Digital Rights in Europe After the Entry Into Force of Regulations for the Protection of Personal Data: Before and After the Right to Be Forgotten

Abstract

This article opens with an analysis of the scope of the protectable legal right to be forgotten, since this must be understood not only in relation to the right to erasure. The right to be forgotten is much more complex, as it needs to cover a wide range of situations. The article proceeds by outlining the main jurisprudential milestones that prefigured the right to be forgotten in the predigital age, considering the Costeja case as a major tipping point. The article goes on to focus on the ambit of the European Union (EU), initially by studying the meaning and impact of the new general data protection regulations that have been in force since May 2018. Subsequently, it analyzes how some EU member states have incorporated this new juridical instrument. Spain, which has updated its legislation in this area in order to fully comply with EU requirements, is a particular focus.

Keywords:

• Right to be forgotten
• right to privacy
• freedom of expression
• European Union
• digital rights

Disclosure Statement

No potential conflict of interest was reported by the author(s).

Notes

1 B. Adsuara, El ciudadano frente al reglamento, in J. López Calvo (ed.), El nuevo marco regulatorio derivado del Reglamento Europeo de Protección de Datos, 167 (2018): “A name, surname, city of origin, age, size, weight, eye color, hair color etc., can be shared by many people and cannot therefore be anyone’s exclusive property. What is protected is not the data per se. The data provide information about someone’s honor or privacy: those are the legal assets that in the end are really being protected.” Here and throughout, unless otherwise specified, translations into English of sources originally published in Spanish were commissioned by the present author for the purposes of this article.

2 A. Rallo Lombarte, Del derecho a la protección de datos a la garantía de nuevos derechos digitales, in A. Rallo Lombarte (ed.), Tratado de protección de datos. Actualizado con la Ley Orgánica 3/2018, de 5 de diciembre, de protección de datos personales y garantía de los derechos digitales (2019).

3 P. Herrera Carpintero, El derecho a la vida privada y las redes sociales en Chile, 5 Rev. Chilena de Derecho y Tecnología 87, 101 (2016).

4 A. Moreno Bobadilla, El derecho al olvido digital: una brecha entre Europa y Estados Unidos, 18 Rev. de Comunicación Universidad de Piura 259, 260 (2016): “Until the creation of the Web 2.0, traditional memory trumped digital memory, requiring the forgetting of certain data and information that the mere passage of time rendered irrelevant.”

5 30th Rapporte d’Activité 2009 of the Commission Nationales de l´Informatique et des Libertés, p. 26.

6 As Meg Leta Jones noted, “To drive home the importance and difficulty of the issue, imagine the worst thing you have ever done, your most shameful secret. Imagine that cringe-inducing incident somehow has made its way online. When future first dates or employers or grandchildren search your name, that incident may be easily discoverable. In a connected world, a life can be ruined in a matter of minutes, and a person, frozen in time. Keeping that embarrassing secret offline is not as easy as it once was.” M. L. Jones, Ctrl + Z: The Right to Be Forgotten (NYU Press, 2016) 3.

7 M. Álvarez Caro, Derecho al olvido en internet: el nuevo paradigma de la privacidad en la era digital 27 (2015): “The right to be forgotten is rooted in what in English is referred to as the right to privacy, as well as in the right to the protection of persona data. One could argue that the right to be forgotten is derived from these two rights.”

8 See P. Anguita Ramírez, Acciones de protección contra Google. Análisis del llamado derecho al olvido en buscadores, redes sociales y medios de comunicación (2016); P. Simón Castellano, El reconocimiento del derecho al olvido digital en España y en la UE (2015).

For Simón, the right to be forgotten proceeds from human dignity, with the objective that each person may freely determine the course of their present and future life. As he points out, “The right to be digitally forgotten may, as a manifestation of human dignity and of the free development of one’s personality, be interpreted as offering citizens a remedy when faced with the diffusion of all past information that may affect them in future, without any care for the impact on the right to a private life. [The right obtains] wherever such information is not protected by the framework of freedom of information” Simón 183.

