
Social networks, fortunes and misfortunes
Definition of the right to be forgotten
The right to be forgotten is the subject of significant European legislative work. It is mentioned in the data protection directive of 1995 no. right to be forgotten in Europe.
Relative recognition by the GDPR
- On April 14, 2016, the European regulation for data protection was adopted (General Data Protection Regulation). This will enter into force on May 24, 2018. It provides in particular that the consent of the subject must be given explicitly, that the powers of the independent national authorities in charge of data protection will be reinforced or that penalties for failure to comply with this regulation will be sent to businesses.
The manager of the site where the information is present has a legal period of two months to respond to the complainant's request (in accordance with Article 94 of Decree No. 2005-1309 of October 20, 2005 taken for the application of Law No. 78-17 of January 6, 1978 relating to data processing, files and freedoms). In the event of no response or refusal, the complainant may file a complaint with the CNIL.
The right to be forgotten applies in practice in two ways:
- by the removal of the information on the original site, we then speak of the right to erasure (I)
- by a delisting of the site by search engines, we then speak of the right to delisting (II).
The right to erasure
- The right to delisting
The right to delisting, arising from the right to be forgotten, allows a search engine to be asked to delete certain search results associated with surnames and first names.
To proceed with a delisting, all you have to do is write to the search engine asking for the removal of this listing.
However, if there is a refusal or a lack of response from the search engine, any person residing in France can then seize the CNIL (or the courts - the CNIL has a "vertical" action of public service for large-scale actions – the judicial judge is more adequate in horizontal private relationships, between adversaries.
However, such a right is not absolute. The deletion of such data must be assessed on a case-by-case basis. This analysis will be done according to the nature of the information, its invasion of the privacy of the person concerned and the interest for the public to receive it (if there is a character of notoriety attached to the person for example). the date of publication, as well as its political significance will also be taken into account.
However, the Council of State, in a decision rendered on February 24, 2017, took the liberty of referring several preliminary questions to the Court of Justice of the European Union concerning the implementation of the right to delisting. Indeed, it raises several difficulties relating to the scope of the European directive of October 24, 1995 on the protection of individuals with regard to the processing of personal data, after the first interpretation given by the Court of Justice of the Union. European Union in its judgment “Google Spain”. These questions concern the delisting obligations incumbent on the operator of a search engine in the event that the web pages it processes contain sensitive information, the collection and processing of which is unlawful or highly regulated (because it reveal sexual orientation, political, religious or philosophical opinions, or contain information relating to offences, criminal convictions or security measures). Thus, the Council of State considered that the judgment of the CJEU was not precise enough to allow it to take its decision. He asks the Court whether the rules applicable to sensitive data are applicable to search engines? Should they delink links to web pages that process this data or can they refuse to do so?
Finally, it should be noted that this procedure only applies to Europe, the European versions of Google in particular. The de-indexation will not be done on the versions of the search engine third countries to the European Union.
- Internet users can approach a search engine operator with a request to delist a web page that would infringe their privacy.
- The operator will then examine the merits of the request, with regard to the conditions set by the CJEU.
- In the event of no response or an unsatisfactory response, the complainant may refer the matter to the CNIL or the courts to verify and order the necessary measures.