Tip #4/10 – Forget me, Now – the new EU Data Protection Regulation

So what’s new about the Right To Be Forgotten (RTBF) that is gaining some attention in the upcoming Data Protection Regulation (GPDR)?

Since the judgment of the ECJ in Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131/12), the Press has been full of articles and opinions about whether this is a practice that inhibits the freedom of expression, or whether individuals should be free to use the so-called “right to be forgotten”. Read more here.

In order to understand, the ECJ judgement is pertaining purely to search results, and auto-complete functionality within the Google search engine. It is not about the original content. For example if something is published in the press, this ruling is not about re-writing history as in George Orwell’s horror scenario, 1984. Everything published, remains printed and searchable in the associated press. What this ruling is about is search engine results and intelligent auto-complete on searches for personal datalinked to an individual who is an EU data subject, that has passed its ‘sell by date’.

The Right To Be Forgotten is not new and was enshrined in the EU Data Protection Directive in 1995!

The thing that is rather amusing with all this fuss and confusions, is that the RTBF has been around in the EU since 1995! It is one of the guiding principles enshrined in the Data Protection Directive, and codified as law in member states, although not wholly effective in all; take a look at Sweden for a bad example of implementation.

In the EU Data Protection Directive and upcoming Regulation, Personal data collected must be collected only to fulfill a purpose as described in the Privacy Notice (see graphic Personal Data Lifecycle, PDLC).  Once the purpose has been fulfilled, personal data must be safely destructed. If personal data is to be used outside of the original purpose, additional consent must be obtained from the data subject.

Hence if personal data linked to an individual is journalistic content (which could include blogs and social media), which falls outside of the scope of PDLC and the Directive, which is where the perceived conflict between Freedom of Speech and Personal Privacy occurs. However there is no conflict. Journalistic content is not effected in the ruling. What has happened is that the RTBF scope has been extended to search engines, which is enshrined in the upcoming GDPR.