9 Despite the evolution of the initial thesis of Warren and Brandeis, they were the ones who led the U.S. courts to begin to see this right as susceptible of protection, and unconsciously began to speak of privacy as being related to the right to be forgotten, that is, to the right to have a second chance, making certain information that belongs to the past, and that is no longer of public interest in the present, return to the sphere of privacy. This is precisely the right to digital oblivion: preserving privacy and honor in the virtual environment. And to achieve this, certain information must be deleted or de-indexed.

10 California: Melvin v. Reid, 112 Cal. App. 285, 297 P. 91 (1931).

11 Time Inc. v. Hill, 385 U.S. 374 (1967).

12 I. Covarrubias Cuevas, La vida privada de las figuras públicas. El interés público como argumento que legitima la intromisión en la vida privada 270 (2013): “With this advance detrimental to privacy, the Tribunal provided a constitutional shield to the press to report on the lives of private personas caught up involuntarily in newsworthy events.”

13 California: Briscoe v. Reader’s Digest Assoc., 483 Cal App. P. 2 d (1971). In this case, the country’s highest court reversed a California Court of Appeals ruling in which it had upheld Mr. Briscoe, who sued Reader’s Digest Magazine for publishing a report on his criminal past. However, the Supreme Court upheld the view that a person who has become public is never private again.

14 The Court was called on to resolve a suit brought by one of the lovers of notorious serial killer Henri Landru. The woman brought the case because their relationship was portrayed in a film made many years after the relationship had ended.

15 European Union Court of Justice.

16 A. M. Muñoz Massouh, Eliminación de datos personales en internet: El reconocimiento del derecho al olvido, 4 Rev. Chilena de Derecho y Tecnología 215, 216 (2015): “We must establish at the outset that we understand the right to be forgotten to be that faculty that arises from the conjunction of two presuppositions: i) time-limited access to digital information that contains personal data and ii) the right of the person about whom information is held to demand the elimination, cancellation, de-indexation, or where appropriate, blocking of such information (where, for example, the validity of the data is questionable). This demand can be directed, at the very least, toward search engines, when the public status of the data is no longer justifiable or has served the ends which publication was originally designed to meet. All of this is limited by the need to respect fundamental guarantees of rights such as freedom of expression and of information, and the freedom of the press.”

17 In Chile, various Supreme Court and Appeals Court sentences handed down between 2015 and the present day have made reference to the right to be forgotten. Nonetheless, there is no up-to-date supporting legislation. Some of the resulting verdicts have therefore been contradictory, and the matter of search engines’ responsibility has not been clarified. See, for examples, the following verdicts: Supreme Court cases ref. (“Rol”) Nº 36753-2015, Nº 12873-2015, Nº 9973-2015, Nº 7148- 2015, and Nº 9301-2010; Punta Arenas Court of Appeals cases Rol Nº 708-2016, Rol Nº 682-2015, and Rol Nº 75-2012; Santiago Court of Appeals cases Rol Nº 101605-2015, and Rol Nº 1495-2010; Iquique Court of Appeals case Rol Nº 231-2015.

18 A. Rallo Lombarte, El derecho al olvido en internet. Google versus España (2014). The former director of the Spanish data protection agency AEPD offers an in-depth analysis of the verdict.

19 Agencia Española de Protección de Datos, AEPD.

20 Chile is almost alone among European countries and its South American peers in not having set up a dedicated data protection agency charged with protecting citizens’ digital rights. This draft bill, mentioned earlier, contemplates the setting up of an administrative body, although it is unclear whether or not this would be independent of the existing Council for Transparency, Consejo para la Transparencia.

21 R. M. Orza Linares, La regulación del “derecho al olvido” en la Unión Europea. Aspectos críticos, in F. Durán Ruiz (ed.), Desafíos de la protección de los menores en la sociedad digital. internet, redes sociales y comunicación 125 (2018), 153: “In practice, as of May 29, 2014 a total of 713,255 requests had been received, petitioning for the removal or hiding of 2,000,321 web pages. 43.1% of requests received had been accepted, with 56.9% rejected. In the specific case of Spain, 57,418 requests had required scrutiny of 170,809 pages. Only 38% of requests had been found admissible, with 62% rejected. France was the principal country of origin of requests by volume, with 227,318 petitions and 411,918 pages scrutinized. To date, 48.7% of those have been accepted, with the remaining 51.3% rejected.”

