Struggling to Erase Personal Data Online: An Analysis of the GDPR and the 'Right to Be Forgotten'

Information is often considered a valuable commodity, and Internet companies capitalize on the vast troves of personal data they collect from their users. However, the challenge of removing private information about yourself from the internet is a significant and ongoing issue. This article explores the complexities surrounding the "right to be forgotten" under the GDPR and how it impacts both data protection and freedom of expression.

The Importance of Personal Data

Internet companies derive considerable value from the data they collect. This data is crucial for improving their services, targeted advertising, and understanding user behavior. Unfortunately, the cost of this information is often minimal, as it is often entered by third parties. This has led to a growing concern over the ability of individuals to control their own personal information.

The 'Right to Be Forgotten' under the GDPR

The General Data Protection Regulation (GDPR) in the European Union provides a mechanism for individuals to request the deletion of their personal data. This is often referred to as the "right to be forgotten." While this directive offers a way for individuals to protect their privacy, it is not without limitations. The GDPR emphasizes that the right to erasure is not absolute and must be assessed on a case-by-case basis.

Case-by-Case Assessment and Balancing Interests

The GDPR and the European Court of Justice (ECJ) have clarified that a detailed assessment is required to determine if a request for erasure should be granted. The ECJ emphasized that neither the right to protect personal data nor the right to freedom of expression are absolute. A fair balance must be struck between the interests of internet users and the rights of individuals.

The ECJ's judgment in the Google Spain case provides an example of this balancing act. In response to a request from a Spanish citizen, Google was ordered to delete certain information deemed irrelevant. However, the underlying content in the newspaper archive was not changed. This ruling indicates that while an individual's data may remain accessible, it is no longer ubiquitous, and their privacy is respected.

Criteria for Data Erasure

Under the GDPR, data erasure requests must meet certain criteria. These criteria include the accuracy, relevance, and proportionality of the links in relation to the purposes of the data processing. For example, the accuracy and relevance of a link may depend significantly on the amount of time that has passed since the original reference to the individual.

While some search results linking to content on other webpages may remain relevant even after a considerable passage of time, others may not be. An individual can therefore ask for such irrelevant or outdated information to be deleted. This reflects the spirit of empowering individuals to manage their personal data while protecting the freedom of expression and the media.

Empowering Individuals and Protecting Freedom of Expression

To achieve this balance, the proposed EU Data Protection Regulation aims to reconcile data protection with the right to freedom of expression, including processing data for journalistic purposes. Article 80 of the proposed Regulation includes a specific clause that obliges Member States to pass national legislation to reconcile data protection with the right to freedom of expression.

The proposal seeks to strengthen freedom of expression and the media through the revision of Europe's data protection rules. The ultimate goal is to strike the right balance between the right to the protection of personal data and freedom of expression, ensuring that individuals can manage their personal information responsibly while maintaining the principles of free speech.

Conclusion

The GDPR and the 'right to be forgotten' bring a significant challenge to the global data landscape, highlighting the complex interplay between personal privacy and free expression. While individuals can request the erasure of their data, the process is not simply a matter of deleting details. Instead, it requires a detailed and fair assessment of the situation, ensuring that personal rights are respected while also upholding the principles of freedom of expression.