The Right to be Forgotten – Or Not

One of the hallmarks of the General Data Protection Regulation (GDPR) in Europe is something called the Right to Be Forgotten. Very simplistically, a data subject can request a data controller to delete any data the controller has about the subject for a variety of reasons. This has hit the search engines hard because they tend to bring up things that are embarrassing like lawsuits or criminal charges.

One of the interesting parts of GDPR is its extraterritoriality play, meaning that it tries to enforce itself outside the European Union.

In this case, a data subject wanted Google to not only erase his data from servers inside the EU, but servers worldwide. The idea being that he really wants to be forgotten.

But Google objected saying it was willing to remove the data from inside the EU but not, for example in the US.

The case went before the European Court of Justice, the EU’s highest court – like the US Supreme Court. In that court the Court’s Advocate General, Maciej Szpunar recommended that the RTBF could only be applied inside the EU.

The ECJ is not required to accept his recommendation, but in this case, it did.

This case comes from a fight between the French privacy commission (CNIL) and Google. Google appealed up to the ECJ and won. This decision is not appealable.

So, for anyone who operates inside and outside the EU, you now have a choice – for better for or for worse.

If you get a RTBF request you can choose to forget the person everywhere worldwide.

OR you can choose to forget it only in the EU.

This is not a decision to be made lightly as it may have business ramifications, so it is nice to know that you have a choice.

Source: Computing