22 Art. 2.2. c) GDPR: “This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity.”

23 J. Aparicio Salom, Derechos del interesado (Arts. 12-19), in J. López Calvo (ed.), El nuevo marco regulatorio derivado del Reglamento Europeo de Protección 363 (2018), 393: “The law regulated by the GDPR is centred on the protection of the individual with regard to information published on the internet. The right to be forgotten is the right that allows persons to eliminate references to certain events in their life that have left a trace on the internet and which could affect their subsequent development as persons, independently of the origins of the references and whether or not their content is true.”

24 A. Moreno Bobadilla & I. Serrano Maíllo, El derecho al olvido digital. Especial consideración al caso chileno, in P. Machado Martins (ed.), Pensamiento Jurídico Central 37 (2017), 44: “The new Regulation arises in response to the lack of coordination prevailing in Europe when each state applies European norms. The Regulations come about to unify criteria, and to attempt to offer a reply to the question of what happens when the entity responsible for data processing is located beyond frontiers. There is a clear legislative intention to defend the rights of European citizens in regard to the protection of their data.”

25 Recital no. 65, GDPR: “A data subject should have […] a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. […] That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child.”

26 Art. 5.2 GDPR: “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

27 J. C. Bajo, Consideraciones sobre el principio de responsabilidad proactiva y diligencia (accountability). Experiencias desde el compliance, in J. López Calvo (ed.), El nuevo marco regulatorio derivado del Reglamento Europeo de Protección de Datos 278 (2018), 281.

28 In Chile, the protection of personal data was incorporated as an autonomous right with constitutional recognition in 2018, modifying Art. 19, subsection 4 of the Constitution to read: “The Constitution assures to all persons the respect and protection of their private life, and the honor of the person and their family, and further assures the protection of their personal data. The handling and protection of this data will be carried out in accordance with such terms and conditions as shall be set down by law.”

29 Art. 35, Constitución Portugal de 1976: “Art. 35 of the Portuguese constitution of 1976 read [in its unamended version]: “Every citizen has the right of access to all mecanographical data that concerns him [sic], which he may require to be corrected and updated, and the right to be informed of the purpose for which they are intended. 2. Information technology may not be used to process data concerning political convictions, religious faith, or private life, save for the purpose of processing statistical data that are not individually identifiable. 3.The allocation of a single national number to any citizen is prohibited.”

30 A. M. Muñoz Massouh, Eliminación de datos personales en internet: El reconocimiento del derecho al olvido, 4 Rev. Chilena de Derecho y Tecnología 215, 218 (2015): “Art. 2.1 of the Basic Law of the Federal Republic of Germany (Grundgesetz) decrees that ‘Every person shall have the right to free development of [his or her] personality, insofar as [s/he] does not violate the rights of others nor offend against the constitutional order, or the moral law.’ German doctrine and jurisprudence have conceived of general personality rights as a fundamental right enshrined in the constitutional right to the free development of one’s personality, and to dignity. The German Constitutional Tribunal has meanwhile pronounced in favor of signaling that general personality rights comprise distinct modes of expression or manifestation, namely: self-determination, self-protection, and representation of the human person him or herself. German law establishes a broader spectrum than ours within the group of personality rights, at least as regards normative recognition. Protection of the free development of personality is therefore made concrete via the protection of various subsets of rights, which have been developed and provided with content through jurisprudence.”

31 P. Simón Castellano, El reconocimiento del derecho al olvido digital en España y en la UE (2015) 182.

32 J. López Calvo, Un reglamento poliédrico que necesita un acercamiento poliédrico, in J. López Calvo (coord.), El nuevo marco regulatorio derivado del Reglamento Europeo de Protección de Datos (2018).

