EDPB publishes guidelines on the right to be forgotten under EU GDPR
On December 11th 2019, the European Data Protection Board (“EDPB”) published its draft guidelines on the criteria of the right to be forgotten in search engine cases under the EU General Data Protection Regulation.
The Court of Justice of the European Union previously held in its 2014 Costeja decision that individuals have a right to request that search engine operators erase links to web pages which are displayed in response to searches of an individual’s name. This is the “right to request delisting,” and is now recognised in Article 17 of the GDPR as the “right to be forgotten.”
The guidelines aim to clarify:
- The grounds on which individuals can submit a request for the right to be forgotten in relation to links to web pages containing their personal data; and
- The exceptions to the right to be forgotten that search engine operators could use to reject these requests.
In practice, individuals will most likely be able to request delisting because they consider it is no longer necessary that their personal data is processed. Additionally, under Article 21 of the GDPR individuals can exercise their right to object to the processing of their personal data. However, search engine operators can refuse such requests if they can demonstrate compelling legitimate reasons for processing the data in question.
In light of this, the guidelines find that search engine operators obligations to erase personal data are inadequate in cases of delisting requests. The draft guidelines seek to balance the protection of privacy and the interests of internet users in accessing information through search engines. The guidelines conclude that, search engine operators often refuse to delist content where they can demonstrate that its inclusion in is strictly necessary for protecting the freedom of information of internet users.
The EDPB is accepting comments on its guidelines until 5th February 2020.
For further information, contact a member of our Data team