‘Right to be forgotten’ creates data dilemma

French philosopher Paul Ricoeur wrote “To be forgotten is to die twice”. However, in recent days the Court of Justice of the EU has taken steps towards recognising a “right to be forgotten”, for EU citizens.

The case in question is Google Spain and Google v AEPD and Gonzalez.

It resulted from a complaint by a Spanish citizen, Mario Costeja González, in relation to the appearance, in Google search results for his name, of newspaper reports regarding his old unpaid debts. The Spanish data protection authority upheld his complaint against Google – although not his separate complaint against the newspaper.

Google appealed this decision, with the matter coming before the Grand Chamber of the Court of Justice, the highest and most authoritative interpreter of EU law.

The court ruled that Google must provide users, in certain instances, with a right to delete links about themselves including, in some cases, public records. The court stated that even where personal information about individuals was accurate and had been lawfully published initially, the continued publication of that information may breach EU data protection law in circumstances where, with the elapse of time, the initial publication was no longer relevant.

The court said that the right of a person to insist that information no longer be linked to searches of his name was not absolute and must be balanced against the rights of internet users.

However, the court indicated the privacy rights of the person whose details were published would “as a general rule” take priority over the rights of other internet users, unless the person played a particular role in public life.

The decision has been criticised by some on the basis that it curtails freedom of expression and internet freedom, as well as raising censorship concerns. This is because it will enable people to prevent truthful facts about them from appearing on the internet. The decision will put search engines in the extremely onerous position of having to take a view on how to comply with potentially millions of individual requests.

It will also place national data protection authorities, such as Ireland’s Data Protection Commissioner, in a similarly difficult position.

This is because individuals will be able to complain to a national data protection authority if they are unhappy with a search engine’s response to a “right to be forgotten” request. The authority, in turn, will need to consider, on a case by case basis, whether the public’s interest in access to information exceeds the individual’s privacy rights. Clearly, this is not a straightforward decision.

The EU has spent the last two years debating whether and on what terms a right to be forgotten should be included in a new general data protection regulation (which continues to be debated). Ironically, it seems that such a right already exists under the current regime.

Robert McDonagh and Francis Kieran BL are committee members of the Irish Society for European Law.