data controller the erasure, as soon as possible, of personal data concerning him. The right to be forgotten therefore serves to prevent the illicit use of an individual’s personal data, whether they have been previously provided voluntarily by the latter or to without his knowledge.

In addition to the possibility of requesting the erasure of personal data, the right to be forgotten also includes the right to deference. In the latter case, a search engine is specifically ordered to delete, as long as there is no legitimate reason to keep them, search results associated with an individual’s personal data (ex: your first and last name).

The right to be forgotten for whom and for what?

• The right to be forgotten only grants prerogatives to “data subjects”, understood as any natural person whose personal data is collected.
  In this sense, a legal entity (an association, an SAS, an SARL, etc.) cannot use this right to erase data about it (e.g. the name of an association cited in an article giving it bad publicity).
• The right to be forgotten applies to “personal” data. Within the meaning of the GDPR, personal data relates to a natural person identified or identifiable directly (e.g. by their first or last name) or indirectly (by their photo, voice, telephone number, email address, etc.).

In addition to these preliminary requirements, Article 17 of the GDPR expressly limits the circumstances for exercising the right to be forgotten to the following situations:

Therefore, it is important to observe that the right to be forgotten in no way constitutes an absolute right.

And for good reason, the data controller may reserve the right to retain the personal data of an individual (notwithstanding the exercise of the right to be forgotten), as long as the use made of them is justified and necessary:

Therefore, a balance must always be struck between an individual’s right to privacy and the public’s right to general information; the arbitration of these two rights being intrinsically linked to the nature of the personal data targeted by the processing.

The right to be forgotten: how to implement it?

As mentioned, the right to be forgotten requires data controllers to put in place a system allowing them to respond, as soon as possible, to a request for erasure of personal data.

As an example, the following application situations can be cited: closure of a user account on a given platform, opposition to a press article contravening the provisions of the GDPR, fraudulent use of personal data by a social network.

To exercise their right to be forgotten, the person concerned must make a request to the person responsible for processing their personal data. Such a request must necessarily state the data concerned and the facts justifying the erasure or delisting thereof.

In the event of refusal or inaction by the data controller, the person concerned may contact the CNIL so that it can carry out an investigation (which may give rise to measures such as reminders, formal notices, or even financial sanctions).

The right to erasure, also called “right to be forgotten”, constitutes one of the main axes of the GDPR, the LEGALPROTECH-AVOCATS firm will in any case be able to put its legal practice at your disposal in order to support you in the exercise of your rights; both with regard to an amicable procedure and in the context of litigation.

Daniella TSHEFU – Lawyer at the Quebec Bar, GDPR lawyer