33 M. Sancho López, La protección de datos en el Reino Unido: evolución del right to privacy y escenarios post brexit (2019) 171.

34 STEDH de 16 de julio de 2013, caso Wergrzynowski y Smolczewski v. Polonia.

35 P. Simón Castellano, El reconocimiento del derecho al olvido digital en España y en la UE (2015) 284: “Italian jurisprudential doctrine has recognized a duty of diligence and updating, incumbent on the communications media. In practice, the message has been that while news whose initial publication was licit need not be deleted, the medium responsible for publication is charged with reducing its subsequent accessibility by impeding its indexation should it prove to contain inexact or incomplete data, or where the mere passage of time has caused it to lose its notoriety or public interest, leading it to come to constitute an injury to the rights of the data subject.”

36 Organic Law (Ley Orgánica) 3/2018, of December 5, 2018, on Protection of Personal Data and the Guaranteeing of Digital Rights.

37 Organic Law (Ley Orgánica) 3/2018, of December 5, 2018, on Protection of Personal Data and the Guaranteeing of Digital Rights Art. 93, The Right to be Forgotten in internet Searches: “1. Every person has the right to have internet search engines remove, from the lists of results obtained from a search starting from his or her name, those published links which contain information relating to that person, insofar as such information is inadequate, inaccurate, not relevant, not up to date, or excessive; or has become so via the passage of time, bearing in mind the purposes for which the information was originally captured or processed, the length of time which has elapsed, and the nature and public interest value of the information. The same procedure shall apply when the personal circumstances invoked by the data subject show that his or her rights should prevail over the maintenance of the links by the internet search service. This right shall persist even when the conservation of the information published on the website to which the link connects is licit, and therefore it does not follow that the information should be simultaneously or previously deleted. 2.The exercise of the right referred to in this article shall not impede access to information published on the web site when obtained using search criteria other that the name of the data subject who has invoked his or her right.”

38 Organic Law (Ley Orgánica) 3/2018, of December 5, 2018, on Protection of Personal Data and the Guaranteeing of Digital Rights, Art. 94: Right to be Forgotten by Social Network Services and Equivalents: “1. Every person has the right to deletion, on simple request, of personal data that they have made available to be published by social networking services and equivalent services of the information society. 2. Every person has the right to deletion of personal data concerning them, that has been made available by third parties to be published by social networking services and equivalent services of the information society, insofar as such data is inadequate, inaccurate, not relevant, not up to date, or excessive; or has become so via the passage of time, bearing in mind the purposes for which the information was originally captured or processed, the length of time which has elapsed, and the nature and public interest value of the information. Similarly, such data must be deleted when the personal circumstances invoked by the data subject show that his or her rights should prevail over the maintenance of the links by the internet search service. This provision shall not apply to the third person supply of personal data by a natural person in the course of a purely personal or household activity. 3. Where this right is exercised by a data subject in respect of data that was made available to the service, whether by the data subject or by a third party, when the data subject was a legal minor, the service provider must proceed without delay to deletion at the simple request of the subject, irrespective of whether the circumstances mentioned in subsection 2 obtain.”

39 Organic Law (Ley Orgánica) 3/2018, of December 5, 2018, on Protection of Personal Data and the Guaranteeing of Digital Rights, Art. 96: Right to be Forgotten in internet Searches: Right to a Digital [Testament]: “1. Access to content managed by providers of information society services related to deceased persons will be governed by the following rules: a) Persons who are connected to the deceased by family or de facto ties, as well as the inheritors of the deceased’s estate, may act before providers of information society services for the purposes of access to said contents and to impart such instructions as they see fit regarding their use, disposal, or deletion. An exception is constituted, and the aforementioned persons may not gain access to content relating to the data subject, where the deceased person has expressly forbidden such access or where applicable law forbids it. Nothing in this prohibition shall limit the rights of inheritors to access content that may form part of the deceased person’s estate. b) The executor of the will, and any person or institution who has been expressly designated by the deceased person in this capacity, may also request, in line with the instructions they have received, access to content with a view to carrying out those instructions. c) In the case where the deceased person is a legal minor, these faculties may also be exercised by his or her legal representative or, acting within its competence, by the Public Prosecutor’s Office, which can act ex officio or at the instigation of any natural or legal person with a legitimate interest. d) In the case where the deceased person had a disability, these faculties may also be exercised by those categories of person named in the previous subsection, and in addition by those who were designated support providers if such faculties can be understood as falling within the ambit of this support. 2. Those persons authorized to act under the terms of the previous subsection may decide as to the maintenance or elimination of personal profiles of the deceased person on social networks or equivalent services, except where the deceased had already taken a decision on the matter, in which case his or her wishes will prevail. A service provider who receives a request to delete a profile that falls under the terms of the preceding paragraph must proceed without delay to meet the terms of the request. 3. The prerequisites and conditions for accrediting the validity and enforceability of the mandates and instructions foreseen in article 3 of the present Organic Law, and, where applicable, for the registration of such, will be established by decree. 4.The dispositions made in this article in relation to persons deceased in autonomous regions with their own civil, regional or special law will be regulated according to these latter within their scope of application.”

40 Facts of the case: In the 1980s, the newspaper El País published an article in its print edition regarding the dismantling of a drug trafficking ring, in which a relative of someone in high public office, as well as other members of the elite, were implicated. The article recounted the prison experiences of those involved, which, since they were also drug users, included having suffered withdrawal symptoms. In 2007, El País established non-paywalled access to its digital archive, from which time on, this article was the top result to appear when the name and surname of any of those involved was entered into Google. According to the text of the verdict, “when D.F.C and M.F.C were alerted to this fact by a third party, they requested that El País cease processing their personal data, or alternatively that it substitute their full names and surnames by their initials, adopting, in any case, such technological measures as might be necessary to ensure that the web page where the article had been published was not indexed as a search result when a web search was done seeking information about the plaintiffs. The newspaper refused the request, invoked its fundamental right to freedom of information and claiming it was impossible to avoid indexing by search engines. The refusal was the subject of the legal action.”

41 Constitutional Tribunal (STC) Sentence 58/2018, June 4, 2018, Legal Explanation (Fundamento Jurídico) FJ2: “The plaintiffs in this action have no public profile whatsoever, whether related to their professional activities, their presence in the public sphere, or any other circumstance, consider[ing] that their fundamental right to privacy prevails over the constitutional requirement to publish the Tribunal’s resolutions, and [this Court] therefore considers the exclusion of their specific identifying information from this sentence to be justified.”

42 Constitutional Tribunal (STC) Sentence 58/2018, June 4, 2018, Legal Explanation (Fundamento Jurídico) FJ 7: “This Court has affirmed that the public relevance of information is determined by both its content and the condition of the person to whom it refers. Newsworthiness can also have to do with the recency of a news item, that is to say with its more or less immediate connection to the present time. The theme or subject of a news item may be relevant in an abstract sense, but if it refers to an event that happened years ago, with no connection to a current event, it may have lost part of its public interest or its informative interest, going on to acquire, or not, historical, statistical or scientific interest. Such interest, while undoubtedly important, is not directly related to the formation of informed, free and diverse public opinion: it is rather part of the general development of culture, which of course acts as the bedrock upon which opinions are founded. For this reason it may be called into question, in such cases, that the right to information (art. 20.1 d) of the Constitution) should prevail over a person’s right to privacy (art. 18.1 of the Constitution) when such a person has, after a certain time has elapsed, chosen to request that data and information that may at one time have been of public relevance should be forgotten. Of course, when the news in question has been digitalized and is contained in an archive, the violation of the right to privacy is accompanied by the undermining of the right to informational self-determination (art. 18.4 of the Constitution).”

43 The facts as set out in section (“FD”) 1 were the following: “The state newspaper of record (henceforth, the ‘BOE’) published on September 18, 1999, a Royal Decree dated August 27, 1999 extending a pardon to the plaintiff with regard to the outstanding prison term to which he had been sentenced by the Second Bench of the Supreme Court on January 18, 1990. The sentence represented the resolution of an appeal against a previous verdict, handed down on June 26, 1986 by the Fifth Section of the Audiencia Provincial of Madrid, which found the plaintiff guilty of a crime against public health in regard to acts committed in the year 1981. […] The public body argued in its defense that it had adopted the necessary measures at its disposal to avoid the automization of the plaintiff’s details: it had eliminated his name from the search engine of the BOE and it was not possible, by the time of the hearing, to reach the decree containing the pardon via entering his name into any of the web search functions of the BOE. Additionally, it was argued, indications given by the Spanish data protection agency (in what follows, the ‘AEPD’) had been followed, leading to documents featuring the plaintiff’s name having been placed on a list of exclusions (robots.txt). This list is used to notify businesses running internet search engines that they should not utilize the listed information, which should therefore disappear from internet search results in a matter of days.”

44 Boletín Oficial del Estado.

45 The facts: “Therefore, in the article published in the EI País newspaper and on its blog, reference was made to environmental protection officers having apprehended three suspicious persons who proved to be direct employees of the Galician autonomous administration. The article went on to narrate a confrontation between the ‘suspicious characters’ and the officers, who ended up being subjected to disciplinary sanctions. Further reference was made to the ‘allegedly suspicious persons’ having also been reported by the national Nature Protection Service (‘Seprona’), whose rangers attended the incident and identified the ‘suspicious characters,’ who admitted that they were hunting wild boar. It is stated that the three were later fined for having parked their vehicle in the middle of a fire trail, in contravention of Galician fire regulations.” The Bench considered that the facts as published did not correspond to reality, or at least did not match the narrative contained in the Galicia high court verdict, which claimed, textually, that the agents had met with various hunters to “form crews pre-authorised to hunt in the designated hunting territory known as ‘PenaMaior,’ resulting in incidents which led to three of the hunters being reported for the issuing of threats.”

46 Supreme Court Sentence (“STS”) 12/2019, January 11, 2019, section (“FD”) 3: “In this concrete supposition the plaintiff’s right to the protection of personal data must prevail over the right to freedom of information: ([the plaintiff] had exercised their right to the cancelation of personal data before Google); bearing in mind that the news item that was disseminated via a Google search lacked one of the requisites that must be concurrent in order for the exercise of freedom of information to be considered legitimate; namely the veracity of that information, since the published data was inaccurate. We consider, in effect, that in adjudicating this litigation between Google and the Spanish data protection agency, in the first instance court has given adequate consideration and weight to the rights and interests that are counterposed, in finding in favor of Mr. Federico’s right to protection of his personal data, the legal protection of which had been sought before the data protection agency as against the right to information argued by the firm Google LLC, operator of the internet search engine, since, taking as our point of departure the nature and public significance of the information revealed (which the sentence appealed against considered to be of public relevance insofar as it concerned actions attributed to a public official over the commission of irregular acts while involved in hunting activities that were relevant to his public duties), as well as the sensitive nature of the information for the private life of the person concerned, we are led to the conviction that the facts that were disseminated—the subject of the news item—were partially inaccurate, as can be seen from the aforementioned sentence by the regional high court, which did not find that the hunting had been undertaken in a furtive manner.”

47 Organic Law (Ley Orgánica) 3/2018, of December 5, 2018, on Protection of Personal Data and the Guaranteeing of Digital Rights, Art. 85, The Right to Rectification on the internet: “1. All persons have the right to freedom of expression on the internet. 2. Operators of social networks and equivalent services will adopt adequate protocols that make it possible for the right to rectification to be exercised with respect to users who disseminate content that offends against the right to honor, personal and family privacy on the internet and the right to freely communicate or receive true information, attending to the requisites and procedures set down in Organic Law 2/1984, of March 26, 1984, regulating the right to rectification. When digital communications media are required to act upon a request for rectification that has been made against them, they must proceed to publish in their digital archives a clarificatory notice that makes it clear that the original news item does not reflect the individual’s current situation. This notice must appear in a visible location adjacent to the original information.”