Eternal Sunshine: the Right to Be Forgotten in the European Union After the 2016 General Data Protection Regulation

• Jurisdiction: European Union
• Citation: Vol. 32 No. 1
• Publication year: 2017

Eternal Sunshine: The Right to Be Forgotten in the European Union after the 2016 General Data Protection Regulation

Stefania Alessi

ETERNAL SUNSHINE: THE RIGHT TO BE FORGOTTEN IN THE EUROPEAN UNION AFTER THE 2016 GENERAL DATA PROTECTION REGULATION

Introduction

"Blessed are the forgetful, for they get the better even of their blunders."

In the movie "Eternal Sunshine of the Spotless Mind," the couple portrayed by Kate Winslet and Jim Carey seeks to erase all memories of each other when their relationship turns sour. Aside from the Hollywood gimmicks of memory erasure, we all have personal information, memories, and opinions that we wish to keep private. The advent of the Internet made this task more complicated.

The Internet revolutionized the information market by allowing people access to a potentially unlimited amount of information with just a computer and connection.¹ Not only is information on the Internet more accessible, but it is also eternal.² Once information is uploaded, the Internet stores it permanently, in what has been called "digital eternity."³ Hence, when personal information is uploaded online,⁴ our most embarrassing or painful moments may acquire lasting significance and haunt our lives.⁵ The Internet is an integral part of our lives to collect information, manage finances, socialize, and shop. Thus, it risks infringing upon individuals' right to privacy.

In 2014, the Court of Justice of the European Union recognized the existence of the individual right to be forgotten as part of the right to data protection in the case Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (Google Spain).⁶ The right to be forgotten (RTBF) is the right of an individual to request search engine providers, such as Google, to

[Page 146]

remove links to personal information that the individual deems prejudicial to him or wishes to be removed.⁷ In May 2016, the European Council and the European Parliament enacted the General Data Protection Regulation (GDPR) to provide a uniform normative framework for the RTBF (also called "right to erasure"⁸ ) and harmonize data protection across the EU.⁹

Google Spain and the GDPR provoked heated criticism and debate as to whether the RTBF should be protected. Some authors argued that there is no expectation of privacy in personal information online.¹⁰ Others predicted that protection of the RTBF will force search engines to remove contents from the Internet and unduly compress the right of access to information and the freedom of expression.¹¹ Technology think tanks maintained that the new regulation, while giving EU citizens more control over their personal data, will be burdensome to implement for medium and small businesses, governments, and civil society groups, as it will require them to jump through too many hoops. Namely, the heavy burdens of proof and the high administrative sanctions for breach of data protection may discourage the creation of start-ups and impair scientific research.¹²

In response to the critics, this Comment presents two main arguments.

First, the new normative framework of the RTBF is consistent with the well-established protection of the right to respect for private life recognized and protected in international law by the European Court of Human Rights (ECtHR) under the 1950 European Convention on Human Rights (ECHR).

Second, the GDPR will not harm the right to information because it guides search engines to duly balance the right to data protection and the right to information. Clear guidance for the data controllers will result in greater uniformity of decisions in RTBF claims. Also, the structure of the Internet

[Page 147]

market will safeguard the right to information and the search engine's economic rights.

This Comment will focus solely on the protection of the RTBF in the EU and will not address issues related to the territorial application of the European data protection legislation.

Part I provides an overview of the regulation of the right to private life, which germinates the right to data protection and the RTBF. Part II describes the evolution of the RTBF, from the Data Protection Directive to the Google Spain decision. Part III discusses the new discipline of the RTBF introduced by the 2016 GDPR. Part IV explains that the GDPR is in line with the EU protection of the right to data protection and right to respect for private life and that the GDPR will not harm the right to information.

I. Personal Data Protection in the European Union

The right to protection of personal data is part of the broader human right to respect for private life,¹³ which is recognized and protected both in international law and in EU law.¹⁴ This section analyzes the scope of the right to respect for private life and its evolution, with particular reference to the right to protection of personal data.

