Is the right to be forgotten on the internet guaranteed? The analysis of the communication law lawyer in Paris

by | Mar 1, 2017

Social networks, fortunes and misfortunes

Definition of the right to be forgotten

Right to be forgotten: allows any individual to request the removal of information concerning him on past actions, which could harm him.
In accordance with article 38 of law n ° 78-17 of January 6, 1978 relating to 'computing, files and freedoms (modified by law n ° 2004-801 of August 6, 2004) " Any natural person has the right to object, for legitimate reasons, to the processing of personal data concerning him. It has the right to object, free of charge, to the use of data concerning it for prospecting purposes, in particular commercial, by the current controller or that of subsequent processing. ".

 The right to be forgotten is the subject of significant European legislative work. It is mentioned in the data protection directive of 1995 no. right to be forgotten in Europe.

 

 Relative recognition by the GDPR

  • On April 14, 2016, the European regulation for data protection was adopted (General Data Protection Regulation). This will enter into force on May 24, 2018. It provides in particular that the consent of the subject must be given explicitly, that the powers of the independent national authorities in charge of data protection will be reinforced or that penalties for failure to comply with this regulation will be sent to businesses.

 

In France, on the initiative of the Secretary of State for Forecasting and Development of the Digital Economy, Nathalie Kosciusko-Morizet, two charters relating to the right to digital oblivion were signed in 2010:
– September 30, 2010: Charter of the right to be forgotten digitally in targeted advertising : concerning personal data collected without the Internet user being aware of it;
– October 13, 2010: Charter of the right to digital oblivion in collaborative sites and search engines : concerning the personal data actively published by the Internet user. (Facebook and Google will not be signatories).
 
In 2011 the G29 by an opinion 15/2001 stresses that the user must be able to clearly express his consent.

 The manager of the site where the information is present has a legal period of two months to respond to the complainant's request (in accordance with Article 94 of Decree No. 2005-1309 of October 20, 2005 taken for the application of Law No. 78-17 of January 6, 1978 relating to data processing, files and freedoms). In the event of no response or refusal, the complainant may file a complaint with the CNIL.

 The right to be forgotten applies in practice in two ways:

  • by the removal of the information on the original site, we then speak of the right to erasure (I)
  • by a delisting of the site by search engines, we then speak of the right to delisting (II).

 

  1. The right to erasure

 

According to the CNIL, all you have to do is contact the original site to request deletion. It is possible to find his identity via the legal notices or the general conditions of use.
To do this, it is sufficient to justify the request by explaining how the publication of this content harms reputation or privacy.
Again, the site manager has a legal period of two months to respond to the request. In the absence of a response or in the event of an unsatisfactory response, a complaint may be sent to the CNIL.

 

  1. The right to delisting

 

The procedure for the right to delisting comes from the judgment rendered by the Court of Justice of the European Union on May 13, 2014 (n° C-131/12): In this decision, the Court of Justice of the European Union confirmed the application of data protection law to search engines. It deduced from this that Internet users can request, under certain conditions, the removal of links to information that infringes privacy. As a result, it assimilates search engine operators (Google in this case) to data controllers within the meaning of Directive 95/46/EC and therefore subjects them to it.
With this judgment, the Court of Justice therefore gives a single interpretation of the 1995 directive applicable in the 28 countries of the European Union. 

 The right to delisting, arising from the right to be forgotten, allows a search engine to be asked to delete certain search results associated with surnames and first names.

But beware, this deletion does not mean the deletion of information on the source website. The original content thus remains present and is always accessible via search engines by using other search keywords or by going directly to the site.
 
These search results should be removed if they are " inadequate, not or no longer relevant or excessive ". The Court nevertheless specified that the de-indexing of content must take into account the public interest, while specifying that search engines cannot claim the journalistic value of content to refuse a request for deletion.

 To proceed with a delisting, all you have to do is write to the search engine asking for the removal of this listing.

Indeed, in the weeks following the shutdown “Google Spain”, Google has set up a withdrawal request process providing all European Internet users with a form in their language.

 However, if there is a refusal or a lack of response from the search engine, any person residing in France can then seize the CNIL (or the courts - the CNIL has a "vertical" action of public service for large-scale actions – the judicial judge is more adequate in horizontal private relationships, between adversaries.

 However, such a right is not absolute. The deletion of such data must be assessed on a case-by-case basis. This analysis will be done according to the nature of the information, its invasion of the privacy of the person concerned and the interest for the public to receive it (if there is a character of notoriety attached to the person for example). the date of publication, as well as its political significance will also be taken into account.

 However, the Council of State, in a decision rendered on February 24, 2017, took the liberty of referring several preliminary questions to the Court of Justice of the European Union concerning the implementation of the right to delisting. Indeed, it raises several difficulties relating to the scope of the European directive of October 24, 1995 on the protection of individuals with regard to the processing of personal data, after the first interpretation given by the Court of Justice of the Union. European Union in its judgment “Google Spain”. These questions concern the delisting obligations incumbent on the operator of a search engine in the event that the web pages it processes contain sensitive information, the collection and processing of which is unlawful or highly regulated (because it reveal sexual orientation, political, religious or philosophical opinions, or contain information relating to offences, criminal convictions or security measures). Thus, the Council of State considered that the judgment of the CJEU was not precise enough to allow it to take its decision. He asks the Court whether the rules applicable to sensitive data are applicable to search engines? Should they delink links to web pages that process this data or can they refuse to do so?

 Finally, it should be noted that this procedure only applies to Europe, the European versions of Google in particular. The de-indexation will not be done on the versions of the search engine third countries to the European Union.

 

To summarize the procedure:

 

  • Internet users can approach a search engine operator with a request to delist a web page that would infringe their privacy.
  • The operator will then examine the merits of the request, with regard to the conditions set by the CJEU.
  • In the event of no response or an unsatisfactory response, the complainant may refer the matter to the CNIL or the courts to verify and order the necessary measures.

 

 
 

Submit a Comment

en_GBEnglish
en_GBEnglish fr_FRFrench de_DE_formalGerman es_ESSpanish pt_PTPortuguese it_ITItalian