At the end of January, the European Commissioner for Justice, Fundamental Rights, and Citizenship, Viviane Reding, announced the European Commission’s proposal to create a sweeping new privacy right—the “right to be forgotten.”
The Court, in its judgement did not elevate the right to be forgotten to a “super right” trumping other fundamental rights, such as the freedom of expression or the freedom of the media.
On the contrary, it confirmed that the right to get your data erased is not absolute and has clear limits. The request for erasure has to be assessed on a case-by-case basis. It only applies where personal data storage is no longer necessary, or is irrelevant for the original purposes of the processing for which the data was collected. Removing irrelevant and outdated links is not tantamount to deleting content.
The Court also clarified, that a case-by-case assessment will be needed. Neither the right to the protection of personal data, nor and the right to freedom of expression are absolute rights. A fair balance should be sought between the legitimate interest of internet users and the person’s fundamental rights. Freedom of expression carries with it responsibilities and has limits both in the online and offline world.
This balance may depend on the nature of the information in question, its sensitivity for the person’s private life, and on the public interest in having that information. It may also depend on the personality in question: the Right to be Forgotten.
Google will have to assess deletion requests on a case-by-case basis, and to apply the criteria mentioned in EU law and the European Court’s judgment. These criteria relate to the accuracy, adequacy, relevance -including time passed - and proportionality of the links, in relation to the purposes of the data processing (paragraph 93 of the ruling). The criteria for accuracy and relevance for example, may critically depend on how much time has passed since the original references to a person. While some search results linking to content on other webpages may remain relevant even after a considerable passage of time, others will not be so, and an individual may legitimately ask to have them deleted.
This is exactly the spirit of the proposed EU data protection regulation: empowering individuals to manage their personal data while explicitly protecting the freedom of expression and of the media. Article 80 of the proposed regulation includes a specific clause which obliges Member States to pass national legislation to reconcile data protection with the right to freedom of expression, including the processing of data for journalistic purposes. The clause specifically asks for the type of balancing that the Court outlined in its ruling whereas today’s 1995 Directive is silently implying that data protection could rank above freedom of the media. The Commission proposes to strengthen freedom of expression and of the media through the revision of Europe’s data protection rules.