Guidelines 5/2019 published by the EDPB on the Right to be Forgotten

The European Data Protection Board, or the ‘EDPB’, has issued a set of guidelines (Guidelines 5/2019) regarding the criteria of the right to be forgotten under the General Data Protection Regulation, or ‘GDPR’ (Regulation 2016/679). The right to be forgotten is dealt with in Articles 17 and 19 of the GDPR, together with the right of erasure and the notification obligation provision respectively. Guidelines 5/2019 were adopted very recently, on the 7th of July 2020, with the aim of interpreting the right to be forgotten in terms of processing by search engine providers and delisting requests submitted by data subjects. Essentially, the Guidelines were published following two cases of the Court of Justice of the European Union, (CJEU), namely the cases of ‘Google Spain vs. Costeja Gonzáles’ (Case C-131/12) and ‘Google vs. CNIL’ (Case C-136/17).

In summary, Guidelines 5/2019 set out six grounds under which a data subject can request delisting under the GDPR in relation to Article 17(1), namely:

1. When the personal data is no longer necessary in relation to the search engine provider’s processing: as discussed in the Guidelines, a data subject can request the delisting of content where the personal information is inaccurate or outdated, due to the course of time. Since this processing is carried out for the purposes of making information accessible to internet users, an analysis will be held to undertake to balance the protection of privacy of a data subject with the interests of internet users to access information.
2. When the data subject withdraws consent and where there is no other legal basis for the processing: here, the Guidelines point out that it is unlikely for a data subject to submit a delisting request on the basis that he/she wishes to withdraw consent since the data controller who indexes the data in this case is the web publisher, and not the search engine operator. Therefore, the Guidelines specify that in the event where a data subject would have withdrawn his/her consent for the use of his/her data in a particular web page, the original publisher of that page should inform the search engine providers who have indexed the data, as per Article 17(2) of GDPR. Subsequently, the data subject could obtain the delisting of personal data according to Article 17(1)(c);
3. When the data subject has exercised his/her right to object to the processing of his/her personal data: the Guidelines highlight the fact that in terms of this ground, a data subject can object to data processing on the grounds relating to his/her particular situation where there are no overriding legitimate grounds. The ‘particular situation’ of that data subject (for example the search results undermine his/her personal reputation) will underpin the delisting request in this regard;
4. When the personal data has been unlawfully processed: the Guidelines refer to the fact that the notion of unlawful processing is to be interpreted broadly yet objectively, and that in cases where no legal basis for processing is demonstrated, the processing in such case may be considered unlawful;
5. When the personal data has to be erased for compliance with a legal obligation: this may result from an injunction, an express request by national or EU law, or a mere breach of the retention period by the search engine provider; and
6. When the personal data has been collected in relation to the offer of information society services, or ISS, to a child: the activities of search engine providers are likely to fall within the scope of ISS and here, the context of the collection of personal data by the original controller must be considered.

The second part of Guidelines 5/2019 provides five exceptions to the right to request delisting as per Article 17(3) of the GDPR:

• The first exception relates to a situation where the processing is necessary for exercising the right of freedom of expression and information. Here it is concluded that search engine providers can refuse to delist a content if they are able to show that its inclusion in the list of results is strictly necessary for protecting the freedom of information of internet users.
• The second exception deals with situations where the processing is necessary for compliance with a legal obligation to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller. In relation to the notion of compliance with a legal obligation, the Guidelines state that the assessment of the delisting request should not assume that the legal obligation of publication necessarily implies that it is not possible to accept the delisting request by the search engine provider. Here, the decision on the delisting request should once again be taken in view of striking a balance between the rights of the data subject and the interest of the Internet users to access the information. The second part of this exception deals with the performance of a task carried out in public interest, or in the exercise of official authority vested in the controller. The Guidelines highlight the fact that the denial to follow a data subject’s delisting request cannot rely on this exception and that the Supervisory Authority of the Member State whose law is applicable, must deal with a potential complaint in relation to Article 55(2) of the GDPR.
• The third and fourth exceptions relate to reasons of public interest in the area of public health and archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as this is likely to render impossible, or seriously impair the achievement of the objectives of that processing. In terms of the former exception, the Guidelines state that the effects of delisting must be understood as only deleting some results from the results page that is obtained when a name is entered as a search criterion, and not that the information is entirely deleted from the search engine providers’ indexes. In terms of the latter exception, the Guidelines affirm that the purposes must be objectively sought by the search engine provider, without a link between the name of the data subject and the search results being necessary.
• The final exception deals with the establishment, exercise or defence of legal claims. The Guidelines note that under a delisting process, the information remains accessible when using other search terms.

For further information about how GVZH Advocates can help you with your data protection queries, kindly contact us on dataprotection@gvzh.mt