Right to be forgotten

The right to be forgotten — codified at GDPR Article 17 as the “right to erasure” — is the right of a data subject to obtain from a controller the erasure of personal data concerning them, on grounds including that the data is no longer necessary for the original purpose, that consent has been withdrawn and no other lawful basis applies, that the processing is unlawful, that the data subject objects to processing on legitimate-interest or public-task grounds and no overriding interest exists, or that the data was collected in connection with a child’s consent to information-society services.

The right is not absolute. Article 17(3) carves out important exceptions: where the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archival or scientific purposes, or for the establishment, exercise, or defence of legal claims. The first of these exceptions — freedom of expression — is the one that consistently produces case-law tension when an erasure claim brushes against journalism.

The foundational case is Google Spain v AEPD and Mario Costeja González, Court of Justice of the EU case C-131/12, decided in 2014. The judgment established that search engines, as data controllers, must on request remove from search results links to lawfully-published material that is “inadequate, irrelevant, or no longer relevant” — and that the public-interest test in the freedom-of-expression carve-out is not automatic. The procedural mechanism that has developed since is operator-side review with appeal to the supervisory data-protection authority and, ultimately, to court.

For an offshore-hosting operator the right matters in two ways. As a controller of subscriber data the operator owes erasure obligations on the conditions of Article 17. As a host of journalism the operator is also a substrate for the freedom-of-expression exception, and the operator’s posture — set out in the Privacy policy and the AUP — is to weight that exception heavily where an erasure request bears on lawfully-published editorial material. The revFADP has an analogous erasure right under Swiss law with broadly comparable carve-outs.