A. The International Framework

The right to respect for private life was first recognized as a human right in international law by the ECHR.¹⁵ Article 8 of the ECHR establishes that "everyone has the right to respect for his private and family life, his home and his correspondence."¹⁶ The right is formulated broadly and protects individuals' autonomy and dignity in developing their personalities both privately and in

[Page 148]

relationships with others.¹⁷ Hence, the right to respect for private life is broader than the right to privacy because it is not limited to the protection of individuals' intimate spheres but includes the right of individuals to freely pursue and fulfill their personalities in relationships with others.¹⁸ The right to private life is not absolute.¹⁹ Indeed, it can be restricted to achieve legitimate public interests like national security, public order, and prevention of crime.²⁰ The right to private life can also be restricted to protect other human rights.²¹ In particular, the right to data protection must be balanced against the right to freedom of expression.²²

The ECtHR, created by the ECHR to ensure its observance,²³ held that the right to respect for private life imposes positive and negative obligations on the contracting states.²⁴ The state has to act affirmatively with measures to ensure respect of the right and must not interfere with a person's private life, home, and correspondence.²⁵

The development of information and surveillance technology in the 1960s created the need to protect individuals' private lives by strengthening their personal data protection.²⁶ Accordingly, a Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) was opened for signature in 1981.²⁷ The convention applies to data processing by private and public entities and protects the individuals against abuses in the collection and storage of personal data.²⁸ Individuals have the right to know that personal information about them is stored and, if necessary, to correct the information. Moreover, the automatic processing and storage of

[Page 149]

"sensitive data" (data revealing race, political, religious and other beliefs, health or sexual life) are prohibited.²⁹ With Convention 108, the Council of Europe aimed to protect individuals' private and family lives against abuses in the automatic collection and storing of personal data introduced by the new information technologies.³⁰ The convention was the first international instrument to recognize the right to data protection and served as inspiration for the enactment of the 1995 Data Protection Directive by the EU.³¹

B. The European Union Framework

Because the EU was originally conceived solely as an economic union, the founding treaties³² did not contain any reference to fundamental rights.³³ Nevertheless, since its creation, the European Court of Justice (CJEU) was confronted with fundamental rights issues, especially cases of conflicts between obligations of the Member States and national constitutional laws.³⁴ The CJEU's jurisprudence gradually filled the gaps of the founding treaties.³⁵ The development of fundamental rights protection in the EU followed three stages.³⁶

In the first stage, the CJEU refused to take on any case that required an examination of European law in terms of fundamental rights and held that the protection of fundamental rights was a matter of exclusive jurisdiction of the Member States.³⁷ In the second stage, criticism by the Member States and the establishment of the supremacy principle of EU law³⁸ over national legislation

[Page 150]

led the CJEU to declare that fundamental rights were general principles of EU law and therefore protected by the CJEU.³⁹ Finally, in the third stage, the CJEU held that the Member States are also bound by EU fundamental rights when acting within the scope of the EU.⁴⁰ The court thus ensured consistent protection of fundamental rights by EU institutions and national governments.⁴¹ However, the EU still lacked its own bill of fundamental rights.

The 1992 Treaty of Maastricht, which formally created the EU, recognized the fundamental rights guaranteed by the ECHR as fundamental principles of EU law.⁴² Accordingly, the EU recognized the right to respect for private life. The EU institutions then sought to enhance the protection of these rights by introducing an EU bill of rights. The goal was achieved through the proclamation of the Charter of Fundamental Rights of the European Union (Charter) in 2000.⁴³

The Charter brings together the fundamental rights and principles protected in the EU, including the rights recognized by the CJEU, the rights and principles resulting from the common constitutional traditions of the Member States, and the rights and freedoms protected by the ECHR.⁴⁴ Although the Charter was originally just a political document, the 2009 Treaty of Lisbon made the Charter binding upon the Member States and the EU institutions.⁴⁵

The Charter guarantees not only the right to respect for private and family life,⁴⁶ but also...