Google has made the decision not to remove links to information that references a businessman’s criminal conviction (a criminal conviction for false accounting from the 1990s) from search engines. This has led to the first ‘right to be forgotten’ case in the English courts with the businessman challenging Googles decision. The hearing that commenced on Tuesday will continue for several days.
What is the ‘right to be forgotten’?
The right to erasure also referred to as ‘right to be forgotten’ is a General Data Protection Regulation (GDPR) principle underpinning the right of an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. The right is not absolute and can be refused if certain circumstances apply.
This right only applies under specific circumstances including:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
- When the individual withdraws consent
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
- The personal data was unlawfully processed
- The personal data has to be erased in order to comply with a legal obligation
- The personal data is processed in relation to the offer of information society services to a child
The right can be refused under circumstances including:
- to exercise the right of freedom of expression and information
- to comply with a legal obligation for the performance of a public interest task or exercise of official authority
- for public health purposes in the public interest
- archiving purposes in the public interest, scientific research historical research or statistical purposes
- the exercise or defence of legal claims
With this in mind, the case is unfolding as follows…
Google believe that it is in the public’s interest that this data not be removed and said it would “defend the public’s right to access lawful information”.
The businessman, however, believes this information relating to him should be removed as the conviction is deemed spent under the Rehabilitation of Offenders Act 1974.
So far, Google has been asked to delist nearly two million search results in Europe and has removed more than 800,000 of them.
Another ‘right to be forgotten’ claim against Google is to be heard next month, involving an individual that was convicted of conspiracy to intercept communications over 10 years ago.
In May, the GDPR will be enforced and many more of these ‘right to be forgotten’ cases will surface and will be heard. Google says it’s received more than 650,000 ‘right to be forgotten’ requests since a European court ordered the company to allow Europeans the “right to be forgotten” in 2014.
Do you have measures in place to action the GDPR requirements?
It is important that organisations processing personal data of EU citizens have measures in place to action GDPR requirements. Not only securing personal information but have the capability to quickly respond to GDPR related requests to address the rights of the data subject. These include: subject access requests, erasure of data (right to be forgotten) and data portability. The data subject can request these and organisations must be able to comply.
The Guardian:
BBC:
https://www.bbc.co.uk/news/technology-43211897
ICO:
