Of the various data subject rights under the General Data Protection Regulation ('GDPR'), the so-called right tten ('RTBF') perhaps attracts tion. When considering the RTBF, it is important to remember that this right is only available to data subjects in certain circumstances and its application is subject to the various exceptions examined below.
Google Spain v Gonzalez
The RTBF came to particular prominence due to the Court of Justice of the European Union's ('CJEU') landmark 2014 ruling in Google Spain v Gonzalez. Based on the premise that Google's search engine activities (of indexing, storing and making information available to the public) constituted 'processing of personal data' under the Data Protection Directive (Directive 95/46/EC), and consequently that Google was a data controller, the CJEU ruled that Google was required to permanently erase links from its search results relating to the plaintiff. The Court established that this right was available not only where search results are inaccurate, but also where they are 'inadequate... no longer relevant or excessive in light of the time that has elapsed'. In terms of precedent, the Gonzalez ruling is limited to search engine results and the underlying news articles containing the relevant personal data were unaffected.
Article 17 of the GDPR
By contrast, the RTBF under Article 17 of the GDPR provides data subjects with a more general right to request erasure of personal data relating to them and in a wider set of circumstances. Subject to the exceptions discussed below, controllers are required to erase personal data (within one month of receipt of a request) in the following circumstances:
where personal data are no longer necessary for the purposes for which they are processed; where the data subject withdraws their consent (and the processing is based on consent); where the data subject objects to legitimate interest-based processing (and the controller does not have an overriding legitimate interest); where the personal data have been unlawfully processed; where EU or national law requires erasure of the personal data; and/or where personal data have been collected in relation to a service offering by an information society service offered to children (i.e. data subjects under the age of 13 or 16 depending on the Member State). The RTBF is not an absolute right and controllers should carefully consider the various exceptions to the RTBF when responding to any data subject requests.
The exceptions to the RTBF may be generally categorised as exceptions based on: (i) lawful basis; (ii)...