With the development of internet technology, a large number of people, companies, entities and organisations are interacting with each other. The processing of this interaction leaves behind a trail of users’ personal information that can last long after users withdraw their consent for its use and publication. Currently users can only request deletion of data that is incomplete or incorrect. This leaves much to be desired and users understandably complain that their online reputation is at stake when they are not allowed to remove material when they so choose.

Currently users can only request deletion of data that is incomplete or incorrect

For this purpose, a “right to be forgotten” is included in a proposed regulation on data protection published by the European Commission. The General Data Protection Regulation proposes new legal provisions applicable within the social media and online context, such as Facebook and Google. In principle, this right allows users to get their personal information removed from primary websites and any other sites that link to, or republish, their information.

A data controller is obliged to erase any links to, or copy or replication of personal data at the data subject’s request. To secure optimal consumer data protection, a data controller must implement protective, including technical, measures to impede access to the published data. Businesses handling valid requests for erasure must, in addition to deleting the data, take all reasonable steps to inform others using this published data to erase any links to, or copies of, the data.

This may be daunting on businesses, particularly due to the prevalence of copying of websites with personal information being harvested and republished by a large number of other websites without the knowledge or consent of the business.

Nonetheless, heavy punitive fines for companies that refuse to comply with requests to erase customers’ personal details apply. Exempt on the grounds of freedom of expression are journalistic archives, comments on articles or posts by bloggers.

There are genuine concerns that this legal right will fail to deliver on the expectations it creates and will present significant challenges for businesses that have to comply. This is the view shared by the UK. For this reason, it is trying to opt-out. Despite the criticism, it seems likely that a right to be forgotten will remain core to the proposed Regulation.

In the wake of this proposal, the Court of Justice of the European Union (CJEU) was recently requested to provide guidance on this matter.

The case owes its origin to a complaint filed by a Spaniard who searched himself on Google and found a link to a newspaper advertisement that reported that his house was being auctioned for failing to pay an old debt.

This person asked Google to remove the link and when they failed, he reported this to Spain’s data protection authority claiming that this was a breach of data protection laws.

Google on the other hand argued that it cannot be required to erase lawful content from its search index. The national authority agreed with this individual’s position but Google did not remove the link, arguing that the advertisement was published in a newspaper and as such the link should not be taken down.

A legal battle before the Spanish courts followed. The Spanish court upheld the man’s complaint and ordered Google to delete the information the data subject found objectionable. Google challenged this decision before Spain’s national court both on jurisdiction issues, claiming that it should be sued before the Californian courts where its headquarters are based as well as on freedom of information laws, claiming that it cannot be asked to suppress information in an individual’s history that has been widely circulated.

A reference was made to the CJEU to clarify the issues involving individual privacy complaints against search engines, such as Google. Broadly speaking, the EU court was asked to establish how far existing rights allow a person to be forgotten. In particular, the court was requested to clarify whether Google should remove data from its search engine’s index and news aggregator even when it is not the creator of that content and when the information is lawfully published on third parties’ webpages. Equally important referred questions relate to whether the Spanish national authority has jurisdiction to decide on a similar complaint if Google is based in California.

The aim of the proposed regulation is to remove uncertainties in the applicable laws and the necessity of endless referrals to the Court of Justice of the European Union for its guidance and interpretation. It remains to be seen whether the “right to be forgotten” becomes law even before the Court delivers its ruling.

Josette Grech is an associate with Guido de Marco & Associates and heads its European law division.