CYIL vol. 12 (2021)

CYIL 12 (2021) THE GLOBAL REACH OF THE RIGHT TO BE FORGOTTEN THROUGH THE LENSES … 1. Introduction The right to be forgotten is one of the most controversial rights in modern EU law. It is a sort of response to an Internet that “never forgets”, and can be understood as society’s capacity for forgiveness and empathy regarding past mistakes. 1 Being established in the case- law of the Court of Justice of the European Union 2 , in particular in the case of Google Spain SL and Google Inc. v AEPD and Mario Costeja Gonzales (hereto – Google Spain) 3 , it was reflected in article 17 (Right to erasure (‘right to be forgotten’)) of the General Data Protection Regulation (hereinafter – “GDPR”) 4 , which states that “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay”. It clarifies that the right to erasure applies when: “(a) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based (…); (c) the data subject objects to the processing (…), (d) the personal data has been unlawfully processed”. It is considered that “the right to be forgotten represents a positive shift in cyberspace law and policy because it increases individuals’ control over personal information, and restores the balance between free speech and privacy in the digital world”. 5 However some scholars tend to believe the appearance of this right is “the biggest threat to free speech on the Internet in the coming decade” 6 . This is due to the fact that not all issues related to the right to be forgotten were resolved after its codification in the GDPR, so there are several main issues yet to be solved. In the Google Spain case, the Court stressed that the right enshrined in article 17 of the GDPR cannot be considered as unlimited: “as the de-referencing of search results might negatively affect others, e.g. internet users trying to obtain information on a past event, such requests have to be carefully weighed against the latter’s freedom of information” 7 . This clearly indicates possible problems in balancing this right with other rights and interests in the law-enforcement practice. Therefore, the CJEU in its judicial practice tries to consistently form an acceptable balancing position and provide the most possible level of protection of the right to data protection while respecting other rights and interests. 1 REYMOND, M. J.: The future of the European Union “Right to be Forgotten”. Latin American Law Review . 2019. Issue 2. pp. 81–98. 2 Hereinafter – the CJEU, the Court. 3 Case C-131/12 Google Inc. Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzales ECLI:EU:C:2014:317 (hereinafter – the “Google Spain” ). 4 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation). Available at: https://eur-lex.europa.eu/eli/ reg/2016/679/oj. 5 LYNDSAY, C.: The Right to Be Forgotten: A Step in the Right Direction for Cyberspace Law and Policy. Journal of Law, Technology & the Internet . 2015, vol. 6, p. 122. 6 ROSEN, J.: The Right to be Forgotten. Stanford Law Review. February 13, 2012. Vol. 64. Available at: https:// review.law.stanford.edu/wp-content/uploads/sites/3/2012/02/64-SLRO-88.pdf. 7 GLOBOCNIK, J.: The Right to Be Forgotten is Taking Shape: CJEU Judgments in GC and Others (C-136/17) and Google v CNIL (C-507/17 ) GRUR International. April 2020, vol. 69, issue 4, pp. 380–388. Available at: https://academic.oup.com/grurint/article/69/4/380/5732807.

197