The Right to be Forgotten is enshrined under Article 17 of the GDPR. A data subject can request the data controller to erase their personal data under certain circumstances enumerated under Article 17. One of those circumstances is when the data subject withdraws their consent to lawful processing which we had discussed under Article 7.
When the data subject exercises its right under Article 17, the organisation or the entity shall delete all of the data subject’s personal data that has been collected for the purposes of processing.
However, the data controller can refuse to erase the data if there is a violation to the freedom of speech and expression or if the data is being used to comply with a legal ruling or obligation or in public interest.
An interesting case was decided in the favour of a convict when he exercised his right to be forgotten. Let us have a look at the case details:
Background:
It all started in 2015 when Data Protection Ombudsman of Finland wrote to Google asking that the details of a man convicted of murder should be removed from the search engine. The ombudsman held that the man’s details available on the internet infringed his right to privacy and were not necessary since the convict had diminished responsibility in the murder due to his mental illness.
However, Google contended that removing the convict’s details would result in restricting the freedom of speech and expression. Google complained to the Administrative Court of Helsinki in relation to this matter.
Judgment:
The Administrative Court of Finland did not overrule the Data Protection Ombudsman’s request to erase the convict’s data hence Google appealed to the Supreme Administrative Court which upheld the Data Protection Ombudsman’s decision.
It was held that the person in question has a right to privacy and this will not clash with the right to freedom of speech and expression nor the right to have information about important persons which was Google’s defence.
The Supreme Court also took into consideration the man’s mental health which was easily available on the search engine which is classified as sensitive data and does not need to be revealed to the public at large.
Conclusion:
This judgment has received criticism from various quarters. Technology experts are of the opinion that if criminals continue to exercise the right to be forgotten, various news outlets will not be able to make available to the public reports of crime that have taken place. It could become very difficult to carry out due diligence for organisations and businesses because they will not know whether the individual who they are hiring or doing business with has links to any criminal activities. This could be even more dangerous than protecting the right to privacy.
However, it is the final call of the Data Protection Authority of each Member State to accede to such requests or take a call only after weighing the pros and cons of each case.
References:
-https://www.gfmag.com
-https://datainnovation.org
-https://yle.fi